9 ms·

People are consistently surprised that Telegram is not encrypted by default in any setting. You have to create a device-to-device-specific encrypted chat with y

People are consistently surprised that Telegram is not encrypted by default in any setting. You have to create a device-to-device-specific encrypted chat with your counter-party. It's not a reasonable security model, vastly outclassed by (the still quite flawed) Signal. Ultimately, we need encrypted-by-default messaging based on public/private key pairs (obscured from the uninterested user, of course).

smsm42 5y ago
If I'll ever need an app to pass around Pentagon secrets, I'll surely use Signal or something better. But if I need an app to chat with my friends and discuss what's going on without being banned and having the daily dose of Mandatory Truth injected, then Telegram works just fine so far.
j16sdiz 5y ago
Not end-to-end encrypted, but it is encrypted.
bakuninsbart 5y ago
Both Threema and Signal are the way to go with chat apps, the only advantage Telegram offers are vast groups for specific purposes. Here in Berlin, I'm getting cheap produce through telegram, get alerted to public transport controls (I do have a ticket, but sometimes friends do not), and sell/buy stuff I don't need.
- theshrike79 5y ago
  Telegram's advantages are a simple bot API and proper moderation tools for large channels.
  - krzyk 5y ago
    And an app that is small and fast (and a proper desktop app, not some electron).
    - tentacleuno 5y ago
      I'm consistently surprised when I remind myself that Telegram is a Qt app. It's so out of the norm today, when so many things [I use] are bloated Electron apps.
      - lpcvoid 5y ago
        It's also Qt Widgets based, which is even more interesting IMO. Just really, really good engineering that happened here.
- baxuz 5y ago
  Other advantages: -not being tied to a phone number -having a desktop app which doesn't suck (sync issues, connection issues, lacking features, is basically a simple proxy for your phone, etc) -allows me to use 3rd party apps -having chat history synced across my apps and devices and backed up. History is immensely important
  - gefhfffh 5y ago
    Checkout Element, it covers all that as well. However, the Desktop App is Electron, so I don't know if you are OK with that
    - lpcvoid 5y ago
      This is the main problem with Matrix for me. If they would just develop a good desktop client, I would be all over it.
      - bilal4hmed 5y ago
        Have you tried some of the alternatives like fluffychat ? I feel their UI is far ahead of the official clients
        lpcvoid 5y ago
        Actually, no. Thanks for the hint, I'll be testing that soon :)
- Tenoke 5y ago
  Funnily enough given the title, those same things have even bigger groups on Facebook than telegram in Berlin even accounting for how popular it is here.
- gefhfffh 5y ago
  TBH I would consider Matrix the way to go regarding chat. It allows app and vendor independent communication and combines e2ee with Synchronisation across arbitrary many devices (something that many people like from Telegram). These days, Threema and Signal don't support the Matrix Protocol.
- PicassoCTs 5y ago
  "Die Fahrscheine bitte! Schwarzfahren ist eine Straftat"
grandpoobah 5y ago
Nobody I know gives a shit that it's not E2E encrypted. It's a kick ass instant messenger, that's all that matters to most people. Vastly superior to Signal and others in almost every way.
- vinay427 5y ago
  Sure, but it’s for some reason framed as a WhatsApp competitor even in countries where Facebook Messenger is relatively popular, which seems silly to me. It appears to fill a similar feature niche as Facebook Messenger, not WhatsApp, even if these two categories can be somewhat conflated for most uses.
  - gonehome 5y ago
    Yeah, the irony is they position themselves as 'anti-facebook' and they're worse for the user than FB's whatsapp product from a security standpoint. I'd probably even trust FB's unencrypted messenger content to be better protected than telegram. They clearly have a loyal fan following though.
    - skinkestek 5y ago
      I absolutely don't recommend using Telegram for sensitive communications. That said, this idea > I'd probably even trust FB's unencrypted messenger content to be better protected than telegram. is ridiculous. With Facebook you know you will be datamined and the result sold to anyone who wants to buy.. With Telegram maybe Putin reads it, maybe not. One of them is a threat to my family and friends, the other is not.
      - gonehome 5y ago
        FB doesn't sell the data, they sell the ability for advertisers to advertise to groups. I'm not a fan of ad-driven models, but this is a lot different than selling data. If you're using unencrypted messaging you should assume it's public. This is true of FB messenger and Telegram, but if I had to bet on what unencrypted content is more likely to be owned I'd bet on Telegram. This is mostly a bet on where the world's best security people are and the company culture. Really though we shouldn't be relying on the benevolence of any of these company leaders, that's why people should use Signal or WhatsApp where the encryption means you don't have to (or Urbit where there is no central leader).
__void 5y ago
let's be realistic: (outside of certain self-referential bubbles - like this site) no one cares anything about encryption, if in public chats I am anonymous and untraceable (example: no one can know my phone number and there are granular privacy settings) this is enough for 98% of people out here "yes, encryption is useful if I want to send nudes to my partner or if I want to buy drugs but not while I'm asking mom for the sufflè recipe or I'm organizing a dinner with friends" this is what people think, and they are not completely wrong
- feanaro 5y ago
  "Normal" people are slowly but surely starting to care about encryption. They hear about it from people participating in self-referential bubbles like HN and then they start wondering. This is my experience.
amelius 5y ago
The source code is available, so if you don't like the defaults, you can change them?
grishka 5y ago
> based on public/private key pairs I said it many times and I'll say it again: this can't possibly work in the real world, period. People are notoriously terrible with passwords already. So terrible in fact that VKontakte (I worked there, both with Pavel and after he was ousted) had, and still has, a department dedicated to account recovery. And those are passwords, short strings that you can actually remember. You can't possibly expect an average person to keep their private key (a file you can't store in your head) absolutely secret and never lose it at the same time. In my world, the ability to recover your account if you lose everything is a hard requirement for any product that is meant to reach mass adoption. The ability to revoke access is also a hard requirement. People share their credentials — it's a fact of life. In the usual setup, you can change your password and terminate sessions. But if your private key is your identity, you can't do shit to prevent someone who has gained access to it from impersonating you for the rest of eternity.
- another_kel 5y ago
  >In my world, the ability to recover your account if you lose everything is a hard requirement for any product that is meant to reach mass adoption. I don't think it matters as much for messenger attached to your phone number. Even if you lose all your conversations you still can be reached by the same identificator and most of your contracts are stored in phonebook anyway.
  - grishka 5y ago
    Phone numbers aren't good identifiers for other reasons: https://news.ycombinator.com/item?id=30258495 https://news.ycombinator.com/item?id=30258495
belorn 5y ago
I see telegram being used by local sport clubs as an alternative to messenger, primarily it seems for the reason that it doesn't require a facebook account. Most online gaming groups I know use discord, while programmer projects tend to use slack. A few gaming groups continue to use teamspeak. I don't know however any groups that use signal as a replacement for any of the above, so do people have experience in migrating groups from those platform to signal?
justshowpost 5y ago

