5 ms·

Telegram is encrypted OVER THE WIRE and AT REST by default with strong encryption no matter what you do. It's E2EE if you select private chat with someone. Lo

by skrowl 5y ago

Telegram is encrypted OVER THE WIRE and AT REST by default with strong encryption no matter what you do. It's E2EE if you select private chat with someone. Lots of FUD out there there about Telegram not being encrypted that's just not true. There's nothing either side can to do send a message in clear text / unencrypted.

542458 5y ago
For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? Does the former mean that telegram itself can read non-private-chat messages if it so chooses?
- Gigachad 5y ago
  Pretty much. End to end uses the encryption keys of both _users_ to send. Over the wire has both sides use the platforms keys so the platform decrypts, stores in plain text, and sends it encrypted again to the other side. Over the wire is basically just HTTPS.
- Daegalus 5y ago
  over the wire is when its encrypted during transmission between the User and Telegram's servers. HTTPS or SSL/TLS, etc. At Rest is when its encrypted in their DBs or hard drives, etc. Theoretically, Telegram can still read the contents if they wished to do so if they setup the appropriate code, or tools inbetween these steps. E2EE means that the users exchange encryption keys, and they encrypt the data at the client, so that only the other client can decrypt it. Meaning Telegram can never inspect the data if they wanted to.
  - Andrew_nenakhov 5y ago
    I very much doubt that Telegram really does encrypt messages "at rest": their server side full text search works extremely fast.
    - Daegalus 5y ago
      That's a fair assessment, I didn't make the original claim, just answered the definitions of the encryption states. I haven't dug enough to know what telegram does or claims to do.
- loeg 5y ago
  Yeah, if you connect to https://facebook.com https://facebook.com and use messenger, it's encrypted over the wire because you're using HTTPS (TLS). But it's not E2EE.
- andreyf 5y ago
  yes. worth remembering also that even with e2ee, a ad-tech-driven company could have endpoints determine marketing segments based on content of conversations ad report those to the company to better target ad spend.
  - skinkestek 5y ago
    Also, as is the case with WhatsApp, they siphon off your metdata and even have the gall to make an agreement with Google to download message content unencrypted to Google when one enable backups.
- skinkestek 5y ago
  > For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? E2EE: As long as it is correctly set up and no significant breakthroughs happens in math, nobody except the sender, the receiver can read the messages. > Does the former mean that telegram itself can read non-private-chat messages if it so chooses? Correct. They say they store messages encrypted and store keys and messages in different jurisdictions, effectively preventing themselves from abusing it or being coerced into giving it away, but this cannot be proven. If your life depends on it, use Signal, otherwise use the one you prefer and can get your friends to use (preferably not WhatsApp though as it leaks all your connections to Facebook and uploads your data unencrypted to Google for indexing(!) if you enable backups. Edited to remove ridiculously wrong statement, thanks kind SquishyPanda23 who pointed it out.
  - SquishyPanda23 5y ago
    > nobody except the sender, the receiver and the service provider can read the messages E2EE means the service provider cannot read the messages. Only the sender and receiver can.
    - skinkestek 5y ago
      Thanks! I edited a whole lot and that came out ridiculously wrong! :-)
      - SquishyPanda23 5y ago
        Haha, no problem. I do that a lot too :)
    - skinkestek 5y ago
      Forgot to upvote you yesterday, done now ;-)
blueprint 5y ago
(how) does the telegram server prevent unencrypted content? also curious - how does telegram support encryption for chatrooms without the parties being known in advance? or are those chats not encrypted?
- MertsA 5y ago
  Telegram only uses end to end encryption for secret chats. All other chats are only encrypted on the wire with Telegram's keys. Your comment was encrypted on the wire to HN but that's not going to do anything to keep it away from the FBI. The majority of all Telegram messages are only secured by Telegram's unwillingness to cave to outside pressure. It's in plaintext as far as they're concerned.
Andrew_nenakhov 5y ago
"Encrypted OVER THE WIRE and AT REST" means that telegram has easy and unfettered access to chat logs. So they can give it up to authorities. (I don't argue that they DO, just that they very much CAN). This is proven by an extremely simple experiment: you log in on your new phone, enter password and instantly see all chats. Another simple experiment points that chats are unlikely to be even encrypted at rest is that Telegram has an extremely fast server side message search. You log into a web client, half a second later you can type a search query and uncover chats from years ago.
- nicce 5y ago
  It kinda depends on if images and videos are encrypted separately and only indexed at first. How much data there are on your chats? 1 megabyte is around one thick book in plaintext. AES-CBC as example method decrypts more than 2 gigabits per second with hardware opcodes (2012 processor), for example if we look this data https://www.bearssl.org/speed.html https://www.bearssl.org/speed.html It is impossible to say based on delay when searching plaintext on this level whether there is encryption.
shawnz 5y ago
Encryption over the wire and at rest is a basic expectancy of any web service today. They would meet that criteria just by using SSL and disk encryption on their servers. E2EE is a much stronger criteria.
octorian 5y ago
> It's E2EE if you select private chat with someone. And its not E2EE if you fail to select private chat. What this means is that any conversations where you do select E2EE are the ones the "authorities" will take interest in, even if only to the extent of metadata. That's the fundamental problem with E2EE-by-exception, rather than by default. It calls attention to specific data, even if its not cleartext, rather than obscuring everything.
farzher 5y ago
are you trolling? telegram (are therefore the fbi) has full access to all content of every message. unless you use private chat, which nobody does, and isn't even available on desktop. i use it. but it's about as private as discord. which is to say not at all

by skrowl 5y ago

542458 5y ago

For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? Does the former mean that telegram itself can read non-private-chat messages if it so chooses?

