5 ms·

... and there's the reason I will likely stop using Signal? Signal was always one of those "win-win" apps, get more security when it's available and I don't ha

... and there's the reason I will likely stop using Signal? Signal was always one of those "win-win" apps, get more security when it's available and I don't have to worry about adding to the giant bucket of messaging apps. They were a paragon of putting the user first and I was a strong supporter... but now... Why not Telegram? Or anything else? I don't need the security, it was nice-to-have. Having to switch between Signal and other apps is a heavy amount of friction.

jacooper 4y ago
Correction, you dont need the privacy* Telegram is absolutely the worst when it comes to privacy, it has access to everything you do and say. If you want a master app, have a lot at matrix.org with bridges.
- jhasse 4y ago
  That's false: Telegram doesn't have access to secret chats.
  - barbazoo 4y ago
    Don't they store the decryption keys?
    - ComodoHacker 4y ago
      It's end-to-end, clients store the keys.
    - orangepurple 4y ago
      Server does not store the keys for secret chats
      - barbazoo 4y ago
        I see, that's the 1 on 1 chats that are explicitly configured as secret. So by default for 1 on 1 chats and for all group chats the keys are stored on the server.
  - kitkat_new 4y ago
    it's not false In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Instead everything is stored online without E2E encryption, i.e. perfectly readable for the service provider.
    - jhasse 4y ago
      > In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Sorry, but "everything" != "almost everything". So it's false that "Telegram has access to everything you do and say".
  - jacooper 4y ago
    Which no body uses and are extremely limited on purpose.
    - jhasse 4y ago
      > Which no body uses [...] False, I use them.
- NayamAmarshe 4y ago
  > Telegram is absolutely the worst when it comes to privacy Really? Telegram never said that they don't store your messages on cloud, they said that they do not sell your data or share it with third parties for profit. Telegram has received a very good score on PrivacySpy (https://privacyspy.org https://privacyspy.org), in fact better than any other messaging app. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience. Even FBI's leaked documents confirmed that Telegram does not ever share user data easily. [Source](https://www.securitynewspaper.com/2021/11/30/leaked-fbi-document-reveals-how-the-agency-can-access-data-from-whatsapp-wechat-imessage-telegram-line-signal-wickr-and-facebook-messenger/ https://www.securitynewspaper.com/2021/11/30/leaked-fbi-docu...) If you're someone who requires spy-level opsec, you should be using Threema, Session or Speek. Maybe even a self-hosted XMPP instance. Telegram is good at what it does and it states it very clearly. It does not lie about the things it does and it is open source. All while not selling user data, not manipulating user behavior through algorithms or censoring media by calculating hashes and providing what's arguably the most feature rich messaging app on the planet for free with a verifiable source code. Also, be careful with what you're suggesting. Not only have Matrix servers been hacked twice but matrix also leaks metadata. If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option.
  - kitkat_new 4y ago
    > Really? Yes, really. You don't even argue against it. > pp. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience. Telegram stores almost everything online without E2EE. > Not only have Matrix servers been hacked twice but matrix also leaks metadata. Even Signal leaks meta data. > If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option. Out of Matrix, Telegram and Signal, Matrix is the best option. It is the only one not making you share your phone number giving you anonymity up to your IP address.
    - NayamAmarshe 4y ago
