8 ms·
This article is good. Telegram is really weird and sketchy; the rants Durov posts on his channel against WhatsApp usually make no sense; and their claims of se
by shp0ngle 5y ago
This article is good.
Telegram is really weird and sketchy; the rants Durov posts on his channel against WhatsApp usually make no sense; and their claims of security are dubious. And TON was a disaster.
On the other hand. If I did any social organizing today, I would definitely use Telegram. Signal is fine, but nobody is using it and the UX is just worse. I don't trust Facebook to randomly not shut everything down because some outsourced content moderator in New Delhi had a bad sleep.
Durov might be sketchy and weird libertarian, but damn, his developers can deliver good and working product really fast. (And from what I understand, it's a really small team.) Credit where it's due.
I still think Telegram will plainly run out of money in a few years (you can use it to host unlimited amount of data and share it with unlimited number of people!! that is not sustainable), but well, I will use them before they do.
- kitsunesoba 5y agoTelegram is ridiculously smooth, runs on everything, doesn’t treat any platform as an afterthought (despite having the electron thing, Signal is still very mobile oriented), and isn’t Facebook. It’s about as good as you’re going to get without making big sacrifices somewhere.
- shp0ngle 5y agoYeah, it’s ridiculously well made. I’m not disputing that. The protocol is weird but they built a great app on top of that. They just cannot be sustainable long term. There is literally no restriction size-wise on data you can save on their servers. For free. And they have basically no income. They have some new ad program with basically no tracking (which is good for users, sure, but nobody will pay that much for that). They get 0 commissions from payment (and I never heard anyone using their payment thing). TON went nowhere.
- tazjin 5y agoI'd pay double what I pay for things like media streaming services for Telegram if they had a supporter tier. It's easily the best service I use.
- wruza 5y agoprotocol is weird You’re repeating weird, but working with both bot api and tg api weekly or so (tg api through a wrapper, but I’ve read about lower level calls and used these in gramjs) I can’t see what do you mean by that.
- shp0ngle 5y agoMeaning MTProto. Not the bot API.
- wruza 5y agoSo, crypto part or mtproto in general? I’m not a fanboy who is going to defend tg crypto, and personally I wonder why they didn’t use the same security stack e.g. my browser uses for gmail access. But apart from that it feels to me like a regular rpc protocol, clumsy sometimes, but nothing particularly weird. Working also with many stock exchanges protocols, I can tell these are sometimes weird af, despite being mostly over-https. E.g. bitfinex and iirc bitmex are funny ones, not to mention FIX/FAST or large exchanges native protocols.
- maemre 5y agoMaybe they are referring to the fact that Telegram rolled their own cryptographic protocol that had a vulnerability that was fixed with a cryptic message [1] and still has some dubious choices [2]. I am not a cryptographer by any measure, so I don't whether there was a reason why they didn't pick an existing protocol like OTR. But, it doesn't make sense to me that they didn't switch to another protocol that is audited several times but released a second version of their protocol with the same criticisms. [1]: https://words.filippo.io/dispatches/telegram-ecdh/ https://words.filippo.io/dispatches/telegram-ecdh/ [2]: https://crypto.stackexchange.com/questions/31418/signal-vs-telegram-in-terms-of-protocols https://crypto.stackexchange.com/questions/31418/signal-vs-t...
- noxer 5y agoThe restriction is done trough throttling in speed. It only looks like you have unlimited space but lets say you would actually want to upload a TB of stuff it would take very very long unless you use multiple accounts and then if you ever would need to download it it would again take very very long. It also seems like files that are not downloaded by many people for a while get moved to slow servers and downloading these is really really really slow. If you have a few GB and want an additional online backup sure you could abuse it for that but realistically the potential to abuse it is low as it simply makes no sense as a could storage + they simply delete accounts from people who abuse the network. "Spam" is very lose defined and if you spam upload/download I'm sure they consider that to be spam and delete your account. Kinda pointless "backup" if you can lose access the moment you use the backup. >And they have basically no income. How would you know? They launched ads in public channels. >TON went nowhere. TON exists and seems functional just doesn't have anything to do with Telegram anymore due to the SEC.
- fastball 5y agoThe reason Telegram is able to easily outclass WA and Signal in the UX department is due to the lack of E2EE. If you don't need/want that it is clearly superior, but if you do...
- msh 5y agoWhatsApp just recently added E2E and before that was still outclassed by telegram.
- throwjs51009 5y ago'Recently' is 2016.
- konart 5y agoWhat does UX\UI has to do with E2EE? Sure, Telegram team used more human resources elsewhere while WA and Signal where doing their E2EE magic, but once they where done - what stopped them from investing into everything else?
- smt88 5y agoZero-knowledge E2EE makes it difficult or impossible to implement certain "quality of life" features that users have come to expect from cloud-based services. The most salient of these is that, if you lose your keys, you may never be able to recover your data.
- Andrew_nenakhov 5y agoIf you have true e2ee, you can't enter your login/password and see all your chats right there, instantly.
