4 ms·

Let's do an apples to apples comparison -End-to-end encrypted by default (WA yes, Telegram No) -End-to-end encrypted group chats (WA yes, Telegram No) -End-t

by maqp 5y ago

Let's do an apples to apples comparison -End-to-end encrypted by default (WA yes, Telegram No) -End-to-end encrypted group chats (WA yes, Telegram No) -End-to-end encrypted group video calls (WA yes, Telegram No) -End-to-end encrypted desktop chats (WA yes, Telegram No) -Client-side encrypted cloud backups (WA yes, Telegram No) -Cross-platform end-to-end encrypted chats (WA yes, Telegram No) It's a bit hard to make a case for Telegram's good intentions when they lack the ability to actually deploy usable, ubiquitous end-to-end encryption. They could even pay people like Moxie to implement it for them, which begs the question, why haven't they. Durov absolutely has the money. Yes WA and FB has access to your communications metadata, but so does Telegram. And every entity that hacks Telegram. Pavel Durov isn't a magical entity of good will and intentions, he's a Russian guy with sure, decent eye towards good user experience, but the cost for that is too great, considering he's never hired a competent cryptographer to even see if the features the app provides could be implemented in a privacy preserving way. I'd love to be able to defend Telegram's design choices, but the more they spend their time adding "sleek animations" and other bs features, the clearer it becomes it's just another social media platform with same privacy features as Facebook Messenger: -Not end-to-end encrypted by default (Telegram Yes, FBM yes) -No end-to-end encrypted group chats (Telegram Yes, FBM yes) -Opt-in 1:1 end-to-end encrypted chats on mobile (Telegram Yes, FBM yes) In that comparison, WA comes at the top. But then again, it's a false dichotomy as Signal puts incremental privacy features with no real down-sides. -Open source clients (Signal yes, WA no) -Reproducible builds (Signal yes, WA no) -User-managed groups (Signal yes, WA no) (And no, Telegram being open source with reproducible builds isn't really worth anything until the verification confirms that it's really using proper E2EE. Currently Telegram's source only confirms that it's not E2EE by default etc.) As for the surveillance capitalistic aspect, Telegram is only as good as their word. FB wasn't surveillance capitalistic when it started back in 2005. Telegram isn't slaughtering the piglet before it's time to cash in, but they can get hacked at any point, and the hundreds of billions of messages that sit on their server, effectively unencrypted (storing the database key in server's memory is the same as "not encrypted"), Telegram isn't private even if Durov never wanted to use that data. The fact is experts agree such data is a liability, a toxic asset, that nobody can protect forever. Durov isn't as security researcher patching zero-days faster than NSA, GCHQ, Fancy Bear, Unit8200, CCA et. al. find them. Most probably Durov wouldn't even realize a rootkit has been sneaking data out of his server for the past 8 years. Compared to these risks, WA has been ahead of Telegram ever since they implemented Signal protocol in 2016.

emptysongglass 5y ago
You're evaluating Telegram with many paragraphs given to your metric, which is E2EE. That's fair enough but it's not representative for what many users outside of the HN bubble are evaluating by. For me I value all of the features I wrote in my original comment in this thread more than I value E2EE by default. If someone were to come to me and offer me E2EE by default without those features I would say no thank you. What I don't want is a corporation behind my chat app whose business is in monetizing my data. If Durov can keep Telegram out of that business I will be pleased.
- maqp 5y ago
  Oh please. You're complaining about technical person evaluating technical product on technical level, on a technical forum. E2EE is the bare minimum for security these days, as so carefully explained by the message you're replying to. "If someone were to come to me and offer me E2EE by default without those features I would say no thank you." This is such a loaded and unthoughtful comment. It assumes you have to make a choice. You don't, at least per technical reasoning. The only situation where you can't have E2EE is massive groups, and it's obvious those have no expectation of privacy. Anything else, I can explain to you on a technical level why it can be done in a privacy preserving way, and the only reason its not, is because Telegram's team lacks the know-how. Signal has already shown they can pull off pretty much any feature in a privacy preserving way. So the question is not "what features do I need", but "should all my features be actual features". A feature that doesn't protect your privacy by definition can be used to spy on you, and I'm sure we both agree that is not a feature. So ask yourself Group chat with end-to-end encryption (Signal) or Group chat without end-to-end encryption (Telegram). Which one do you choose? The answer is obvious. >What I don't want is a corporation behind my chat app Also, you should know Telegram is not a non-profit like Signal. Telegram is a limited liability _company_. It's a for-profit entity, and the LLC only means, the owners are "legally responsible for its debts only to the extent of the amount of capital they invested".
  - emptysongglass 5y ago
    > This is such a loaded and unthoughtful comment. It assumes you have to make a choice. You don't, at least per technical reasoning. When Signal provides these features, please feel free to ping me back here but until then, the proof is in the pudding and the Signal pudding doesn't taste like the Telegram pudding. As Signal's client is open source and its server is whenever they feel like it, I'm sure they'd also value your contribution to prove out your point.

by maqp 5y ago

emptysongglass 5y ago

You're evaluating Telegram with many paragraphs given to your metric, which is E2EE. That's fair enough but it's not representative for what many users outside of the HN bubble are evaluating by. For me I value all of the features I wrote in my original comment in this thread more than I value E2EE by default. If someone were to come to me and offer me E2EE by default without those features I would say no thank you. What I don't want is a corporation behind my chat app whose business is in monetizing my data. If Durov can keep Telegram out of that business I will be pleased.

maqp 5y ago
Oh please. You're complaining about technical person evaluating technical product on technical level, on a technical forum. E2EE is the bare minimum for security these days, as so carefully explained by the message you're replying to. "If someone were to come to me and offer me E2EE by default without those features I would say no thank you." This is such a loaded and unthoughtful comment. It assumes you have to make a choice. You don't, at least per technical reasoning. The only situation where you can't have E2EE is massive groups, and it's obvious those have no expectation of privacy. Anything else, I can explain to you on a technical level why it can be done in a privacy preserving way, and the only reason its not, is because Telegram's team lacks the know-how. Signal has already shown they can pull off pretty much any feature in a privacy preserving way. So the question is not "what features do I need", but "should all my features be actual features". A feature that doesn't protect your privacy by definition can be used to spy on you, and I'm sure we both agree that is not a feature. So ask yourself Group chat with end-to-end encryption (Signal) or Group chat without end-to-end encryption (Telegram). Which one do you choose? The answer is obvious. >What I don't want is a corporation behind my chat app Also, you should know Telegram is not a non-profit like Signal. Telegram is a limited liability _company_. It's a for-profit entity, and the LLC only means, the owners are "legally responsible for its debts only to the extent of the amount of capital they invested".
- emptysongglass 5y ago
  > This is such a loaded and unthoughtful comment. It assumes you have to make a choice. You don't, at least per technical reasoning. When Signal provides these features, please feel free to ping me back here but until then, the proof is in the pudding and the Signal pudding doesn't taste like the Telegram pudding. As Signal's client is open source and its server is whenever they feel like it, I'm sure they'd also value your contribution to prove out your point.