Gigachad 5y ago
Pretty much. End to end uses the encryption keys of both _users_ to send. Over the wire has both sides use the platforms keys so the platform decrypts, stores in plain text, and sends it encrypted again to the other side. Over the wire is basically just HTTPS.
Daegalus 5y ago
over the wire is when its encrypted during transmission between the User and Telegram's servers. HTTPS or SSL/TLS, etc. At Rest is when its encrypted in their DBs or hard drives, etc. Theoretically, Telegram can still read the contents if they wished to do so if they setup the appropriate code, or tools inbetween these steps. E2EE means that the users exchange encryption keys, and they encrypt the data at the client, so that only the other client can decrypt it. Meaning Telegram can never inspect the data if they wanted to.
- Andrew_nenakhov 5y ago
  I very much doubt that Telegram really does encrypt messages "at rest": their server side full text search works extremely fast.
  - Daegalus 5y ago
    That's a fair assessment, I didn't make the original claim, just answered the definitions of the encryption states. I haven't dug enough to know what telegram does or claims to do.
loeg 5y ago
Yeah, if you connect to https://facebook.com https://facebook.com and use messenger, it's encrypted over the wire because you're using HTTPS (TLS). But it's not E2EE.
andreyf 5y ago
yes. worth remembering also that even with e2ee, a ad-tech-driven company could have endpoints determine marketing segments based on content of conversations ad report those to the company to better target ad spend.
- skinkestek 5y ago
  Also, as is the case with WhatsApp, they siphon off your metdata and even have the gall to make an agreement with Google to download message content unencrypted to Google when one enable backups.
skinkestek 5y ago
> For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? E2EE: As long as it is correctly set up and no significant breakthroughs happens in math, nobody except the sender, the receiver can read the messages. > Does the former mean that telegram itself can read non-private-chat messages if it so chooses? Correct. They say they store messages encrypted and store keys and messages in different jurisdictions, effectively preventing themselves from abusing it or being coerced into giving it away, but this cannot be proven. If your life depends on it, use Signal, otherwise use the one you prefer and can get your friends to use (preferably not WhatsApp though as it leaks all your connections to Facebook and uploads your data unencrypted to Google for indexing(!) if you enable backups. Edited to remove ridiculously wrong statement, thanks kind SquishyPanda23 who pointed it out.
- SquishyPanda23 5y ago
  > nobody except the sender, the receiver and the service provider can read the messages E2EE means the service provider cannot read the messages. Only the sender and receiver can.
  - skinkestek 5y ago
    Thanks! I edited a whole lot and that came out ridiculously wrong! :-)
    - SquishyPanda23 5y ago
      Haha, no problem. I do that a lot too :)
  - skinkestek 5y ago
    Forgot to upvote you yesterday, done now ;-)

blueprint 5y ago

(how) does the telegram server prevent unencrypted content? also curious - how does telegram support encryption for chatrooms without the parties being known in advance? or are those chats not encrypted?

MertsA 5y ago
Telegram only uses end to end encryption for secret chats. All other chats are only encrypted on the wire with Telegram's keys. Your comment was encrypted on the wire to HN but that's not going to do anything to keep it away from the FBI. The majority of all Telegram messages are only secured by Telegram's unwillingness to cave to outside pressure. It's in plaintext as far as they're concerned.

Andrew_nenakhov 5y ago

"Encrypted OVER THE WIRE and AT REST" means that telegram has easy and unfettered access to chat logs. So they can give it up to authorities. (I don't argue that they DO, just that they very much CAN). This is proven by an extremely simple experiment: you log in on your new phone, enter password and instantly see all chats. Another simple experiment points that chats are unlikely to be even encrypted at rest is that Telegram has an extremely fast server side message search. You log into a web client, half a second later you can type a search query and uncover chats from years ago.

nicce 5y ago
It kinda depends on if images and videos are encrypted separately and only indexed at first. How much data there are on your chats? 1 megabyte is around one thick book in plaintext. AES-CBC as example method decrypts more than 2 gigabits per second with hardware opcodes (2012 processor), for example if we look this data https://www.bearssl.org/speed.html https://www.bearssl.org/speed.html It is impossible to say based on delay when searching plaintext on this level whether there is encryption.

shawnz 5y ago

Encryption over the wire and at rest is a basic expectancy of any web service today. They would meet that criteria just by using SSL and disk encryption on their servers. E2EE is a much stronger criteria.

octorian 5y ago

> It's E2EE if you select private chat with someone. And its not E2EE if you fail to select private chat. What this means is that any conversations where you do select E2EE are the ones the "authorities" will take interest in, even if only to the extent of metadata. That's the fundamental problem with E2EE-by-exception, rather than by default. It calls attention to specific data, even if its not cleartext, rather than obscuring everything.

farzher 5y ago

are you trolling? telegram (are therefore the fbi) has full access to all content of every message. unless you use private chat, which nobody does, and isn't even available on desktop. i use it. but it's about as private as discord. which is to say not at all