      > Yes, really. You don't even argue against and yet I just did. Can we please stop confusing privacy and anonymity? Your claims about Telegram being bad for privacy are baseless. Your concerns about messages is valid but it in no way compromises privacy because: 1. No telegram employee can read any messages. They use distributed key generation to encrypt data on servers which means no single server has access to decryption keys and all the servers are in different jurisdictions. 2. They do not sell message content data. If you can prove it, you can go ahead with a lawsuit and win a hefty sum. 3. They do not compromise security. They do not use E2EE by default. Their threat model and vision for a messaging platform is different than yours. 4. Telegram has never given message content for a court order. As mentioned in the privacy policy, they give out only the phone number and IP Address only in case of terrorism or child abuse and only when there's a court order from a country of a higher democratic index. 5. If you truly believe Telegram is bad for privacy even after all the evidence from FBI itself and PrivacySpy giving it a higher score than Signal, then please go ahead and sue them because surely they can't have a good privacy policy and bad privacy at the same time.
- zaik 4y ago
  Bridges break end to end encryption.
  - jacooper 4y ago
    Correct. But in the case of matrix you can host them in your home if you want, or maybe on your phone(they are still checking if this is possible or not)
    - zaik 4y ago
      Maybe I am capable to do so (although I already host an XMPP server, so Matrix is rather redudant) but expecting everyone to self-host is obviously not realistic. Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. Those messages would have stayed encrypted and secure if people didn't use Matrix.
      - tcfhgj 4y ago
        > Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. That's not true in general. For most if not all messengers (at least encrypted ones), there is the option to use Bridge-to-End encryption on the Matrix side, which doesn't give the homeserver any possibility to inspect messages let alone aggregate them.
        zaik 4y ago
        If I understand correctly, the Matrix encryption and message format is not compatible to other protocols so all messages must be decrypted and converted on the homeserver which runs the bridge.
        jacooper 4y ago
        The bridge and the home server are separate things. So if you run the home server somewhere untrusted, but the bridge in your home with E2EE enabled, the decryption AFAIK happens in the bridge, and the home server doesn't see anything.
kelvie 4y ago
"why not anything else" is mostly (for me) because they are a non-profit, and unlikely to be bought by or turn into a megacorp, similar to how wikipedia runs, although they're certainly a mega-something at this point, it still feels a lot less evil than a facebook or a google.
nilespotter 4y ago
> ... and there's the reason I will likely stop using Signal? > Signal was always one of those "win-win" apps, get more security when it's available and I don't have to worry about adding to the giant bucket of messaging apps. Same here. I see no reason to continue using Signal if they do this.
- Thorentis 4y ago
  Which E2E encrypted app that matches Signals security will you be switching to instead?
  - mardifoufs 4y ago
    Wickr? Never heard anything bad about its security
  - nichos 4y ago
    Briar
Snitch-Thursday 4y ago
I agree. I picked signal over deltachat to replace group MMS threads because it was less startup friction than getting everyone to login to their email accounts on a mobile account since they got SMSes for free. Now? Delta chat is looking plenty fine for doing private group chats. My threat model is not nation states watching my metadata, I have horrible opsec for that. My threat model is discord and whatsapp etc. tossing me and my chat groups off a cliff at their sole discretion. Signal gave me control over chat groups, and integrated with SMS as a bonus. Now? If I'm gonna have to deal with a separate SMS app anyways, I might as well use delta chat where I know my messages are automatically backed up in my email account.
elric 4y ago
Yup, as soon as this happens I'll be deleting Signal. I hope they turn back this decision.