smsm42 5y ago

If I'll ever need an app to pass around Pentagon secrets, I'll surely use Signal or something better. But if I need an app to chat with my friends and discuss what's going on without being banned and having the daily dose of Mandatory Truth injected, then Telegram works just fine so far.

j16sdiz 5y ago

Not end-to-end encrypted, but it is encrypted.

bakuninsbart 5y ago

Both Threema and Signal are the way to go with chat apps, the only advantage Telegram offers are vast groups for specific purposes. Here in Berlin, I'm getting cheap produce through telegram, get alerted to public transport controls (I do have a ticket, but sometimes friends do not), and sell/buy stuff I don't need.

theshrike79 5y ago
Telegram's advantages are a simple bot API and proper moderation tools for large channels.
- krzyk 5y ago
  And an app that is small and fast (and a proper desktop app, not some electron).
  - tentacleuno 5y ago
    I'm consistently surprised when I remind myself that Telegram is a Qt app. It's so out of the norm today, when so many things [I use] are bloated Electron apps.
    - lpcvoid 5y ago
      It's also Qt Widgets based, which is even more interesting IMO. Just really, really good engineering that happened here.
baxuz 5y ago
Other advantages: -not being tied to a phone number -having a desktop app which doesn't suck (sync issues, connection issues, lacking features, is basically a simple proxy for your phone, etc) -allows me to use 3rd party apps -having chat history synced across my apps and devices and backed up. History is immensely important
- gefhfffh 5y ago
  Checkout Element, it covers all that as well. However, the Desktop App is Electron, so I don't know if you are OK with that
  - lpcvoid 5y ago
    This is the main problem with Matrix for me. If they would just develop a good desktop client, I would be all over it.
    - bilal4hmed 5y ago
      Have you tried some of the alternatives like fluffychat ? I feel their UI is far ahead of the official clients
      - lpcvoid 5y ago
        Actually, no. Thanks for the hint, I'll be testing that soon :)
Tenoke 5y ago
Funnily enough given the title, those same things have even bigger groups on Facebook than telegram in Berlin even accounting for how popular it is here.
gefhfffh 5y ago
TBH I would consider Matrix the way to go regarding chat. It allows app and vendor independent communication and combines e2ee with Synchronisation across arbitrary many devices (something that many people like from Telegram). These days, Threema and Signal don't support the Matrix Protocol.
PicassoCTs 5y ago
"Die Fahrscheine bitte! Schwarzfahren ist eine Straftat"

grandpoobah 5y ago

Nobody I know gives a shit that it's not E2E encrypted. It's a kick ass instant messenger, that's all that matters to most people. Vastly superior to Signal and others in almost every way.

