13 ms·
Telegram has launched a pretty intense campaign to malign Signal as insecure
- simion314 2y agoMaybe walled submissions should not be a,lowed unless an alternative way to reading the content is presented
- michelledepeil 2y agohttps://threadreaderapp.com/thread/1789687898863792453.html https://threadreaderapp.com/thread/1789687898863792453.html
- xyst 2y agoI wish there was a way to auto hide any submissions from a site (ie, “hide all twitter.com submissions)
- deleted 2y ago[deleted]
- dangoodmanUT 2y agoTelegram has always felt like the catch-up of the messenger apps. I don't know a single person who uses it.
- filleokus 2y agoI know a quite a lot of people (including me) who use it as a kinda RSS reader to keep up to date with Russian cyber security threat actors.
- lukan 2y agoMany do. But most use it as a forum software, or to send files, than as a messenger.
- sitzkrieg 2y agoi use it for messaging and everyone else i know does too. "most"? any sources?
- lukan 2y ago"Most" was anecdota here. Oh and I also use it for messaging sometimes. But my main use case is participating in various groups, like in a forum way. And my peer group does the same and I have not met a single person that uses telegram mainly for messaging. Most also have signal or whatsapp for that.
- vbezhenar 2y agoI don't know a single person who doesn't use Telegram.
- School-Cotton 2y agoWhat country do you live in?
- vbezhenar 2y agoKazakhstan.
- School-Cotton 2y agoThat makes sense, AFAIK Telegram is most popular in the post-Soviet countries.
- baq 2y agoThat in itself is a red flag. Things don't 'just happen' in those places. Don't ask me how I know.
- nexoft 2y agoSame In the EU, no ones that's legit uses Telegram, except scammers that you can run into in local "graigslist" website.
- hifromwork 2y ago"Same in the EU" - but you're actually make an opposite statement than the GP (GP said "everyone i know uses telegram" and you said "nobody uses telegram")
- nexoft 2y agoindeed you are right, I did read the opposite for some reason.
- billpcs 2y agoI use it since 2014 and have felt that it's very performant (more so than Signal or Whatsapp, Messenger, or Viber). Also, it adds many useful features that other messengers didn't always have and many still don't have, for example Saved Messages, Scheduled Messages, Spoiler Messages, Reply to Message, message formatting (bold, monospace, etc), just to name a few off the top of my head.
- kreyenborgi 2y agoSignal has "Scheduled Messages, Spoiler Messages, Reply to Message, message formatting (bold, monospace, etc)". I don't know what Saved Messages are, maybe it doesn't have those. Oh, and it's end-to-end encrypted by default.
- billpcs 2y agoIt does, in Signal it's called "Note to Self". I am saying that in general, Telegram is the first to offer such new feautres.
- troupo 2y agoAs with any messenger, it depends on countries and regions and groups of people. Everyone in my friend group is using it. In terms of functionality, speed, fluidity of the interface everyone is trying to catch up to Telegram. And doing a half-assed job of it
- lyu07282 2y agoI don't think Signal is even trying tbh
- HatchedLake721 2y ago?! Telegram is often praised here for their features that helped them to grow and made people keep using it. Something that Signal should consider doing. They have 900million monthly active users.
- dannyw 2y agoYes, their app and UX is absolutely delightful.
- TacticalCoder 2y agoI don't get this. I'm in the EU and nearly everybody I know has Telegram. Telegram has a huge advantage versus WhatsApp: it's not Meta. Then the Telegram UI is really excellent. When you tell people all your friends and family are using it and that's it's not from Facebook, they usually install it on the spot. Then they're hooked.
- deleted 2y ago[deleted]
- conradfr 2y agoI'm in France and don't know anyone using it. Except the government, as reported in the news. Actually the only time I used it it's because I needed to chat with a Russian SaaS personnel.
- rahen 2y agoI know few people who use Telegram either. All my contacts and I use Signal here.
- yodsanklai 2y agoI don't mind WhatsApp being Meta but Telegram is more lightweight and UI is far superior (for instance, ability to edit messages). Unfortunately, most people still use WhatsApp, you can't really avoid using it.
- oytis 2y agoFor Russian language content it feels a lot like pre-enshittification internet. You get blogs on all possible topics without ads or "Algorithm". Just read what you subscribed to, in whatever order you want. I would never trust in with any confidential information though.
- kome 2y agoThis is the most out of touch comment. Everybody is running after telegram, they are innovating all the time. If you want to see what Whatsapp will look like in a year, use telegram now.
- konart 2y agoCan say the same for Viber and to a lesser extent Whatsapp. Not to mention Signal. I'd guess popular IRC servers have more real users than Signal.
- lutrinus 2y agohttps://nitter.poast.org/matthew_d_green/status/1789687898863792453 https://nitter.poast.org/matthew_d_green/status/178968789886...
- thih9 2y ago> Tweet not found
- red_trumpet 2y agoWorks for me.
- 5e92cb50239222b 2y agohttps://archive.is/Khc0i https://archive.is/Khc0i
- yreg 2y agohttps://nitter.poast.org/matthew_d_green/status/1789687898863792453 https://nitter.poast.org/matthew_d_green/status/178968789886...
- danielbln 2y agoA nitter instance that still works? What is this sorcery?
- LoganDark 2y agoLack of widespread use most likely. Maybe some people put Nitter on their personal user account and it works until it has too many users.
- anthk 2y agoReplace https://twitter.com https://twitter.com with https://twiiit.com https://twiiit.com (3 i's), it will automatically redirect a Twtr link to a working instance.
- rglullis 2y agoNitter still works if you configure the instance to use valid accounts.
- viraptor 2y ago* enough valid accounts. If the instance gets popular, you're going to need hundreds of them to get past rate limits according to the announcements some time ago (maybe the rate limits have changed though)
- rigid 2y agoSignal has reproducible builds for android now? Why not f-droid then, too?
- kuschku 2y agoSignal's definition of "reproducible" meant for quite a while "download this binary docker image and build Signal inside of it". I don't know if that has changed since. Signal rejects F-Droid for a different reason, though: They only want to distribute through channels where they get download statistics and control update rollouts.
- VMG 2y agoNon X version?
- djaychela 2y agohttps://threadreaderapp.com/thread/1789687898863792453.html https://threadreaderapp.com/thread/1789687898863792453.html
- deleted 2y ago[deleted]
- schlonger0009 2y agohttps://threadreaderapp.com/thread/1789687898863792453.html https://threadreaderapp.com/thread/1789687898863792453.html
- schlonger0009 2y agohttps://web.archive.org/web/20240513112355/https://threadreaderapp.com/thread/1789687898863792453.html https://web.archive.org/web/20240513112355/https://threadrea...
