4 ms·

So, what I'm hearing that unlike all the other sufficiently popular apps to matter, Telegram doesn't provide unlimited access to their user data.

by d0mine 4y ago

tapoxi 4y ago
WhatsApp is end-to-end encrypted for all messages by default, so Telegram is worse by having full access to the plaintext for the vast majority of messages on the service.
- 0des 4y ago
  I have doubts, given their owner is Facebook.
  - kasey_junk 4y ago
    You can of course go verify it. Or you could trust the many many people who have. Or you can spread FUD on the internet…
    - sodality2 4y ago
      How can this be verified? WhatsApp isn't open source.
      - dcsommer 4y ago
        You could use a network traffic analyzer, Frida, or trust third party security audits that WhatsApp publishes like https://research.nccgroup.com/2021/10/27/public-report-whatsapp-end-to-end-encrypted-backups-security-assessment/ https://research.nccgroup.com/2021/10/27/public-report-whats...
        sodality2 4y ago
        What if it acts normal for a vast majority of users, but a user which is secretly flagged on Facebook's back end will secretly report plaintext? Or a certain list of conditions will trigger more snooping? Network traffic works for proving that the app, right now, in this exact circumstance and time and date and location etc, probably isn't snooping on me. There's lots of sneaky ways to exfiltrate data that you wouldn't notice. Imagine encoding data through the timing of requests made or the exact ordering of simultaneous requests.
        baisq 4y ago
        >What if it acts normal for a vast majority of users, but a user which is secretly flagged on Facebook's back end will secretly report plaintext? You can see that by reverse engineering the binary.
      - kasey_junk 4y ago
        Software verification rarely uses the source (at least exclusively) because you can’t trust it. Typically it’s a combination of decompiling and traffic analysis.
- afiori 4y ago
  I am very happy that they cannot MitM my convos, I am less happy that they literally control the app I use to see/send/store those messages. E2EE only means stuff if you have a baseline of trust for the app developer.
  - zaik 4y ago
    That's why there are vendor indepedent standards like IRC or XMPP. We need to stop talking about messaging "apps" and make compliance with internet standards a requirement.
deleted 4y ago
[deleted]

So, what I'm hearing that unlike all the other sufficiently popular apps to matter, Telegram doesn't provide unlimited access to their user data.

by d0mine 4y ago

So, what I'm hearing that unlike all the other sufficiently popular apps to matter, Telegram doesn't provide unlimited access to their user data.

tapoxi 4y ago

WhatsApp is end-to-end encrypted for all messages by default, so Telegram is worse by having full access to the plaintext for the vast majority of messages on the service.

0des 4y ago
I have doubts, given their owner is Facebook.
- kasey_junk 4y ago
  You can of course go verify it. Or you could trust the many many people who have. Or you can spread FUD on the internet…
  - sodality2 4y ago
    How can this be verified? WhatsApp isn't open source.
    - dcsommer 4y ago
      You could use a network traffic analyzer, Frida, or trust third party security audits that WhatsApp publishes like https://research.nccgroup.com/2021/10/27/public-report-whatsapp-end-to-end-encrypted-backups-security-assessment/ https://research.nccgroup.com/2021/10/27/public-report-whats...
      - sodality2 4y ago
        What if it acts normal for a vast majority of users, but a user which is secretly flagged on Facebook's back end will secretly report plaintext? Or a certain list of conditions will trigger more snooping? Network traffic works for proving that the app, right now, in this exact circumstance and time and date and location etc, probably isn't snooping on me. There's lots of sneaky ways to exfiltrate data that you wouldn't notice. Imagine encoding data through the timing of requests made or the exact ordering of simultaneous requests.
        baisq 4y ago
        >What if it acts normal for a vast majority of users, but a user which is secretly flagged on Facebook's back end will secretly report plaintext? You can see that by reverse engineering the binary.
    - kasey_junk 4y ago
      Software verification rarely uses the source (at least exclusively) because you can’t trust it. Typically it’s a combination of decompiling and traffic analysis.
afiori 4y ago
I am very happy that they cannot MitM my convos, I am less happy that they literally control the app I use to see/send/store those messages. E2EE only means stuff if you have a baseline of trust for the app developer.
- zaik 4y ago
  That's why there are vendor indepedent standards like IRC or XMPP. We need to stop talking about messaging "apps" and make compliance with internet standards a requirement.

deleted 4y ago

[deleted]