5 ms·

Correction, you dont need the privacy* Telegram is absolutely the worst when it comes to privacy, it has access to everything you do and say. If you want a ma

Correction, you dont need the privacy* Telegram is absolutely the worst when it comes to privacy, it has access to everything you do and say. If you want a master app, have a lot at matrix.org with bridges.

jhasse 4y ago
That's false: Telegram doesn't have access to secret chats.
- barbazoo 4y ago
  Don't they store the decryption keys?
  - ComodoHacker 4y ago
    It's end-to-end, clients store the keys.
  - orangepurple 4y ago
    Server does not store the keys for secret chats
    - barbazoo 4y ago
      I see, that's the 1 on 1 chats that are explicitly configured as secret. So by default for 1 on 1 chats and for all group chats the keys are stored on the server.
- kitkat_new 4y ago
  it's not false In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Instead everything is stored online without E2E encryption, i.e. perfectly readable for the service provider.
  - jhasse 4y ago
    > In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Sorry, but "everything" != "almost everything". So it's false that "Telegram has access to everything you do and say".
- jacooper 4y ago
  Which no body uses and are extremely limited on purpose.
  - jhasse 4y ago
    > Which no body uses [...] False, I use them.
NayamAmarshe 4y ago
> Telegram is absolutely the worst when it comes to privacy Really? Telegram never said that they don't store your messages on cloud, they said that they do not sell your data or share it with third parties for profit. Telegram has received a very good score on PrivacySpy (https://privacyspy.org https://privacyspy.org), in fact better than any other messaging app. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience. Even FBI's leaked documents confirmed that Telegram does not ever share user data easily. [Source](https://www.securitynewspaper.com/2021/11/30/leaked-fbi-document-reveals-how-the-agency-can-access-data-from-whatsapp-wechat-imessage-telegram-line-signal-wickr-and-facebook-messenger/ https://www.securitynewspaper.com/2021/11/30/leaked-fbi-docu...) If you're someone who requires spy-level opsec, you should be using Threema, Session or Speek. Maybe even a self-hosted XMPP instance. Telegram is good at what it does and it states it very clearly. It does not lie about the things it does and it is open source. All while not selling user data, not manipulating user behavior through algorithms or censoring media by calculating hashes and providing what's arguably the most feature rich messaging app on the planet for free with a verifiable source code. Also, be careful with what you're suggesting. Not only have Matrix servers been hacked twice but matrix also leaks metadata. If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option.
- kitkat_new 4y ago
  > Really? Yes, really. You don't even argue against it. > pp. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience. Telegram stores almost everything online without E2EE. > Not only have Matrix servers been hacked twice but matrix also leaks metadata. Even Signal leaks meta data. > If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option. Out of Matrix, Telegram and Signal, Matrix is the best option. It is the only one not making you share your phone number giving you anonymity up to your IP address.
  - NayamAmarshe 4y ago
    > Yes, really. You don't even argue against and yet I just did. Can we please stop confusing privacy and anonymity? Your claims about Telegram being bad for privacy are baseless. Your concerns about messages is valid but it in no way compromises privacy because: 1. No telegram employee can read any messages. They use distributed key generation to encrypt data on servers which means no single server has access to decryption keys and all the servers are in different jurisdictions. 2. They do not sell message content data. If you can prove it, you can go ahead with a lawsuit and win a hefty sum. 3. They do not compromise security. They do not use E2EE by default. Their threat model and vision for a messaging platform is different than yours. 4. Telegram has never given message content for a court order. As mentioned in the privacy policy, they give out only the phone number and IP Address only in case of terrorism or child abuse and only when there's a court order from a country of a higher democratic index. 5. If you truly believe Telegram is bad for privacy even after all the evidence from FBI itself and PrivacySpy giving it a higher score than Signal, then please go ahead and sue them because surely they can't have a good privacy policy and bad privacy at the same time.
zaik 4y ago
Bridges break end to end encryption.
- jacooper 4y ago
  Correct. But in the case of matrix you can host them in your home if you want, or maybe on your phone(they are still checking if this is possible or not)
  - zaik 4y ago
    Maybe I am capable to do so (although I already host an XMPP server, so Matrix is rather redudant) but expecting everyone to self-host is obviously not realistic. Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. Those messages would have stayed encrypted and secure if people didn't use Matrix.
    - tcfhgj 4y ago
      > Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. That's not true in general. For most if not all messengers (at least encrypted ones), there is the option to use Bridge-to-End encryption on the Matrix side, which doesn't give the homeserver any possibility to inspect messages let alone aggregate them.
      - zaik 4y ago
        If I understand correctly, the Matrix encryption and message format is not compatible to other protocols so all messages must be decrypted and converted on the homeserver which runs the bridge.
        jacooper 4y ago
        The bridge and the home server are separate things. So if you run the home server somewhere untrusted, but the bridge in your home with E2EE enabled, the decryption AFAIK happens in the bridge, and the home server doesn't see anything.