- nubinetwork 2y agoTelegram is full of scammers. Something something bricks and a glass house.
- izacus 2y agoI've started getting a lot of spam scam messages on Signal as well lately. What's going on with these platforms?
- hmmm-i-wonder 2y agoPersonally I've never received a scam or spam message on Signal.
- cuu508 2y agoI am in a Signal group which has an invite link discoverable on public internet (it's a local OpenStreetMap group). From time to time, a bot joins and proceeds to spam the group's members one-on-one.
- RicoElectrico 2y agoThe same happens on the Telegram OSM group. Now, the easy and 99% effective mitigation is to make a "bridge group" where you need to click something to join the real deal but changing that would invalidate any existing links.
- swores 2y agoIsn't it an expected issue with popular services, particularly ones with proper e2e encryption? Things like WhatsApp and iMessage get scam messages too, and the less visibility the operators have for contents of messages the harder it is to proactively filter out spam.
- epicide 2y agoIt feels like any platform that allows for one-way initiation of a conversation is bound to increase in spam as the platform grows in usage (phone calls, email, SMS, various social media, various messengers, etc.). Do any platforms require that both parties add one another? (And/or allow for restricting an account to such a mode) e.g. if user123 and user789 wish to communicate, then user123 must add/contact user789 AND user789 must add/contact user123. Until both do so, then nothing happens. It's more work to legitimately establish contact with someone, but that seems like it pales in comparison to the effort produced by spam/scams. Same thing with verifying identities. In order to actually establish proper contact with someone, you need to communicate with them via some outside means (ideally in person) in order to establish the connection. Requiring both parties to enter/scan some ID/code/whatever seems like it would only facilitate proper verification (though not guarantee it, of course). I'm sure that I'm missing something, though. I assume I'm just not familiar enough with these platforms and that some/all of them provide such a feature. It's just odd to me that spam sounds like such a problem when it feels like the above solution would be highly effective and simple to include.
- deleted 2y ago[deleted]
- Semaphor 2y agoNot a huge fan of Signal (phone number requirement [0], crypto push a while ago), but there are worlds between those two, and every time the Telegram CEO makes a post it looks more like a scam than before. [0]: Yeah, might be changing or has already. Now, after ages.
- jraph 2y ago> phone number requirement. Yeah, might be changing or has already. Now, after ages. A phone number is still required for registration. As of a few weeks, it's not necessarily communicated to your contacts anymore, which solves a few concerns (but not all). > crypto push a while ago I was worried about this, but I use Signal daily and I haven't even noticed anything in the UI about this, it seems like a non event in the end.
- nani8ot 2y agoThe crypto payments have to be manually enabled under Settings -> Payments, which is the correct way to handle such features imo.
- ementally 2y agoFSB vs CIA? You can check this thread where his claims are debunked https://discuss.privacyguides.net/t/according-to-elon-musk-signal-has-known-vulnerabilities-that-are-not-being-addressed/18206/16 https://discuss.privacyguides.net/t/according-to-elon-musk-s...
- sschueller 2y agoand who runs privacyguides.net ? the FSB or CIA?
- ementally 2y agoWell... if you scrolled up a bit you would have found https://discuss.privacyguides.net/t/according-to-elon-musk-signal-has-known-vulnerabilities-that-are-not-being-addressed/18206/14 https://discuss.privacyguides.net/t/according-to-elon-musk-s... which says Signal isn't great either.
- lynndotpy 2y agoNo, it does not. Let's enumerate the purported problems: - "Elon Musk said so", which does not matter. - Signal attachments can be viewed by an attacker with local access to the client. This is not Signal's job to protect against. - Signal offers an optional `--no-sandbox` flag which only has security options if enabled on Linux. - Weaknesses in sealed sender. This is the only one that might be an actual problem (two theoretical and one empirical attack, but the latter comes from an 18 page paper that I have not read). But this does not compromise the integrity of the chats, and is not something Telegram improves on. Given how the posted described the optional `--no-sandbox` flag as "no sandbox on Linux", it's clear that they don't understand anything they're sharing, and they just want to spread FUD. --- edit: Per discussion below, I was wrong about the `--no-sandbox` flag. It's enabled by default. The risk is that an attacker could figure out how to use Signal to run arbitrary JavaScript. I take back my insult- it was I who did not understand the linked issue. I still stand by Signal > Telegram. The risk here is that an attacker could figure out how to abuse Signal to run arbitrary Javascript, e.g. through a specially crafted message.
- sschueller 2y agoI don't trust either side and having a cryptography expert located in Baltimore, MD trying to prove that the other side is wrong seems just as off as a Russian owner trying to prove the opposite. In the end it doesn't matter if you are using a smart phone from Apple or Google as your soft-keyboard is such an easy target there is no need to decrypt anything.
- verisimi 2y agoYes, afaik the whole point of all this tech is that it is compromised by design and intended to allow agencies/governments/corporations fine grained access to each individual. I use both these apps fwiw. I'm under no illusions that anything is really private online.
- alfiedotwtf 2y agoFor what it’s worth, Matt has a pretty damn good track record
- abdellah123 2y ago-__- I need to make my own OS
- fidotron 2y ago[flagged]
- sp332 2y agoWe don’t have to trust the board. We have the binaries.
- dannyw 2y agoThat you cannot verify matches the source code. Telegram is shady, but the points made has a point. Not having reproducible builds on iOS is disappointing for such a security-critical product.
- vmfunction 2y agoWould make more sense if it is reproducible builds. Shouldn't we just all switch to matrix clients which use Olm and Megolm cryptographic ratchets and it doesn't rely on one server/one entity. And looks like it is implemented in Rust: https://github.com/matrix-org/vodozemac/ https://github.com/matrix-org/vodozemac/
- jug 2y agoThe binaries? This sounds like some kind of joke.
- fidotron 2y agoIt is pretty bad bait, but then this whole thread is a dumpster fire of distraction from any substance.
- fidotron 2y agoTo follow on, it turned out not only did that stunningly milquetoast comment I made get flagged, but after I made it someone tried to DDoS everything associated with me. I mean, do these people not know their Shakespeare?
- rakoo 2y ago
- deleted 2y ago[deleted]
- xyst 2y agoIt’s a Telegram psyop that uses emotion, particularly fear and paranoia, to switch to their shite platform.
- ceejayoz 2y agoIt’s also part of Christopher Rufo’s campaign to oust NPR’s new CEO. https://www.bugeyedandshameless.com/p/chris-rufo-katherine-maher-signal https://www.bugeyedandshameless.com/p/chris-rufo-katherine-m...