vinay427 5y ago
Sure, but it’s for some reason framed as a WhatsApp competitor even in countries where Facebook Messenger is relatively popular, which seems silly to me. It appears to fill a similar feature niche as Facebook Messenger, not WhatsApp, even if these two categories can be somewhat conflated for most uses.
- gonehome 5y ago
  Yeah, the irony is they position themselves as 'anti-facebook' and they're worse for the user than FB's whatsapp product from a security standpoint. I'd probably even trust FB's unencrypted messenger content to be better protected than telegram. They clearly have a loyal fan following though.
  - skinkestek 5y ago
    I absolutely don't recommend using Telegram for sensitive communications. That said, this idea > I'd probably even trust FB's unencrypted messenger content to be better protected than telegram. is ridiculous. With Facebook you know you will be datamined and the result sold to anyone who wants to buy.. With Telegram maybe Putin reads it, maybe not. One of them is a threat to my family and friends, the other is not.
    - gonehome 5y ago
      FB doesn't sell the data, they sell the ability for advertisers to advertise to groups. I'm not a fan of ad-driven models, but this is a lot different than selling data. If you're using unencrypted messaging you should assume it's public. This is true of FB messenger and Telegram, but if I had to bet on what unencrypted content is more likely to be owned I'd bet on Telegram. This is mostly a bet on where the world's best security people are and the company culture. Really though we shouldn't be relying on the benevolence of any of these company leaders, that's why people should use Signal or WhatsApp where the encryption means you don't have to (or Urbit where there is no central leader).

__void 5y ago

let's be realistic: (outside of certain self-referential bubbles - like this site) no one cares anything about encryption, if in public chats I am anonymous and untraceable (example: no one can know my phone number and there are granular privacy settings) this is enough for 98% of people out here "yes, encryption is useful if I want to send nudes to my partner or if I want to buy drugs but not while I'm asking mom for the sufflè recipe or I'm organizing a dinner with friends" this is what people think, and they are not completely wrong

feanaro 5y ago
"Normal" people are slowly but surely starting to care about encryption. They hear about it from people participating in self-referential bubbles like HN and then they start wondering. This is my experience.

amelius 5y ago

The source code is available, so if you don't like the defaults, you can change them?

grishka 5y ago

> based on public/private key pairs I said it many times and I'll say it again: this can't possibly work in the real world, period. People are notoriously terrible with passwords already. So terrible in fact that VKontakte (I worked there, both with Pavel and after he was ousted) had, and still has, a department dedicated to account recovery. And those are passwords, short strings that you can actually remember. You can't possibly expect an average person to keep their private key (a file you can't store in your head) absolutely secret and never lose it at the same time. In my world, the ability to recover your account if you lose everything is a hard requirement for any product that is meant to reach mass adoption. The ability to revoke access is also a hard requirement. People share their credentials — it's a fact of life. In the usual setup, you can change your password and terminate sessions. But if your private key is your identity, you can't do shit to prevent someone who has gained access to it from impersonating you for the rest of eternity.

another_kel 5y ago
>In my world, the ability to recover your account if you lose everything is a hard requirement for any product that is meant to reach mass adoption. I don't think it matters as much for messenger attached to your phone number. Even if you lose all your conversations you still can be reached by the same identificator and most of your contracts are stored in phonebook anyway.
- grishka 5y ago
  Phone numbers aren't good identifiers for other reasons: https://news.ycombinator.com/item?id=30258495 https://news.ycombinator.com/item?id=30258495

belorn 5y ago

I see telegram being used by local sport clubs as an alternative to messenger, primarily it seems for the reason that it doesn't require a facebook account. Most online gaming groups I know use discord, while programmer projects tend to use slack. A few gaming groups continue to use teamspeak. I don't know however any groups that use signal as a replacement for any of the above, so do people have experience in migrating groups from those platform to signal?

justshowpost 5y ago