jhasse 4y ago

That's false: Telegram doesn't have access to secret chats.

barbazoo 4y ago
Don't they store the decryption keys?
- ComodoHacker 4y ago
  It's end-to-end, clients store the keys.
- orangepurple 4y ago
  Server does not store the keys for secret chats
  - barbazoo 4y ago
    I see, that's the 1 on 1 chats that are explicitly configured as secret. So by default for 1 on 1 chats and for all group chats the keys are stored on the server.
kitkat_new 4y ago
it's not false In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Instead everything is stored online without E2E encryption, i.e. perfectly readable for the service provider.
- jhasse 4y ago
  > In reality almost no one bothers with secret chats (no syncing between devices, no backup and no group chat possible). Sorry, but "everything" != "almost everything". So it's false that "Telegram has access to everything you do and say".
jacooper 4y ago
Which no body uses and are extremely limited on purpose.
- jhasse 4y ago
  > Which no body uses [...] False, I use them.

NayamAmarshe 4y ago

> Telegram is absolutely the worst when it comes to privacy Really? Telegram never said that they don't store your messages on cloud, they said that they do not sell your data or share it with third parties for profit. Telegram has received a very good score on PrivacySpy (https://privacyspy.org https://privacyspy.org), in fact better than any other messaging app. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience. Even FBI's leaked documents confirmed that Telegram does not ever share user data easily. [Source](https://www.securitynewspaper.com/2021/11/30/leaked-fbi-document-reveals-how-the-agency-can-access-data-from-whatsapp-wechat-imessage-telegram-line-signal-wickr-and-facebook-messenger/ https://www.securitynewspaper.com/2021/11/30/leaked-fbi-docu...) If you're someone who requires spy-level opsec, you should be using Threema, Session or Speek. Maybe even a self-hosted XMPP instance. Telegram is good at what it does and it states it very clearly. It does not lie about the things it does and it is open source. All while not selling user data, not manipulating user behavior through algorithms or censoring media by calculating hashes and providing what's arguably the most feature rich messaging app on the planet for free with a verifiable source code. Also, be careful with what you're suggesting. Not only have Matrix servers been hacked twice but matrix also leaks metadata. If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option.

kitkat_new 4y ago
> Really? Yes, really. You don't even argue against it. > pp. Telegram is good from a regular privacy perspective unless your threat model involves fearing cloud convenience. Telegram stores almost everything online without E2EE. > Not only have Matrix servers been hacked twice but matrix also leaks metadata. Even Signal leaks meta data. > If you're seriously suggesting true anonymity (not consenting privacy) then Matrix is not a good option. Out of Matrix, Telegram and Signal, Matrix is the best option. It is the only one not making you share your phone number giving you anonymity up to your IP address.
- NayamAmarshe 4y ago
  > Yes, really. You don't even argue against and yet I just did. Can we please stop confusing privacy and anonymity? Your claims about Telegram being bad for privacy are baseless. Your concerns about messages is valid but it in no way compromises privacy because: 1. No telegram employee can read any messages. They use distributed key generation to encrypt data on servers which means no single server has access to decryption keys and all the servers are in different jurisdictions. 2. They do not sell message content data. If you can prove it, you can go ahead with a lawsuit and win a hefty sum. 3. They do not compromise security. They do not use E2EE by default. Their threat model and vision for a messaging platform is different than yours. 4. Telegram has never given message content for a court order. As mentioned in the privacy policy, they give out only the phone number and IP Address only in case of terrorism or child abuse and only when there's a court order from a country of a higher democratic index. 5. If you truly believe Telegram is bad for privacy even after all the evidence from FBI itself and PrivacySpy giving it a higher score than Signal, then please go ahead and sue them because surely they can't have a good privacy policy and bad privacy at the same time.

zaik 4y ago

Bridges break end to end encryption.

jacooper 4y ago
Correct. But in the case of matrix you can host them in your home if you want, or maybe on your phone(they are still checking if this is possible or not)
- zaik 4y ago
  Maybe I am capable to do so (although I already host an XMPP server, so Matrix is rather redudant) but expecting everyone to self-host is obviously not realistic. Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. Those messages would have stayed encrypted and secure if people didn't use Matrix.
  - tcfhgj 4y ago
    > Currently Matrix is operating in a way that larger instances aggregate private messages from bridges in plain text. That's not true in general. For most if not all messengers (at least encrypted ones), there is the option to use Bridge-to-End encryption on the Matrix side, which doesn't give the homeserver any possibility to inspect messages let alone aggregate them.
    - zaik 4y ago
      If I understand correctly, the Matrix encryption and message format is not compatible to other protocols so all messages must be decrypted and converted on the homeserver which runs the bridge.
      - jacooper 4y ago
        The bridge and the home server are separate things. So if you run the home server somewhere untrusted, but the bridge in your home with E2EE enabled, the decryption AFAIK happens in the bridge, and the home server doesn't see anything.