- robertlagrant 2y agoIs it possible to link to primary or neutral secondary sources, rather than hatchet-jobs?
- ceejayoz 2y agoThat’s what the underlined bits throughout are, including to Rufo’s own tweets. But here, primary: https://christopherrufo.com/p/the-zen-koans-of-npr https://christopherrufo.com/p/the-zen-koans-of-npr > This week, I have been engaged in a campaign to expose NPR’s new CEO, Katherine Maher, and her anti-speech, anti-truth philosophy.
- robertlagrant 2y agoHow does that show he wants to use Telegram in a "psy-op"?
- ceejayoz 2y agoSignal was the last place she worked. https://christopherrufo.com/p/signals-katherine-maher-problem https://christopherrufo.com/p/signals-katherine-maher-proble...
- joemazerino 2y ago
- pydry 2y agoGiven the location of Telegram's servers (Dubai), and the nature of the government (neutral dictatorship) and the lack of encryption, my default assumption would be that not only are they selling access to your data to major governments, they've probably even streamlined the bidding process.
- XorNot 2y agoYep. The magic of "you could turn on encryption" is that nearly all people using it won't. "Ah, but if you need encryption then you'll..." - well, two things now. Suddenly you're the person who has encryption switched on. And also more likely, someone they talk to will forget to switch it on and just blab everything into cleartext anyway. The entire importance of Signal's model is that it is always encrypted. It's why LetsEncrypt is also important: to have effective security you need to be able to hide in the crowd. If encryption usage is rare, then who's using it itself (or suddenly starts using it) becomes an extremely valuable datapoint. (so I'd add: Telegram absolutely sell timeline details of which user accounts change their frequency of encrypted chat usage).
- piaste 2y agoAddressing only one point, not your main one which I agree with: > And also more likely, someone they talk to will forget to switch it on and just blab everything into cleartext anyway. I expect that if you enable a Telegram Secret Chat with Bob, Bob cannot unilaterally un-secret it. I would be very surprised if that was the case. Of course Bob can then share the contents with Carol via an un-encrypted channel. But every encrypted channel has that weakness.
- nani8ot 2y agoLast I used Telegram, creating an e2ee chat with someone added an encrypted chat in addition to the unencrypted chat. This means if your not careful in which chat with a single person a message is sent to it's easy to accidentally send unencrypted data. I'd guess this is possible because Telegram e2ee chats aren't multi-device capable, so it's necessary to be able to use unencrypted chats while using Telegram on something else than the phone with e2e.
- pmarreck 2y agoisn’t telegram the one that uses a wonky/sus custom encryption algorithm? https://words.filippo.io/dispatches/telegram-ecdh/ https://words.filippo.io/dispatches/telegram-ecdh/
- huhtenberg 2y agoThey rectified that around the time it surfaced. If you follow the discourse, the crypto quality is no longer brought up in factual Telegram-to-Signal comparisons, except as low-effort swipes at Telegram's general credibility.
- r721 2y agoThis post was on front page recently: https://news.ycombinator.com/item?id=40315274 https://news.ycombinator.com/item?id=40315274
- vetinari 2y agoWell, if you think that AES-256 that MTProto uses[1] is some wonky algorithm... [1] https://core.telegram.org/mtproto https://core.telegram.org/mtproto
- rakoo 2y agoGoing from "AES is safe" to "Any protocol that uses AES is safe" is the kind of leap that will ban you from any cryptography work
- vetinari 2y agoGP was talking encryption, not protocol. Randomly changing topics will get you banned from any crypto work too.
- rakoo 2y agoBecause saying "AES" is enough to talk about encryption ? Nothing else is involved ? Because if we're going in this direction everyone should just use XORs for encrypting and everything would be fine, and the rest would be implementation details.
- yreg 2y agoSo the entire argument for "Telegram isn’t a secure messenger, full stop." is that E2EE is opt-in? If that's all there is to it, then the opinion is rather weak. edit: maybe post a comment in addition to pressing the downbutton. I'm curious what's so problematic about what I've said.
- akie 2y agoDefaults are important because (very) many people don't change them.
- snvzz 2y agoMost.
- tifik 2y agoIt's not just opt-in, it's a non-default option you have to actively seek out and enable with every new conversation you start. So yes, by default, without additional steps taken, telegram is not e2e encrypted.
- FabHK 2y agoThe non-standard crypto was also problematic, at least initially. Furthermore, as outlined, the claims on reproducible builds vis-a-vis Signal are debatable - both provide them on Android, neither satisfactorily on iOS.
- azubinski 2y agoLife will be much more boring if we cannot find humour even in the most boring things. So, it's good that the personal involvement of the illustrious Elon turns even obvious political influence operations into a circus with talking horses and scary clowns. It's good :)
- redbell 2y agoFor more context, here are some of the references related to this thread: > Pavel Durov, the CEO of Telegram, has recently been making a big conspiracy push to promote Telegram as more secure than Signal.. https://t.me/durov/274 https://t.me/durov/274 Jack Dorsey's Tweet: https://twitter.com/jack/status/1787895769183268948 https://twitter.com/jack/status/1787895769183268948
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- mmmdaaa 2y agoThis is a response to the following post from Telegram creator Durov https://t.me/durov/274 https://t.me/durov/274
- danpalmer 2y ago- "I don't like where one of their board worked" (find someone high up in the cryptography ecosystem who hasn't been involved in this sort of thing somewhere in their career) - "I don't like where their funding comes from" (US govt regularly funds secure software because they depend on it for their own operations, see: Tor) - "An alarming number of people think their chats were leaked". It's easy to state things without sources. Also an alarming number of people think Facebook listens to them through their phones' mic. People are bad at opsec. Not news. - "No reproducible builds. They closed a GitHub request from the community." Well, except Android is reproducible, and they explicitly state on that closed issue that they don't do feature requests via GitHub and asked the reporter to raise in the proper channel. - "Telegram is the only service with reproducible builds". Telegram barely has encrypted chats, reproduce all you like, that doesn't make the chats secure. Signal has E2E encryption and verifiable builds for Android, that's a strictly better security position.
- Intermernet 2y agoThere seems to be a concerted effort to discredit Matthew's claims. Even here on HN. I find this suspicious. The Signal protocol has been heavily audited by many different people from many different countries. It's usually found to be sound. The telegram protocol has been found to have issues that are, if not malicious, amateur level mistakes. Once again, this is not my opinion. This is the result of independent auditors who have no affiliation with either the USA or Russia. There are positives to the UI of Telegram, there are negatives to the UI of Signal. None of these has much to do with the underlying protocol of either. Personally I'd rather we all put our collective efforts into something like the protocol suggested by Matrix, but if only given the choice of Telegram or Signal, I'd avoid Telegram like the plague. They are either malicious or amateur. Either one isn't a good choice for security.
