3 ms·

Signal is subject to the same warrants. And yes, because the OP is specifically talking about privileged attacks. Why would it matter if the database was plaint

by 0xy 5y ago

Signal is subject to the same warrants. And yes, because the OP is specifically talking about privileged attacks. Why would it matter if the database was plaintext? It's only a problem if your adversary has privileged access to your device, either physically or via an exploit. So Signal's "encrypted" database is literally marketing. It doesn't prevent anything. Cellebrite can access it, as can another app with the right series of zero days. Signal's encrypted database is as secure as Telegram's plain text database, because both require privileged access, and Signal isn't more secure (the encryption has been pwned by multiple companies).

throwaway290 5y ago
You might have missed the part where Telegram stores messages on a central server without e2e encryption by default. You can find more old pwnage quotes (come on, only two?), it will not change the fact that one only uses e2e implementation that is not known to be broken in the last 2 years and never without physical access to device, while the other's default mode of operation is effectively plain text stored in the cloud. Signal may be liable to receive those warrants from Russian gov, though I'm sure moxie will publish and mock each one. With Telegram, all you need is to hack a server and/or send an agent with a $5 wrench to one of the guys who runs it (or just ask nicely, they are cooperating after all).
- 0xy 5y ago
  Hardly related to the OP, and Telegram secret chats have been audited multiple times. On the other hand, Signal's "E2E" encrypted chats regularly have critical bugs such as those that send private image content to random people on your contacts list, an utterly inexcusable error that suggests poor engineering standards. [1] I think I'll take audited E2E encryption over E2E encryption that fans out private images at random to your contacts. [1] https://www.bleepingcomputer.com/news/security/signal-fixes-bug-that-sent-random-images-to-wrong-contacts/ https://www.bleepingcomputer.com/news/security/signal-fixes-...
  - throwaway290 5y ago
    I appreciate your point, but the idea of the OP was that Telegram is insecure by default, not as a result of a bug but as a design decision. Sadly, no one I know is using Telegram secret chats.

by 0xy 5y ago

throwaway290 5y ago

You might have missed the part where Telegram stores messages on a central server without e2e encryption by default. You can find more old pwnage quotes (come on, only two?), it will not change the fact that one only uses e2e implementation that is not known to be broken in the last 2 years and never without physical access to device, while the other's default mode of operation is effectively plain text stored in the cloud. Signal may be liable to receive those warrants from Russian gov, though I'm sure moxie will publish and mock each one. With Telegram, all you need is to hack a server and/or send an agent with a $5 wrench to one of the guys who runs it (or just ask nicely, they are cooperating after all).

0xy 5y ago
Hardly related to the OP, and Telegram secret chats have been audited multiple times. On the other hand, Signal's "E2E" encrypted chats regularly have critical bugs such as those that send private image content to random people on your contacts list, an utterly inexcusable error that suggests poor engineering standards. [1] I think I'll take audited E2E encryption over E2E encryption that fans out private images at random to your contacts. [1] https://www.bleepingcomputer.com/news/security/signal-fixes-bug-that-sent-random-images-to-wrong-contacts/ https://www.bleepingcomputer.com/news/security/signal-fixes-...
- throwaway290 5y ago
  I appreciate your point, but the idea of the OP was that Telegram is insecure by default, not as a result of a bug but as a design decision. Sadly, no one I know is using Telegram secret chats.