7 ms·

Telegram is ridiculously smooth, runs on everything, doesn’t treat any platform as an afterthought (despite having the electron thing, Signal is still very mobi

Telegram is ridiculously smooth, runs on everything, doesn’t treat any platform as an afterthought (despite having the electron thing, Signal is still very mobile oriented), and isn’t Facebook. It’s about as good as you’re going to get without making big sacrifices somewhere.

shp0ngle 5y ago
Yeah, it’s ridiculously well made. I’m not disputing that. The protocol is weird but they built a great app on top of that. They just cannot be sustainable long term. There is literally no restriction size-wise on data you can save on their servers. For free. And they have basically no income. They have some new ad program with basically no tracking (which is good for users, sure, but nobody will pay that much for that). They get 0 commissions from payment (and I never heard anyone using their payment thing). TON went nowhere.
- tazjin 5y ago
  I'd pay double what I pay for things like media streaming services for Telegram if they had a supporter tier. It's easily the best service I use.
- wruza 5y ago
  protocol is weird You’re repeating weird, but working with both bot api and tg api weekly or so (tg api through a wrapper, but I’ve read about lower level calls and used these in gramjs) I can’t see what do you mean by that.
  - shp0ngle 5y ago
    Meaning MTProto. Not the bot API.
    - wruza 5y ago
      So, crypto part or mtproto in general? I’m not a fanboy who is going to defend tg crypto, and personally I wonder why they didn’t use the same security stack e.g. my browser uses for gmail access. But apart from that it feels to me like a regular rpc protocol, clumsy sometimes, but nothing particularly weird. Working also with many stock exchanges protocols, I can tell these are sometimes weird af, despite being mostly over-https. E.g. bitfinex and iirc bitmex are funny ones, not to mention FIX/FAST or large exchanges native protocols.
  - maemre 5y ago
    Maybe they are referring to the fact that Telegram rolled their own cryptographic protocol that had a vulnerability that was fixed with a cryptic message [1] and still has some dubious choices [2]. I am not a cryptographer by any measure, so I don't whether there was a reason why they didn't pick an existing protocol like OTR. But, it doesn't make sense to me that they didn't switch to another protocol that is audited several times but released a second version of their protocol with the same criticisms. [1]: https://words.filippo.io/dispatches/telegram-ecdh/ https://words.filippo.io/dispatches/telegram-ecdh/ [2]: https://crypto.stackexchange.com/questions/31418/signal-vs-telegram-in-terms-of-protocols https://crypto.stackexchange.com/questions/31418/signal-vs-t...
- noxer 5y ago
  The restriction is done trough throttling in speed. It only looks like you have unlimited space but lets say you would actually want to upload a TB of stuff it would take very very long unless you use multiple accounts and then if you ever would need to download it it would again take very very long. It also seems like files that are not downloaded by many people for a while get moved to slow servers and downloading these is really really really slow. If you have a few GB and want an additional online backup sure you could abuse it for that but realistically the potential to abuse it is low as it simply makes no sense as a could storage + they simply delete accounts from people who abuse the network. "Spam" is very lose defined and if you spam upload/download I'm sure they consider that to be spam and delete your account. Kinda pointless "backup" if you can lose access the moment you use the backup. >And they have basically no income. How would you know? They launched ads in public channels. >TON went nowhere. TON exists and seems functional just doesn't have anything to do with Telegram anymore due to the SEC.
fastball 5y ago
The reason Telegram is able to easily outclass WA and Signal in the UX department is due to the lack of E2EE. If you don't need/want that it is clearly superior, but if you do...
- msh 5y ago
  WhatsApp just recently added E2E and before that was still outclassed by telegram.
  - throwjs51009 5y ago
    'Recently' is 2016.
- konart 5y ago
  What does UX\UI has to do with E2EE? Sure, Telegram team used more human resources elsewhere while WA and Signal where doing their E2EE magic, but once they where done - what stopped them from investing into everything else?
  - smt88 5y ago
    Zero-knowledge E2EE makes it difficult or impossible to implement certain "quality of life" features that users have come to expect from cloud-based services. The most salient of these is that, if you lose your keys, you may never be able to recover your data.
  - Andrew_nenakhov 5y ago
    If you have true e2ee, you can't enter your login/password and see all your chats right there, instantly.
    - piaste 5y ago
      Are you sure? You can do what good password managers do: - Hash the password client-side - Send the hash to the server. The server treats it as a password, and gives you your blob of encrypted data - Decrypt the data client-side using the original password
gonehome 5y ago
Isn't the big sacrifice with Telegram security? I get that people like its UX, but if you're sacrificing security for UX then basically anything becomes fine?
- konart 5y ago
  For most people the said security is not a big issue. Esp. in countries where police can come for you and make you talk by any means. E2EE won't help you if they want you.
  - smt88 5y ago
    "Encryption isn't useful because you can be tortured" is a bizarre and ridiculous argument. The police can only make you talk if they know who to make talk in the first place. Reading your messages tells them who to interrogate, where to find them, who else is involved, etc. Encryption is important especially in such countries.
    - j16sdiz 5y ago
      It is encrypted, just not e2ee. The police need to crack the encryption protocol (not impossible, telegram use non-standard crypto), or somehow gain access to telegram's server farm.
      - GoblinSlayer 5y ago
        Wasn't it fixed? It was almost e2ee, but not really due to a bug as it trusted the server, but it was fixed save for key verification, but AFAIK, key verification is an open problem in e2ee.
      - throwjs51009 5y ago
        That's not true. Nobody needs to crack any encryption. Check my other comment with 3 links.
    - konart 5y ago
incompatible 5y ago
I took a look, but apparently you can't use the web app unless you already have an account, and you can only create an account in a mobile app. Is this an afterthought?
- kasper_kerem 5y ago
  Found out the same thing. I guess they started from mobile, moved to web and git something better to do :)
  - incompatible 5y ago
    I guess they want to know your phone number, or want to limit accounts to one per phone number. Edit: but even so, they could verify a phone number by SMS, no need to make anyone install an app.
thwoeriu234 5y ago
Telegram is the only platform that "works" on Jolla. WA/Signal are both proprietary and will not work outside the Google-Apple "pleb sandbox".
- egberts1 5y ago
  Pffft. Signal is proprietary? it is on https://Github.com/SignalApp https://Github.com/SignalApp and i’ve got my own variant of Signal server and client running. and runs on not only mobile but Linux too.
  - AnonC 5y ago
    ...except that for nearly a year you didn't have access to any updates to the Signal server code on their public repo while they were secretly adding Mobilecoin to it.
    - egberts1 5y ago
      of course. it a necessary submarine method to a rollout if not enough developers are on hand. Bad move, IMHO. but it is easily excised.
  - SecurityLagoon 5y ago
    Out of curiosity why do you run your own Signal server when there is no federation?
    - egberts1 5y ago
      a study of Signal protocols.