- FabHK 2y agoEh, split any important message into pieces, put a piece each in Signal, WhatsApp, Telegram, Threema, Line, and then the Americans, Russians, Swiss, and Koreans will each have some parts, but if you're lucky, nobody has all...
- Intermernet 2y agoI didn't even know Line was still a thing!
- viraptor 2y agoAt that point you're giving the metadata to everyone. That's not a great thing if you actually care about being protected from all of them.
- medo-bear 2y agoYou can have a secure verified protocol but an insecure implementation of the protocol (the app). Note though that Im not saying that Signal the app is insecure. However I do think that Signal can certainly do more to make itself more transparrent and to accomodate libre 3rd party implementations of their protocol
- 2y ago
- GaggiX 2y agoThis just seems like a knee-jerk reaction to Durov promoting his own platform as usual, what does Elon Musk have to do with this for example? Is there any evidence that the authorities have ever had access to private conversations? At the end of the day, the issue comes down to the fact that Telegram is such a superior messaging app compared to anything else.
- supriyo-biswas 2y agoSee this other comment which contains links to Elon Musk’s comments about Signal[1]. [1] https://news.ycombinator.com/item?id=40342204 https://news.ycombinator.com/item?id=40342204
- aurelien 2y agoI do not see the demonstration of the way they brake the cryptography ... Maybe they have some interest in that propaganda.
- TacticalCoder 2y agoI don't know about Telegram being nasty towards Signal but Signal brought this upon themselves. Metadata are more important than the content of the messages and yet Signal has always been about knowing your phone number, with handwaving when the subject is mentioned. Sessions, a Signal fork, had its tagline right: "Share encrypted messages, not metadata". Signal is a metadata exchanging app and it's about collecting your phone number and everybody else' phone number. Now I don't think Telegram needs to "attack" Telegram: Telegram is immensely more successful and has reached take-off velocity. To me Telegram is going after WhatsApp, not Signal.
- Quiark 2y agoNot sure if metadata is more important but ok. Signal has launched support to use nicknames instead of phone numbers although it's true this took a long time. I think Telegram is very wide-spread for running large group chats and communities, a use case that Signal is not interested in. Personally, I want my chats end to end encrypted and I'm grateful to Signal for pioneering this and inspiring Whatsapp, facebook messenger and others to adopt the same.
- rfoo 2y ago> Signal has launched support to use nicknames instead of phone numbers You will still need a phone number to sign up for Signal. Signal still knows your phone number, you just hide it from your contacts. To me this only makes it even more suspicious.
- OSI-Auflauf 2y agoYou need a phone number to sign up for Telegram as well. And you can correlate username to phone number not that hard in most standard setting cases.
- nottorp 2y agoYeah, basically both super duper encrypted privacy oriented services want your phone number. Sorry, but that's not privacy. I don't care what they do to encrypt your messages, they are still tied to me, which makes the super duper encryption pointless.
- gkbrk 2y agoYou can download Telegram and many forked clients from F-Droid. All the builds are from source code, so you know the source code is up-to-date. Any distro can have Telegram clients, both official and third-party, in their repository. Compared to this 1. You cannot download Signal from F-Droid. You need to download it from the Google Play Store. The released source code has lagged behind the version on the Google Play store by long periods of time many times. One example was when they implemented cryptocurrency payments, pushed the update to everyone but no one could inspect the source code. 2. Signal has sent legal threats to repositories that package Signal. The repos either need to confuse users by offering the client under other package names or remove it. 3. They also send baseless threats to forks that use their server. Combined with their lack of federation, this results in people having to use multiple apps from different sources with a much larger attack surface. 4. They beg for donations in the app even though they made an app with payments and cryptocurrency integration with an obscure coin (which they were involved with and had ample opportunity to hoard before ever announcing it as a feature in Signal). 5. They claim to have privacy features that other messengers lack, but these features are based on known-to-be-broken technologies like Intel SGX.
- ale42 2y agoAll true. But where are the sources of Telegram server? They are not open source, simply! What are they actually doing with our messages? Only they know. And they can read them because by default there's no E2E encryption.
- riffraff 2y agowould it matter if the server was open source? You'd know have no proof what is what they run on the actual server anyway, nor can you use a custom server.
- ale42 2y agoIt can matter if you can trust them to do the proper thing, i.e. if you assume they are not a malicious entity. In this case, checking the server source code can give experts insights about possible security risks. If you assume they are malicious, (a) I wouldn't use their product in the first point, and (b) of course they can do whatever they want independently from the published code.
- ixwt 2y agoAnother thing that wasn't pointed out: Du Rove said "Signal messages have been exploited against them in US courts or media." This would be the same case for Telegram as well, if someone has your phone. I believe that Signal can have a lock on the client, and the database is encrypted. The other part that Du Rove conveniently left out: Signal went against the US courts and won [0]. When subpoenaed to give all user information they gave them all that had: the unix timestamp of when the account was created, and the last date you connected to the signal service. That was in late 2021. I'm really curious as to what Telegram has told the FSB. [0]: https://signal.org/bigbrother/cd-california-grand-jury/ https://signal.org/bigbrother/cd-california-grand-jury/
- noirscape 2y agoTelegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. The bigger problem with Telegram is that it by default has insecure encryption settings (as opposed to Signal, where encrypted is the default, you need to manually activate it with Telegram + I think it's not possible to enable for all chats and clients) and to my knowledge, Telegram will outright co-operate with law enforcement agencies to just hand over unencrypted communications. I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default
- 1oooqooq 2y ago> security dark pattern - make privacy a big selling point, but then don't activate the security by default pretty similar to whatsapp. they boast end to end encryption, but business account (all of them now) uses the facebook server's key, so that the business can give access to several other clients to answer customers. they still call it end to end encryption, and this was actually the last crap the original founder accepted before leaving with lots of money on the table.
- FiloSottile 2y ago“All of them” in what sense? I use WhatsApp dozens of times a day, and interact with business accounts every couple months at most.
- lukan 2y agoTo quote one comment (Phillip.png): "With assistance from Elon Musk" is a pretty big accusation. I held off replying until I read your whole thread, and then you didn't mention that at all. What the hell?" Seriously, what the heck has Elon Musk to do with this? Unless we also want to debate what we all think of Elon Musk when we talk about chat protocols?
- r721 2y agohttps://twitter.com/elonmusk/status/1787908190799278360 https://twitter.com/elonmusk/status/1787908190799278360 https://twitter.com/elonmusk/status/1787589564917490059 https://twitter.com/elonmusk/status/1787589564917490059 Keep in mind that X/Twitter's "For You" algo boosts posts to which Elon replies in his followers' feeds.