jacooper 4y ago

Correction, you dont need the privacy* Telegram is absolutely the worst when it comes to privacy, it has access to everything you do and say. If you want a master app, have a lot at matrix.org with bridges.

jhasse 4y ago
That's false: Telegram doesn't have access to secret chats.
- barbazoo 4y ago
  Don't they store the decryption keys?
  - ComodoHacker 4y ago
    It's end-to-end, clients store the keys.
  - orangepurple 4y ago
    Server does not store the keys for secret chats
    - barbazoo 4y ago
      I see, that's the 1 on 1 chats that are explicitly configured as secret. So by default for 1 on 1 chats and for all group chats the keys are stored on the server.
- kitkat_new 4y ago
  it's not false In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Instead everything is stored online without E2E encryption, i.e. perfectly readable for the service provider.
  - jhasse 4y ago
    > In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Sorry, but "everything" != "almost everything". So it's false that "Telegram has access to everything you do and say".
- jacooper 4y ago
  Which no body uses and are extremely limited on purpose.
  - jhasse 4y ago
    > Which no body uses [...] False, I use them.
NayamAmarshe 4y ago
> Telegram is absolutely the worst when it comes to privacy Really? Telegram never said that they don't store your messages on cloud, they said that they do not sell your data or share it with third parties for profit. Telegram has received a very good score on PrivacySpy (https://privacyspy.org https://privacyspy.org), in fact better than any other messaging app. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience. Even FBI's leaked documents confirmed that Telegram does not ever share user data easily. [Source](https://www.securitynewspaper.com/2021/11/30/leaked-fbi-document-reveals-how-the-agency-can-access-data-from-whatsapp-wechat-imessage-telegram-line-signal-wickr-and-facebook-messenger/ https://www.securitynewspaper.com/2021/11/30/leaked-fbi-docu...) If you're someone who requires spy-level opsec, you should be using Threema, Session or Speek. Maybe even a self-hosted XMPP instance. Telegram is good at what it does and it states it very clearly. It does not lie about the things it does and it is open source. All while not selling user data, not manipulating user behavior through algorithms or censoring media by calculating hashes and providing what's arguably the most feature rich messaging app on the planet for free with a verifiable source code. Also, be careful with what you're suggesting. Not only have Matrix servers been hacked twice but matrix also leaks metadata. If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option.
- kitkat_new 4y ago
  > Really? Yes, really. You don't even argue against it. > pp. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience. Telegram stores almost everything online without E2EE. > Not only have Matrix servers been hacked twice but matrix also leaks metadata. Even Signal leaks meta data. > If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option. Out of Matrix, Telegram and Signal, Matrix is the best option. It is the only one not making you share your phone number giving you anonymity up to your IP address.
  - NayamAmarshe 4y ago
    > Yes, really. You don't even argue against and yet I just did. Can we please stop confusing privacy and anonymity? Your claims about Telegram being bad for privacy are baseless. Your concerns about messages is valid but it in no way compromises privacy because: 1. No telegram employee can read any messages. They use distributed key generation to encrypt data on servers which means no single server has access to decryption keys and all the servers are in different jurisdictions. 2. They do not sell message content data. If you can prove it, you can go ahead with a lawsuit and win a hefty sum. 3. They do not compromise security. They do not use E2EE by default. Their threat model and vision for a messaging platform is different than yours. 4. Telegram has never given message content for a court order. As mentioned in the privacy policy, they give out only the phone number and IP Address only in case of terrorism or child abuse and only when there's a court order from a country of a higher democratic index. 5. If you truly believe Telegram is bad for privacy even after all the evidence from FBI itself and PrivacySpy giving it a higher score than Signal, then please go ahead and sue them because surely they can't have a good privacy policy and bad privacy at the same time.
zaik 4y ago
Bridges break end to end encryption.
- jacooper 4y ago
  Correct. But in the case of matrix you can host them in your home if you want, or maybe on your phone(they are still checking if this is possible or not)
  - zaik 4y ago
    Maybe I am capable to do so (although I already host an XMPP server, so Matrix is rather redudant) but expecting everyone to self-host is obviously not realistic. Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. Those messages would have stayed encrypted and secure if people didn't use Matrix.
    - tcfhgj 4y ago
      > Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. That's not true in general. For most if not all messengers (at least encrypted ones), there is the option to use Bridge-to-End encryption on the Matrix side, which doesn't give the homeserver any possibility to inspect messages let alone aggregate them.
      - zaik 4y ago
        If I understand correctly, the Matrix encryption and message format is not compatible to other protocols so all messages must be decrypted and converted on the homeserver which runs the bridge.
        jacooper 4y ago
        The bridge and the home server are separate things. So if you run the home server somewhere untrusted, but the bridge in your home with E2EE enabled, the decryption AFAIK happens in the bridge, and the home server doesn't see anything.

kelvie 4y ago

"why not anything else" is mostly (for me) because they are a non-profit, and unlikely to be bought by or turn into a megacorp, similar to how wikipedia runs, although they're certainly a mega-something at this point, it still feels a lot less evil than a facebook or a google.

nilespotter 4y ago

> ... and there's the reason I will likely stop using Signal? > Signal was always one of those "win-win" apps, get more security when it's available and I don't have to worry about adding to the giant bucket of messaging apps. Same here. I see no reason to continue using Signal if they do this.

Thorentis 4y ago
Which E2E encrypted app that matches Signals security will you be switching to instead?
- mardifoufs 4y ago
  Wickr? Never heard anything bad about its security
- nichos 4y ago
  Briar

Snitch-Thursday 4y ago

I agree. I picked signal over deltachat to replace group MMS threads because it was less startup friction than getting everyone to login to their email accounts on a mobile account since they got SMSes for free. Now? Delta chat is looking plenty fine for doing private group chats. My threat model is not nation states watching my metadata, I have horrible opsec for that. My threat model is discord and whatsapp etc. tossing me and my chat groups off a cliff at their sole discretion. Signal gave me control over chat groups, and integrated with SMS as a bonus. Now? If I'm gonna have to deal with a separate SMS app anyways, I might as well use delta chat where I know my messages are automatically backed up in my email account.

elric 4y ago

Yup, as soon as this happens I'll be deleting Signal. I hope they turn back this decision.