shp0ngle 5y ago

Yeah, it’s ridiculously well made. I’m not disputing that. The protocol is weird but they built a great app on top of that. They just cannot be sustainable long term. There is literally no restriction size-wise on data you can save on their servers. For free. And they have basically no income. They have some new ad program with basically no tracking (which is good for users, sure, but nobody will pay that much for that). They get 0 commissions from payment (and I never heard anyone using their payment thing). TON went nowhere.

tazjin 5y ago
I'd pay double what I pay for things like media streaming services for Telegram if they had a supporter tier. It's easily the best service I use.
wruza 5y ago
protocol is weird You’re repeating weird, but working with both bot api and tg api weekly or so (tg api through a wrapper, but I’ve read about lower level calls and used these in gramjs) I can’t see what do you mean by that.
- shp0ngle 5y ago
  Meaning MTProto. Not the bot API.
  - wruza 5y ago
    So, crypto part or mtproto in general? I’m not a fanboy who is going to defend tg crypto, and personally I wonder why they didn’t use the same security stack e.g. my browser uses for gmail access. But apart from that it feels to me like a regular rpc protocol, clumsy sometimes, but nothing particularly weird. Working also with many stock exchanges protocols, I can tell these are sometimes weird af, despite being mostly over-https. E.g. bitfinex and iirc bitmex are funny ones, not to mention FIX/FAST or large exchanges native protocols.
- maemre 5y ago
  Maybe they are referring to the fact that Telegram rolled their own cryptographic protocol that had a vulnerability that was fixed with a cryptic message [1] and still has some dubious choices [2]. I am not a cryptographer by any measure, so I don't whether there was a reason why they didn't pick an existing protocol like OTR. But, it doesn't make sense to me that they didn't switch to another protocol that is audited several times but released a second version of their protocol with the same criticisms. [1]: https://words.filippo.io/dispatches/telegram-ecdh/ https://words.filippo.io/dispatches/telegram-ecdh/ [2]: https://crypto.stackexchange.com/questions/31418/signal-vs-telegram-in-terms-of-protocols https://crypto.stackexchange.com/questions/31418/signal-vs-t...
noxer 5y ago
The restriction is done trough throttling in speed. It only looks like you have unlimited space but lets say you would actually want to upload a TB of stuff it would take very very long unless you use multiple accounts and then if you ever would need to download it it would again take very very long. It also seems like files that are not downloaded by many people for a while get moved to slow servers and downloading these is really really really slow. If you have a few GB and want an additional online backup sure you could abuse it for that but realistically the potential to abuse it is low as it simply makes no sense as a could storage + they simply delete accounts from people who abuse the network. "Spam" is very lose defined and if you spam upload/download I'm sure they consider that to be spam and delete your account. Kinda pointless "backup" if you can lose access the moment you use the backup. >And they have basically no income. How would you know? They launched ads in public channels. >TON went nowhere. TON exists and seems functional just doesn't have anything to do with Telegram anymore due to the SEC.