- lukan 2y agoThanks for the missing context, I think that qualifies as "boosting".
- deleted 2y ago[deleted]
- vasilipupkin 2y agoDo use Telegram as a news source, to subscribe to channels Do not, for the love of all that is holy, use it for any communications. It is not secure and most likely has been hacked up the wazoo by the FSB.
- suck-my-spez 2y agoTelegram is a cesspit full of spammy bots & scams. Easy pass…
- imjonse 2y agoTelegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.
- treprinum 2y agoWhy is home-rolled crypto inherently insecure?
- OSI-Auflauf 2y agoBecause theirs was particularly bad. They xored a server provided nonce in their modified DH scheme making their side able to mitm the key exchanges.
- hcks 2y agoIt’s not been audited by CIA approved programmers
- ale42 2y agoBecause doing proper crypto is VERY hard. You might think you've gotten the ultimate security and one year later someone will defeat it (or cryptanalize within a practical limit, which boils down to the same), because you forgot a detail. Even just implementing a crypto algorithm properly in a way that doesn't leak information is very complex, reason for which most applications tend to use well-established crypto libraries.
- richardw 2y agoGood answers here: https://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own https://security.stackexchange.com/questions/18197/why-shoul... I’d do a disservice to try copy and paste here so rather look at the top answer
- danpalmer 2y agoIt's inherently risky – cryptography is hard and building secure software is hard, so starting it from scratch rather than re-using well-vetted code increases the risk unnecessarily. It's not inherently broken, but it's sufficiently risky that it may be fair to assume it is broken. History has proven that software that's not known to be secure is typically insecure when it gets to the really hard crypto implementation. I think it's fair therefore to approximate it as "inherently insecure".
- kome 2y agoStating that Telegram is unencrypted is incorrect. It offers optional end-to-end encryption; however, by default, it uses encryption in transit. Of course, there is a trade-off between convenience and encryption, and having access to all messages on all devices is beneficial. However, technicalities are not the point: both Ukrainians and Russians trust Telegram—despite being at war. Telegram has managed to distribute its servers and legal presence across multiple countries, making it challenging for courts to track. This provides a level of security that American-based entities cannot offer. There is a great discussion by Pinboard on why telegram is more safe, and it is preferred by activists in Hong Kong: https://twitter.com/Pinboard/status/1474096410383421452 https://twitter.com/Pinboard/status/1474096410383421452 "There's a disconnect between critiques of Telegram and its practical use that have made me uneasy about joining technical pile-ons around how it's not really encrypted messaging. Let me use the example of Telegram use in the Hong Kong protests..." If anything, all this animosity toward telegram has always been a bit suspicious to me. But anyway, assume your cellphone to be extremely unsafe.
- darthrupert 2y agoHaving in-transit encryption in your communications software is kindergarten level stuff. It's the most minimum of hurdles to pass, so it's not worth mentioning anymore. Thus encryption always refers to E2E encryption in these discussions.
- Intermernet 2y agoOptional E2E encryption is effectively not encryption. The default encryption in transit is useless if you don't trust the server. The argument about convenience is ridiculous. Whatsapp provides better default encryption than Telegram. The (probably deliberate) flaw in Whatsapp encryption is the default backup method, but E2E encryption is enabled by default with no loss in convenience. Telegram is not encrypted by default, and their encryption scheme has been shown to have rookie level mistakes in it. Just because it's "preferred by activists" doesn't mean said activists have any idea about secure communications. I'm not saying that you should jump on Signal (or anything else). I'm saying Telegram is almost certainly broken. Maybe maliciously, maybe accidentally, but almost certainly. For reference, I don't use either Signal or Telegram anymore, but Telegram sets off so many alarms I'd steer clear of it.
- Razengan 2y agoTelegram is just as bullshit as WhatsApp etc as long as it requires: * A phone number * Access to your contacts WHY do messaging apps need ALL our contacts? Why can't we add only the people we want to stay in touch with on a particular app? WHY doesn't Apple let us choose WHICH contents to let an app steal, just like we can with limited photos access?
- EVa5I7bHFq9mnYK 2y agoIt asks for, but does not require access to contacts. As of lately, it does not require phone number either.
- negative_zero 2y agoGrapheneOS allows you to do this. The downside is that it only runs on Pixel phones.
- FabHK 2y ago> An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media. Any sources for this except the private testimony of a Signal competitor talking about his important friends? (ETA: Or is it when the court/media obtains your unlocked phone, in which case Telegram won't protect you either...)
- stufffer 2y agohttps://discuss.techlore.tech/t/tucker-claims-nsa-had-access-to-his-signal-messages/7477 https://discuss.techlore.tech/t/tucker-claims-nsa-had-access...
- notachatbot1234 2y agohttps://www.washingtonpost.com/politics/2023/06/07/tucker-carlson-ufos-twitter-fox-news/ https://www.washingtonpost.com/politics/2023/06/07/tucker-ca...
- daedalus_j 2y agoMy guess would be that their phone was taken from them, unlocked, and their messages were accessed that way. I know several large IT orgs that have done this when Legal got involved. Literally using a 2nd phone to take pictures of Signal chats on the phone in question.
- nabakin 2y agoOr some sort of spyware like Pegasus
- treprinum 2y agoWhich messaging app applies US, Russian and Chinese encryption on each message/metadata at the same time that neither agency can break it alone?
- imjonse 2y agoDurov's exile and distancing from Russia after the VK takeover may be just for show and for selling Telegram as 'the dissident app'. It is popular, easy to use and insecure.
- crazywulf 2y agoIf you really have secrets which you don't wanna share, then you should not trust any of these services. Develop your own service or stick to PGP mails.
- deleted 2y ago[deleted]
- benterix 2y agoAs far as we can tell, they are both insecure: Telegram is closed source and Signal published their source but basically forces users to use the Google Play version which lags behind the OS version and you can never be 100% sure what it does, not to mention things like SGX.
- rglullis 2y agoGo on, keep defending the overlord you believe have your best interests at heart while the other 57 of us go worry-free, using Matrix or XMPP.
- cookiengineer 2y agoYou will eventually revise your opinion once you find your chat logs 20 years later in some randomly occuring IRC logs because that one guy was using an IRC bridge. You cannot critique missing guaranteed end to end encryption when effectively matrix cannot guarantee it either.
- MattJ100 2y agoYes it can. End-to-end encryption is enforced by your app, not by the protocol you use. This is a key part of how end-to-end encryption works.
- rglullis 2y agoIf one guy gets their device compromised or decides to publish the contents of a conversation, is it that a problem of E2E? Of course not.