- piaste 5y agoAre you sure? You can do what good password managers do: - Hash the password client-side - Send the hash to the server. The server treats it as a password, and gives you your blob of encrypted data - Decrypt the data client-side using the original password
- gonehome 5y agoIsn't the big sacrifice with Telegram security? I get that people like its UX, but if you're sacrificing security for UX then basically anything becomes fine?
- konart 5y agoFor most people the said security is not a big issue. Esp. in countries where police can come for you and make you talk by any means. E2EE won't help you if they want you.
- smt88 5y ago"Encryption isn't useful because you can be tortured" is a bizarre and ridiculous argument. The police can only make you talk if they know who to make talk in the first place. Reading your messages tells them who to interrogate, where to find them, who else is involved, etc. Encryption is important especially in such countries.
- j16sdiz 5y agoIt is encrypted, just not e2ee. The police need to crack the encryption protocol (not impossible, telegram use non-standard crypto), or somehow gain access to telegram's server farm.
- GoblinSlayer 5y agoWasn't it fixed? It was almost e2ee, but not really due to a bug as it trusted the server, but it was fixed save for key verification, but AFAIK, key verification is an open problem in e2ee.
- throwjs51009 5y agoThat's not true. Nobody needs to crack any encryption. Check my other comment with 3 links.
- konart 5y ago
- incompatible 5y agoI took a look, but apparently you can't use the web app unless you already have an account, and you can only create an account in a mobile app. Is this an afterthought?
- kasper_kerem 5y agoFound out the same thing. I guess they started from mobile, moved to web and git something better to do :)
- incompatible 5y agoI guess they want to know your phone number, or want to limit accounts to one per phone number. Edit: but even so, they could verify a phone number by SMS, no need to make anyone install an app.
- thwoeriu234 5y agoTelegram is the only platform that "works" on Jolla. WA/Signal are both proprietary and will not work outside the Google-Apple "pleb sandbox".
- egberts1 5y agoPffft. Signal is proprietary? it is on https://Github.com/SignalApp https://Github.com/SignalApp and i’ve got my own variant of Signal server and client running. and runs on not only mobile but Linux too.
- AnonC 5y ago...except that for nearly a year you didn't have access to any updates to the Signal server code on their public repo while they were secretly adding Mobilecoin to it.
- egberts1 5y agoof course. it a necessary submarine method to a rollout if not enough developers are on hand. Bad move, IMHO. but it is easily excised.
- SecurityLagoon 5y agoOut of curiosity why do you run your own Signal server when there is no federation?
- egberts1 5y agoa study of Signal protocols.
- throwjs51009 5y ago// On the other hand. If I did any social organizing today, I would definitely use Telegram // Don't, unless it's for a BBQ or friendly partying. [1] https://www.wired.com/story/brazil-hacker-bolsonaro-car-wash-leaks/ https://www.wired.com/story/brazil-hacker-bolsonaro-car-wash... [2] https://www.reuters.com/article/us-iran-cyber-telegram-exclusive-idUSKCN10D1AM https://www.reuters.com/article/us-iran-cyber-telegram-exclu... [3] https://www.haaretz.com/israel-news/tech-news/.premium-exclusive-intricate-hack-against-israeli-crypto-execs-mossad-investigating-1.9211991 https://www.haaretz.com/israel-news/tech-news/.premium-exclu... C'mon, it's not even E2E. It's as good as Facebook Messenger when it comes to security.
- theshrike79 5y agoThe funniest thing is that Telegram's group management tools blow anything FB has out of the water by a nautical mile. If you only need the one channel and you need to manage a 100+ people, Telegram is by far the best tool. For "communities" Discord is a bit better, since you can split stuff to multiple channels. Anyone with basic knowledge of the internet can also install bots on both to manage dozens of different things. Signal on the other hand is SUPER SECURE (although you will be giving your phone number to everyone), but no bots and no real ways to manage hundreds of possibly unruly people on a single channel.
- Andrew_nenakhov 5y agoDoes anyone need e2ee on group chats anyway?
- theshrike79 5y agoNope. If you're managing a 100+ user channel, encryption matters fuck-all unless your invitation process is 100% airtight and every user has all their devices encrypted and locked up at all times. Data will leak anyway so E2EE won't bring any real advantages.
- Andrew_nenakhov 5y agoThat was a rhetorical question, of course, but thank you for confirming my opinion.
- TuringTest 5y agoPolitical parties typically do, and some are known to use Telegram for their internal groups. Any leakage of secret knowledge shared only through these groups could be detected as treason by one of the participants in that channel. Having several channels with fewer and fewer members, closer to the party's leadership, is a typical configuration to maintain control of the most secret information.