fastball 5y ago

The reason Telegram is able to easily outclass WA and Signal in the UX department is due to the lack of E2EE. If you don't need/want that it is clearly superior, but if you do...

msh 5y ago
WhatsApp just recently added E2E and before that was still outclassed by telegram.
- throwjs51009 5y ago
  'Recently' is 2016.
konart 5y ago
What does UX\UI has to do with E2EE? Sure, Telegram team used more human resources elsewhere while WA and Signal where doing their E2EE magic, but once they where done - what stopped them from investing into everything else?
- smt88 5y ago
  Zero-knowledge E2EE makes it difficult or impossible to implement certain "quality of life" features that users have come to expect from cloud-based services. The most salient of these is that, if you lose your keys, you may never be able to recover your data.
- Andrew_nenakhov 5y ago
  If you have true e2ee, you can't enter your login/password and see all your chats right there, instantly.
  - piaste 5y ago
    Are you sure? You can do what good password managers do: - Hash the password client-side - Send the hash to the server. The server treats it as a password, and gives you your blob of encrypted data - Decrypt the data client-side using the original password

gonehome 5y ago

Isn't the big sacrifice with Telegram security? I get that people like its UX, but if you're sacrificing security for UX then basically anything becomes fine?

konart 5y ago
For most people the said security is not a big issue. Esp. in countries where police can come for you and make you talk by any means. E2EE won't help you if they want you.
- smt88 5y ago
  "Encryption isn't useful because you can be tortured" is a bizarre and ridiculous argument. The police can only make you talk if they know who to make talk in the first place. Reading your messages tells them who to interrogate, where to find them, who else is involved, etc. Encryption is important especially in such countries.
  - j16sdiz 5y ago
    It is encrypted, just not e2ee. The police need to crack the encryption protocol (not impossible, telegram use non-standard crypto), or somehow gain access to telegram's server farm.
    - GoblinSlayer 5y ago
      Wasn't it fixed? It was almost e2ee, but not really due to a bug as it trusted the server, but it was fixed save for key verification, but AFAIK, key verification is an open problem in e2ee.
    - throwjs51009 5y ago
      That's not true. Nobody needs to crack any encryption. Check my other comment with 3 links.
  - konart 5y ago

incompatible 5y ago

I took a look, but apparently you can't use the web app unless you already have an account, and you can only create an account in a mobile app. Is this an afterthought?

kasper_kerem 5y ago
Found out the same thing. I guess they started from mobile, moved to web and git something better to do :)
- incompatible 5y ago
  I guess they want to know your phone number, or want to limit accounts to one per phone number. Edit: but even so, they could verify a phone number by SMS, no need to make anyone install an app.

thwoeriu234 5y ago

Telegram is the only platform that "works" on Jolla. WA/Signal are both proprietary and will not work outside the Google-Apple "pleb sandbox".

egberts1 5y ago
Pffft. Signal is proprietary? it is on https://Github.com/SignalApp https://Github.com/SignalApp and i’ve got my own variant of Signal server and client running. and runs on not only mobile but Linux too.
- AnonC 5y ago
  ...except that for nearly a year you didn't have access to any updates to the Signal server code on their public repo while they were secretly adding Mobilecoin to it.
  - egberts1 5y ago
    of course. it a necessary submarine method to a rollout if not enough developers are on hand. Bad move, IMHO. but it is easily excised.
- SecurityLagoon 5y ago
  Out of curiosity why do you run your own Signal server when there is no federation?
  - egberts1 5y ago
    a study of Signal protocols.