- Sebb767 2y ago> You will eventually revise your opinion once you find your chat logs 20 years later in some randomly occuring IRC logs because that one guy was using an IRC bridge. E2EE can not prevent the receivers from sharing the message (they are one of the "end"s in "end to end-encryption" after all"). The same thing could happen because one person in the group chat ends up getting some ransomware on his phone; E2EE can not prevent that.
- deleted 2y ago[deleted]
- 2OEH8eoCRo0 2y agoSo since Signal has a board member who worked at a place that some people don't like then the Signal app must be backdoored/compromised/honeypot? That's one hell of a leap. How far has our requirement for evidence fallen?
- Tycho 2y agoUm, yes. When the “place that some people don’t like” is all sorts of CIA-connected NGOs and you’re a member of group defined by its paranoia about privacy, then absolutely this becomes disqualifying.
- gitfan86 2y agoIt is kind of too late at that point. Good security requires proactive measures.
- mikeyouse 2y agoYes. The crew pushing for this is 100% bad faith, it’s pretty contemptible.
- mtremsal 2y agoAFAICT Signal is collateral damage in this disinformation campaign. The original attack seems to be aimed at the CEO of NPR, coming from an assortment of right wing (and some Russian-aligned) voices. She happens to also be on the board of Signal which, through the prism of conspiracy theory, now extends their crusade. Given that Telegram is commonly understood to be aligned with the Russian government, this maps neatly on the US/left vs Russia/right axis through which such people already understand the world.
- cryptoboy2283 2y agoSo, who has actually launched "a pretty intense" campaign here? https://twitter.com/matthew_d_green/status/1788386090841161913 https://twitter.com/matthew_d_green/status/17883860908411619... https://twitter.com/evacide/status/1788040276331884593 https://twitter.com/evacide/status/1788040276331884593 https://twitter.com/naomibrockwell/status/1788634952269009390 https://twitter.com/naomibrockwell/status/178863495226900939... https://twitter.com/paulmillr/status/1788563576455610552 https://twitter.com/paulmillr/status/1788563576455610552 (I'm pretty sure the list goes on)
- r721 2y agoHere's the other side: https://news.ycombinator.com/item?id=40301508 https://news.ycombinator.com/item?id=40301508 https://news.ycombinator.com/item?id=40336005 https://news.ycombinator.com/item?id=40336005 https://news.ycombinator.com/item?id=40330694 https://news.ycombinator.com/item?id=40330694 https://news.ycombinator.com/item?id=40308241 https://news.ycombinator.com/item?id=40308241 https://news.ycombinator.com/item?id=40299313 https://news.ycombinator.com/item?id=40299313 https://news.ycombinator.com/item?id=40298608 https://news.ycombinator.com/item?id=40298608 https://news.ycombinator.com/item?id=40279661 https://news.ycombinator.com/item?id=40279661 https://twitter.com/jack/status/1787895769183268948 https://twitter.com/jack/status/1787895769183268948 https://twitter.com/elonmusk/status/1787908190799278360 https://twitter.com/elonmusk/status/1787908190799278360 https://twitter.com/elonmusk/status/1787589564917490059 https://twitter.com/elonmusk/status/1787589564917490059
- cryptoboy2283 2y agoAre you pointing out that Mr. Durov is in conspiracy with... Jack Dorsey and Elon Musk?
- r721 2y agoIn my opinion this has started as part of Rufo's campaign against Katherine Maher (see https://news.ycombinator.com/item?id=40341993 https://news.ycombinator.com/item?id=40341993), then Dorsey and Musk boosted that article because it aligns with their political views. Durov decided to add Telegram vs Signal angle in his post.
- bloqs 2y agoTelegram has never AFAIK been open, and is thus insecure and always has been
- sevagh 2y ago[flagged]
- jeroenhd 2y agoIt's completely fair to criticise Signal for its weird decisions (like that time they stopped publishing part of their code for a while to surprise everyone with a crypto scheme. However, when this criticism comes from an insecure competitor that was forced to pay back immense amounts of money for misleading investors about crypto, I wouldn't take that at face value. Signal is mostly fine with some weird/bad decisions. Telegram is worse in every single way. All of that said, I've never seen any of the cryptocurrency shit show up in my phone. Is it geofenced or something?
- deleted 2y ago[deleted]
- sevagh 2y agoIt's exactly as hidden/opt-in as the Stripe crypto settings, where Stripe was completely shit on in 20 comments about scams, scamming, and scam currencies. Downvoters hate having their double standard revealed.
- pt_PT_guy 2y agoThey want to do this because they want more traction for their blockchain: TRON, which, IIRC, is the payment method for ads, usernames and "stuff" inside Telegram. However Du Rove is right about a bunch of things: - Signal clients suck, specially the Desktop one where they ship (or used to) pre-built binaries like their own lib: https://github.com/signalapp/ringrtc https://github.com/signalapp/ringrtc - Also you can't have Signal without Google Play Store - Signal client suck in usability. I wish I had Telegram client (android) and desktop (qt) instead of this electron garbage. Telegram clients are super-duper-awesome - I would say that removing phone number requirement is their #1 request. yet they take so much time to address it, specially when they cry about phone number validation SMS costs - BTW, telegram is implementing a very nice idea of a crowd sourced sms validation, where they use their users phone numbers to send the validation sms - They have a very questionable crypto integration with MobileCoin, which have a obscure value: they depend on IntelSGX and is 95% pre-mined
- r0ks0n 2y agoton and tron are not the same thing
- pt_PT_guy 2y agoty. you're right
- luuurker 2y ago> you can't have Signal without Google Play Store You can use Signal without the Play Store. Download the apk from Signal's website and it will use a background connection to receive calls and notifications. The downside is that it's heavier on the battery.
- pt_PT_guy 2y agojust that? then why not a f-droid release?
- 2y ago
- hacker_88 2y agoConcerning
- danpalmer 2y agoThis issue is sadly all just identity politics. Telegram is frequently associated with fringe groups, conspiracy theorists, anti-vaxxers, and "the right". Signal is pushed by the sort of lefty-liberals who quit Twitter, by journalists, and more associated with the mainstream media. This is not to group everyone, I realise there are communities that cross that divide, and this is no judgement of people using either. But I think this divide will continue as the political trends continue. Both sides believe they are right, both more than they perhaps should given the evidence. That said, I'll stick with the one the cryptography/security nerds are using, not the one they think is a honeypot.
- deleted 2y ago[deleted]
- mikae1 2y agoI can only see the first message in this thread. What does it say?
