3 ms·

> I'm fairly certain it is deeply connected to Russia. Just as Signal, Facebook, Google, WhatsApp are deeply connected to the USA? > People believe it's encry

> I'm fairly certain it is deeply connected to Russia. Just as Signal, Facebook, Google, WhatsApp are deeply connected to the USA? > People believe it's encrypted but it's not for group chats or default for direct chats. The cloud and E2EE encryption of Telegram have already been audited by independent researchers. > They have money when Telegram is expensive to run They literally raised money (a billion dollars) by selling bonds last year and to make Telegram self-sustainable, introduced Telegram Premium. > not to mention they can easily threaten Durov's life Which is why Durov (and his whole dev team) moved to the UAE in the first place! I'm all for healthy skepticism, but there must be a limit. Unproven conspiracies aren't helping anyone, especially from people who have no issues with apps like WhatsApp. Telegram has time and again tried to fight government intervention, and yet that's not enough. The clients are open-source, everything audited by independent researchers and yet, people aren't afraid to make claims that they can't prove.

bmarquez 4y ago
Yeah people keep trying to push the "Russian connection" when it isn't being supported by Durov's actions. It almost feels like a conspiracy theory encouraged by users of competing apps. There are legitimate reasons to doubt Telegram like the lack of default end-to-end encryption but the Russian thing as a criticism of the app itself is overblown.
- xinayder 4y ago
  There's reason to believe that specially when you realize VK is actively monitored by Russia and Pavel doesn't care about it at all.
  - NayamAmarshe 4y ago
    Pavel has no control over VK. He sold all his stake when he left Russia. https://www.theverge.com/2014/1/31/5363990/how-putins-cronies-seized-control-over-russias-facebook-pavel-durov-vk https://www.theverge.com/2014/1/31/5363990/how-putins-cronie...
dancemethis 4y ago
The server side is still proprietary. They could have just given "dummied" source code to "independent researchers". Chances are ALWAYS against regular people.
- LukeShu 4y ago
  If it's encryoted E2E, then you don't need to inspect the server side to verify that. And the client is FOSS, anyone can inspect it. (It is my understanding that group chats are not encrypted; I have not cared to verify that one way or the other, but I could.)
- NayamAmarshe 4y ago
  > The server side is still proprietary Open sourcing it would make no difference. Signal's server is open source, yet the sources are always released late. For a whole year, Signal was running a totally different server code than the one they had made public, they even injected some crypto stuff and not a single person knew what the server was running. This is the nature of servers. Backend is always unverifiable, even if it's got the latest code available to the public. The only thing open source backend is useful for is self-hosting, not verification.
- _trackno5 4y ago
  How would that make any difference if the traffic is end to end encrypted, though? Maybe they do something with the metadata, but so can every other messaging service. This paranoia that everything is linked to Russia is just nuts.
  - jruohonen 3y ago
    Right. If you speak Russian and actually look at what is happening in Telegram, you'd know better. If I was a dissident there and my adversary would be SVR/GRU, I surely wouldn't call it paranoia.
hiimkeks 4y ago
> The cloud and E2EE encryption of Telegram have already been audited by independent researchers. Yes, and they all agree it's crap. Just look at this thread https://news.ycombinator.com/item?id=6915741 https://news.ycombinator.com/item?id=6915741 (Feel free to ignore Moxie, but listen to tptacek). In addition, it doesn't even matter since (a) it's not turned on by default and (b) it can't be turned on for group chats. That said, I agree that Durov probably is not closely collaborating with the Russian state.
- NayamAmarshe 4y ago
  The thread you linked is talking about a totally different algorithm, not relevant to our discussion. MTProto 1.0 had flaws and proven vulnerabilities. Telegram ditched the algorithm after 2013. MTProto 2.0 is much secure and has been audited multiple times already without fail. The security is solid, that's the consensus. Also, there are 2 types of MTProto 2.0 algorithms. One is cloud encryption and the other is end to end encryption. Cloud encryption is enabled by default on all chats but for those who need end to end encryption, they can use secret chats. You can read more about it here: https://core.telegram.org/techfaq#q-how-does-server-client-encryption-work-in-mtproto https://core.telegram.org/techfaq#q-how-does-server-client-e...
  - hiimkeks 4y ago
    Apparently they didn't learn much, given that MTProto 2.0 still uses IGE. Or still derives the IV from a hash of the message. The article you link does not mention "cloud encryption". What is that? TLS?
    - NayamAmarshe 4y ago
      The cloud encryption is what I linked, the Server-Client encryption. Just below it, you can see E2E.
      - IYasha 3y ago
        E2E is not available on all platforms, is hidden in obscure menus and the whole UI discourages users from using it. Telegram is a data-harvesting social goolag-oriented network after all. :-/
Aerbil313 4y ago
Literally everything can be faked. Independent researchers, etc. Especially by the government. I don’t have an iota of trust in govts.
tapoxi 4y ago
Most Telegram messages are group chats, they are not E2EE at all since Telegram doesn't support them.