- gefhfffh 5y ago> If you only need the one channel and you need to manage a 100+ people, Telegram is by far the best tool. Even better than Element? In my experience it does well with hundreds of people as well. And it allows to group channels as well, or use bots And you can use E2EE everywhere you think you want it
- caskstrength 5y ago> I still think Telegram will plainly run out of money in a few years (you can use it to host unlimited amount of data and share it with unlimited number of people!! that is not sustainable), but well, I will use them before they do. FYI they recently got an ad platform https://promote.telegram.org/ https://promote.telegram.org/
- rvz 5y ago> On the other hand. If I did any social organizing today, I would definitely use Telegram. Signal is fine, but nobody is using it and the UX is just worse. I don't trust Facebook to randomly not shut everything down because some outsourced content moderator in New Delhi had a bad sleep. I don't see how Telegram is any different to say, Signal. It may have better apps, UX, features and more which that alone makes it a compelling competitor but its optional E2EE support is quite damning. The great thing about regulations is that it stops such suspicious projects like TON dead in their tracks. After the ICO madness in 2017, unregistered ICOs have become illegal and TON fell in that category. But who knows, maybe when the terrorists, extremists, scammers and fraudsters realise that Telegram is not E2EE by default or layman terms 'not secure', perhaps they would run to Signal and chat amongst themselves about using a private untraceable cryptocurrency like MobileCoin to fund and plan their operations. [0] [1]. [0] https://www.theverge.com/22249391/signal-app-abuse-messaging-employees-violence-misinformation https://www.theverge.com/22249391/signal-app-abuse-messaging... [1] https://foreignpolicy.com/2021/03/13/telegram-signal-apps-right-wing-extremism-islamic-state-terrorism-violence-europol-encrypted/ https://foreignpolicy.com/2021/03/13/telegram-signal-apps-ri...
- konart 5y ago>I don't see how Telegram is any different to say, Signal. It may have better apps, UX, features and more which that alone makes it a compelling competitor You have answered your own question there. Humans naturally chose paths that they find convenient, not necessarily safest or otherwise "better" paths.
- DocTomoe 5y agoAlso, out of the "popular" IM networks (network effect is a real thing), Telegram is the only one that has a sensible API to interface with your own systems.
- jcelerier 5y ago> his developers can deliver good and working product really fast. (And from what I understand, it's a really small team.) People keep insisting that electron is chosen for productivity yet telegram delivers more features with more efficiency in C++/QtWidgets (for the desktop) with a smaller team than so many electron stuff
- lpcvoid 5y agoYou get efficiency basically for free with C++/Qt, unlike all of the Electron trash that gets pushed out. It's such a selfish way of thinking - "I don't care if my users can use efficient software, I just care about shoehorning Javascript into everything I touch!"
- emptysongglass 5y agoI take issue with your description of Telegram as "really weird and sketchy". You don't give any evidence other than Durov's personal opinions. And he's certainly entitled to them, given all the weird, often totally illogical beliefs everyone else in the world holds. You toss out another statement in "TON was a disaster" without explanation. If you're going to make really big statements like this, please go into detail otherwise you're just shooting from the hip. TON was a disaster because the SEC got involved. TON, as a technical solution to decentralizing Telegram, was a great idea and I'm sad Telegram was forced into a position of paying for all that infrastructure another way, with ads (opt-in, non-tracking, and only in one-to-many channels but still, ads).
- deleted 5y ago[deleted]
- tentacleuno 5y ago> Telegram is really weird and sketchy; the rants Durov posts on his channel against WhatsApp usually make no sense; and their claims of security are dubious. And TON was a disaster. Oh yes, definitely. Whenever I read them it feels strange, understanding the technical context of Telegram. He never mentions that WhatsApp is actually end-to-end encrypted. He does continue to talk about 'encryption', though. It's very very misleading. It just seems to be bashing WhatsApp without talking about Telegram's shortcomings too. He obviously isn't going to be non-partisan but it would be nice if he would be a little more honest.
- tentacleuno 5y ago> Durov might be sketchy and weird libertarian, but damn, his developers can deliver good and working product really fast. (And from what I understand, it's a really small team.) Credit where it's due. The UX is great. The Telegram clients are quite nice to use. They're open-source, too. Well, 'open-source' as in they dump a huge diff into the source tree now and again, and they never interact with outside developers submitting Feature Requests and Issues.
- trenchgun 5y agoWhen Telegram eventually fails, I expect there to be a Matrix client of similar quality and will just start using it.
- McDev 5y ago>his developers can deliver good and working product really fast. (And from what I understand, it's a really small team.) Fun fact, their Android code [0] (haven't seen iOS) is unmaintainable mess and on the surface just looks like a complete disaster. I find it baffling how Telegram Android not only hasn't fallen to bits requiring a full rewrite, but has continued to deliver brilliant UX and features. 0. https://raw.githubusercontent.com/DrKLO/Telegram/master/TMessagesProj/src/main/java/org/telegram/ui/ChatActivity.java https://raw.githubusercontent.com/DrKLO/Telegram/master/TMes...
- gaius_baltar 5y ago> I still think Telegram will plainly run out of money in a few years (you can use it to host unlimited amount of data and share it with unlimited number of people!! that is not sustainable), but well, I will use them before they do. And then they will start selling all the personal data they gathered in all these years. They have all the data, except for the tiny amount that passed through secret chats (but they also have the metadata for these, tied to accounts and all the non-secret stuff). The kind of data Signal can't sell even if Moxie turns evil, simply because Signal does not have it.