- r721 2y agohttps://threadreaderapp.com/thread/1789687898863792453.html https://threadreaderapp.com/thread/1789687898863792453.html
- cookiengineer 2y agoMaybe just don't use either one and switch to briar or tox instead?
- redbell 2y ago> Telegram has launched a pretty intense campaign to malign Signal as insecure, with assistance from Elon Musk I got a bit confused here! Didn't Musk support and encourage people to "Use Signal" three years ago?! https://twitter.com/elonmusk/status/1347165127036977153 https://twitter.com/elonmusk/status/1347165127036977153
- novaRom 2y agoThere are multiple layers where interception can happen: 1) On-screen keyboard - by default most phones do send what is being typed - a lot of phones also have 3rd party keyboards of doubtful origin preinstalled 2) "Enable backup" scam - on starting an app (like Google Photos or WhatsApp) chances you or your wife accidentally press "ok" on a pop up message 3) Hardware drivers - non open source binary blobs with back doors 4) Operating system - you basically don't know what information is logged and sent back to phone's vendor
- orbital-decay 2y ago>by default most phones do send what is being typed That's extraordinary if true. Do you have anything to back it up, though? Even Google (!) wasn't brazen enough to log everything typed on Gboard, they implemented federated learning.
- dbmnt 2y agoI wouldn't say "most phones", but perhaps most of them in China: https://www.technologyreview.com/2024/04/24/1091740/chinese-keyboard-app-security-encryption/ https://www.technologyreview.com/2024/04/24/1091740/chinese-...
- idk1 2y ago...my husband might also accidentally press "ok" too.
- deleted 2y ago[deleted]
- deleted 2y ago[deleted]
- not_me_ever 2y ago[flagged]
- ibobev 2y agoDid someone watch Tucker Carlson's interview with the Telegram creator Pavel Durov? https://www.youtube.com/watch?v=1Ut6RouSs0w https://www.youtube.com/watch?v=1Ut6RouSs0w
- fecker 2y ago[flagged]
- api 2y agoI've always at least strongly suspected that Telegram is a FSB honeypot. It's insecure by default so I guess it could be an everyone-honeypot. I'll keep using Signal for my secure messaging thank you very much. Honestly I trust Apple iMessage encryption more than Telegram.
- axegon_ 2y agoLet me set a few things straight: Telegram is for the most part tiktok for people that don't mind putting some effort into reading on a few odd occasions. Saying that I have a lot of Ukrainian friends would be an understatement and the are the only reason I have telegram-all of them favor it, which, all things considered, is a grave mistake. In practice, telegram is far more closely related to tiktok and twitter than a messaging app and by extension it is heavily used to spread misinformation: telegram channels are ultimately under the complete control of their admins and they have the ultimate authority with no way of doing anything about it. Twitter was forced to put some effort into it through community notes but that hasn't even made a dent: it literally takes two google searches to find tens of thousands of bot accounts spreading misinformation. In that regard, telegram is much worse since it's an infinite source of cognitive dissonance: People are willfully joining echo chambers, which are openly advertised as such. I am really glad that telegram is nowhere nearly as big in western countries compared to eastern Europe. It pains me to say this but, but even till this day, us eastern Europeans are way more susceptible to propaganda than the western world, although, for a million and one reasons that seems to have a huge effect on the western world as well. In that sense, telegram is an active contributor. 10/10 times I'll sit firmly behind Signal, despite the many shortcomings: there is no developer integration, if you want to create a signal account for your own personal bots or whatever, you can but only through a hacky repo that's on github. Yes, the people behind telegram know all this very well and they don't like the fact that people who are aware of it as well are favoring signal infinitely more than telegram.
- 5e92cb50239222b 2y agoAnd that's good, that's their strength. I use it to read information from all sides of the conflict and decide for myself what's "disinformation" and what's not. A grown person doesn't need a gatekeeper that pushes their own interests and shuts up anyone daring to contradict them.
- axegon_ 2y agoOh yeah, "both sides". Sure... Wanna ask the two orphans living at my cousin's where their parents are and who killed them? How many thousands of such examples do you need? I'm sure as hell I can supply you with a sufficient amount, even worse than straight up shooting a child's parents in front of their eyes.
- dncornholio 2y agoWhere are the facts? This is just made-up drama. No tech involved in this. Ah let's throw Elon Musk in there for some extra points. I'm sad to see so many people swallow this up.
- ants_everywhere 2y agoHere's some global context from the past week or so. I'm just piecing this together, maybe someone more informed can comment: - The Polish spy chief is warning that Russia intends to invade a NATO state in the near future [0] - Poland is strengthening its border with Belarus [1] - Germany is considering conscripting all 18 year olds in the face of what it perceives as Russian aggression [2] - Russia warns of "enormous danger" if NATO troops are sent to Ukraine [3] - Russia threatens to use "special ammunition" against NATO [4] Headlines were starting to read like this immediately before the Russian invasion of Ukraine. We saw troop buildups and threats for a while before any action was taken. Amidst all this, there's a sudden push to move people off of Signal and onto the Russian-developed Telegram, which is widely regarded as less secure and is even not encrypted by default. Telegram now operates out of the UAE, which has long been a partner with Russia. Wikipedia has this to say about the strengthening of UAE-Russia relations since the invasion of Ukraine: > trade between the two nations strengthened with many Russians relocating to the UAE to invest in real estate, business, or "escape financial restrictions in Europe". Trade between the two countries has doubled to $5 billion since 2020 and there are approximately 4,000 companies with Russian roots that are operating within the country. So, my take here is that this push toward telegram smells pretty bad given the timing. Telegram has always had kind of a smell about it, given that it rolled its own crypto and given Durov's involvement with the VK social network which was, in Durov's POV (again according to Wikipedia), taken over by Putin's faction. Personally, I like Signal. I have some of the same concerns folks here have brought up. But it's been well vetted by experts and is highly regarded by people I trust. That doesn't mean you have to like Signal. Its crypto improvements have been spread to other apps, and many people are probably just fine using something like iMessage. And while I don't know anything about Durov or his motives, I have yet to see any successful cryptography app anywhere in the world that didn't eventually have to compromise with a government. And Russia seems especially good at applying pressure, with a history of institutional tips and tricks that go back at least to the Soviet secret police, and possibly even further back to the Tsars. As much as I think we can't objectively trust the US government in all matters, I think we can generally trust the cryptography experts. They tend to be skeptical of all governments when it comes to cryptography, even in democracies. So that's my two cents. I wouldn't switch from Signal to Telegram. If you're on Telegram and you have especially interesting activity (like you fight in a war), then you should probably assume that Russia can see everything you're doing. That may change if Telegram gets the sort of robust cryptographic scrutiny Signal has. If you're not warring, you're not doing exotic fancy crimes, and you live in a democracy, you're probably fine with either app but possibly a little better off with Signal or iMessage. [0] https://www.newsweek.com/russia-ready-launch-offensive-nato-country-poland-1898213 https://www.newsweek.com/russia-ready-launch-offensive-nato-... [1] https://abcnews.go.com/International/wireStory/poland-strengthening-border-belarus-plans-reinforce-border-russia-110066544 https://abcnews.go.com/International/wireStory/poland-streng... [2] https://www.telegraph.co.uk/world-news/2024/05/11/germany-considering-conscription-for-all-18-year-olds/ https://www.telegraph.co.uk/world-news/2024/05/11/germany-co... [3] https://www.telegraph.co.uk/world-news/2024/05/11/germany-considering-conscription-for-all-18-year-olds/ https://www.telegraph.co.uk/world-news/2024/05/11/germany-co... [4] https://timesofindia.indiatimes.com/world/rest-of-world/former-russian-president-medvedev-threatens-nato-with-special-ammunition/articleshow/110083527.cms https://timesofindia.indiatimes.com/world/rest-of-world/form...