bmarquez 4y ago

Yeah people keep trying to push the "Russian connection" when it isn't being supported by Durov's actions. It almost feels like a conspiracy theory encouraged by users of competing apps. There are legitimate reasons to doubt Telegram like the lack of default end-to-end encryption but the Russian thing as a criticism of the app itself is overblown.

xinayder 4y ago
There's reason to believe that specially when you realize VK is actively monitored by Russia and Pavel doesn't care about it at all.
- NayamAmarshe 4y ago
  Pavel has no control over VK. He sold all his stake when he left Russia. https://www.theverge.com/2014/1/31/5363990/how-putins-cronies-seized-control-over-russias-facebook-pavel-durov-vk https://www.theverge.com/2014/1/31/5363990/how-putins-cronie...

dancemethis 4y ago

The server side is still proprietary. They could have just given "dummied" source code to "independent researchers". Chances are ALWAYS against regular people.

LukeShu 4y ago
If it's encryoted E2E, then you don't need to inspect the server side to verify that. And the client is FOSS, anyone can inspect it. (It is my understanding that group chats are not encrypted; I have not cared to verify that one way or the other, but I could.)
NayamAmarshe 4y ago
> The server side is still proprietary Open sourcing it would make no difference. Signal's server is open source, yet the sources are always released late. For a whole year, Signal was running a totally different server code than the one they had made public, they even injected some crypto stuff and not a single person knew what the server was running. This is the nature of servers. Backend is always unverifiable, even if it's got the latest code available to the public. The only thing open source backend is useful for is self-hosting, not verification.
_trackno5 4y ago
How would that make any difference if the traffic is end to end encrypted, though? Maybe they do something with the metadata, but so can every other messaging service. This paranoia that everything is linked to Russia is just nuts.
- jruohonen 3y ago
  Right. If you speak Russian and actually look at what is happening in Telegram, you'd know better. If I was a dissident there and my adversary would be SVR/GRU, I surely wouldn't call it paranoia.

hiimkeks 4y ago

> The cloud and E2EE encryption of Telegram have already been audited by independent researchers. Yes, and they all agree it's crap. Just look at this thread https://news.ycombinator.com/item?id=6915741 https://news.ycombinator.com/item?id=6915741 (Feel free to ignore Moxie, but listen to tptacek). In addition, it doesn't even matter since (a) it's not turned on by default and (b) it can't be turned on for group chats. That said, I agree that Durov probably is not closely collaborating with the Russian state.

NayamAmarshe 4y ago
The thread you linked is talking about a totally different algorithm, not relevant to our discussion. MTProto 1.0 had flaws and proven vulnerabilities. Telegram ditched the algorithm after 2013. MTProto 2.0 is much secure and has been audited multiple times already without fail. The security is solid, that's the consensus. Also, there are 2 types of MTProto 2.0 algorithms. One is cloud encryption and the other is end to end encryption. Cloud encryption is enabled by default on all chats but for those who need end to end encryption, they can use secret chats. You can read more about it here: https://core.telegram.org/techfaq#q-how-does-server-client-encryption-work-in-mtproto https://core.telegram.org/techfaq#q-how-does-server-client-e...
- hiimkeks 4y ago
  Apparently they didn't learn much, given that MTProto 2.0 still uses IGE. Or still derives the IV from a hash of the message. The article you link does not mention "cloud encryption". What is that? TLS?
  - NayamAmarshe 4y ago
    The cloud encryption is what I linked, the Server-Client encryption. Just below it, you can see E2E.
    - IYasha 3y ago
      E2E is not available on all platforms, is hidden in obscure menus and the whole UI discourages users from using it. Telegram is a data-harvesting social goolag-oriented network after all. :-/

Aerbil313 4y ago

Literally everything can be faked. Independent researchers, etc. Especially by the government. I don’t have an iota of trust in govts.

tapoxi 4y ago

Most Telegram messages are group chats, they are not E2EE at all since Telegram doesn't support them.