- deepsun 2y agoIt seems like a twitter thread of multiple messages. How can I read the rest of the messages, not just /1? There's no links to them.
- deepsun 2y agoFound the answer to my question in comments here: https://nitter.poast.org/matthew_d_green/status/1789687898863792453 https://nitter.poast.org/matthew_d_green/status/178968789886...
- deleted 2y ago[deleted]
- dathos 2y agoI use threadreader app for this.
- laniakean 2y agohttps://threadreaderapp.com/thread/1789687898863792453.html https://threadreaderapp.com/thread/1789687898863792453.html You can use the above link. Otherwise, you will have to log in, unfortunately. Earlier, we could have used a nitter instance, but all of them have been blocked.
- deleted 2y ago[deleted]
- kornhole 2y agoThis post does not explain how Telegram is campaigning to malign Signal. On the other hand, the CEO of Signal recently posted this: https://mastodon.world/@Mer__edith/112413358315296528 https://mastodon.world/@Mer__edith/112413358315296528
- YPPH 2y agoThey can't be compared because Signal's criticism of Telegram is legitimate and warranted, Telegram's criticism of Signal isn't. Telegram isn't even an encrypted messenger.
- kelipso 2y ago1. Accuse Telegram of conducting a campaign against Signal 2. Conduct an astroturfed campaign for Signal 3. ??? 4. Crypto profits!
- kornhole 2y agoWhich big centralized messenger operator can be more trusted to run the SW they say they are running is always a contentious shifting argument. If you host your own or use a small hoster, these arguments about who might have been compromised or compelled are not relevant. Decentralized and federated protocols such as Simplex.chat, XMPP, Nextcloud Talk, Matrix, Session, and Delta Chat eliminate this concern.
- aaron695 2y ago[dead]
- reportgunner 2y agoNot being in either Telegram/Signal camp I see a lot of tribalism in the comments. It seems that any arguments for/against either one end up in politics. Like I understand that Telegram is probably not very secure, but seeing what proponents of Signal are saying doesn't really make me trust Signal either.
- thisislife2 2y agoIt is political. As I mentioned elsewhere in HN, Telegram is now being promoted in the US by the political-right there because they have lost trust in US BigTech social media platforms who, they believe, are "unjustly" censoring them on their platform. That is why the right-leaning media are now heavily promoting Telegram ( https://www.youtube.com/watch?v=1Ut6RouSs0w https://www.youtube.com/watch?v=1Ut6RouSs0w ) and bashing other platforms ( https://www.city-journal.org/article/signals-katherine-maher-problem https://www.city-journal.org/article/signals-katherine-maher... ).
- reportgunner 2y agoYou mean the BigTech social media platforms that use Signal's protocol for messaging ? Wow I wonder why the people who don't trust BigTech social media don't choose Signal that is actually insane. If it is indeed political don't try to bring some kind of technological merit into this, it makes you look really dishonest.
- thisislife2 2y agoYou missed my point - I am agreeing with you that the arguments for or against both end up political, because politics is the reason both are being promoted. Technically both products are equivalent. And both products may also be sharing data with government(s). The right- in the US just hope that Telegram isn't sharing it with the US government. :)
- zug_zug 2y agoIn theory somebody could just make a client that takes your message, generates a random string, XORs your message by that, and sends the XOR via Signal and the rest via Telegram.
- jwells89 2y agoI think Signal could stand to gain popularity by either prioritizing overall niceness and polish in their clients (especially on desktop) or by allowing third parties to build clients which prioritize those things. iMessage, Telegram, and Signal all get usage from me, with the vast majority of that usage weighted heavily on the former two because that’s where most people in my circles are. When comparing user experience between the three, it’s easy to see why.
- altairprime 2y agoAllowing third party clients that provide identity verification signatures would be totally excellent, and I would support that. Signal does this today by verifying phone numbers themselves, so they’d have to continue doing so centrally; “never trust the client” applies to their own client just as much as anyone else’s, and “allow unverified users to initiate contact with strangers” is the spam vector infecting all modern telephony (thus STIR/SHAKEN). So with that need resolved, the biggest risk of third party clients would be intentionally compromised code within an attractive wrapper — but the only way to defend against that is to not allow third party clients at all. So.. I guess I no longer support third-party clients, having worked through the timelines of what will occur. Ah well.
- vtrenc 2y agoDu Rove made the original post on May 8th 7:31, judge it yourself if it is 'pretty intense'. Boast that end-to-end encryption is absolutely safe is obscurantism. If you want most security in transmission, share your GPG public keys face-to-face. Du Rove made this post after the founder of Twitter forwarded an article about Signal. Instead of Elon Musk who has turned Twitter into a easy to surveillance platform. It was also Elon Musk who used to be very direct and later learned to be smart these days. I strongly recommend reading the original post yourself first.
- amai 2y agoPavel Durov talks about security? The guy who thought having clear text passwords for his social network VK was a good idea? https://www.vice.com/en/article/d7yyqv/another-day-another-hack-100-million-accounts-for-vk-russias-facebook https://www.vice.com/en/article/d7yyqv/another-day-another-h...
- deleted 2y ago[deleted]
- stefandesu 2y agoI really like Telegram from a UI/UX standpoint (so much better than Signal), but Pavel Durov is such a sketchy character that it's starting to turn me off. How can he be touting about being secure when they still haven't implemented end-to-end encryption by default? Also so many other things if you follow Durov's channel. (I use Telegram and Signal each for about 45% of my messaging, even though I'm in Europe where WhatsApp is so prevalent.)