4 ms·

Given the location of Telegram's servers (Dubai), and the nature of the government (neutral dictatorship) and the lack of encryption, my default assumption woul

by pydry 2y ago

Given the location of Telegram's servers (Dubai), and the nature of the government (neutral dictatorship) and the lack of encryption, my default assumption would be that not only are they selling access to your data to major governments, they've probably even streamlined the bidding process.

XorNot 2y ago
Yep. The magic of "you could turn on encryption" is that nearly all people using it won't. "Ah, but if you need encryption then you'll..." - well, two things now. Suddenly you're the person who has encryption switched on. And also more likely, someone they talk to will forget to switch it on and just blab everything into cleartext anyway. The entire importance of Signal's model is that it is always encrypted. It's why LetsEncrypt is also important: to have effective security you need to be able to hide in the crowd. If encryption usage is rare, then who's using it itself (or suddenly starts using it) becomes an extremely valuable datapoint. (so I'd add: Telegram absolutely sell timeline details of which user accounts change their frequency of encrypted chat usage).
- piaste 2y ago
  Addressing only one point, not your main one which I agree with: > And also more likely, someone they talk to will forget to switch it on and just blab everything into cleartext anyway. I expect that if you enable a Telegram Secret Chat with Bob, Bob cannot unilaterally un-secret it. I would be very surprised if that was the case. Of course Bob can then share the contents with Carol via an un-encrypted channel. But every encrypted channel has that weakness.
  - nani8ot 2y ago
    Last I used Telegram, creating an e2ee chat with someone added an encrypted chat in addition to the unencrypted chat. This means if your not careful in which chat with a single person a message is sent to it's easy to accidentally send unencrypted data. I'd guess this is possible because Telegram e2ee chats aren't multi-device capable, so it's necessary to be able to use unencrypted chats while using Telegram on something else than the phone with e2e.
vbezhenar 2y ago
Both Russians and Ukrainians use Telegram, including confidential messaging with their agents on the foreign territory. So that's a prove enough for me, that it's safe enough.
- lukan 2y ago
  "including confidential messaging with their agents on the foreign territory" Possible, as many ridiculous things happened around the whole war. (Recently german generals on a video chat were targeted by the russians, wasn't too hard, they did not use any encyption at all) Sources would be nice though. But it really would not be a reason for me to trust telegrams security. Rather a confirmation again, that also secret services can show great incompetence.
  - vetinari 2y ago
    > Recently german generals on a video chat were targeted by the russians, wasn't too hard, they did not use any encyption at all They used Webex. Doesn't Webex use any encryption at all?
    - lukan 2y ago
      It can use encryption. But they choose not to for probably lazy reasons. Which is bad for normal persons, even worse for generals who should lead by example - and ridiculous for generals with an background in IT who really should know better. But as far as I know, there were no real consequences so apparently it was not such a big deal. https://en.m.wikipedia.org/wiki/German_Taurus_leak https://en.m.wikipedia.org/wiki/German_Taurus_leak
- ceejayoz 2y ago
  Which bits of this war scream “good judgement and opsec” to you? https://www.nytimes.com/2023/01/04/world/europe/ukraine-russia-cellphones.html https://www.nytimes.com/2023/01/04/world/europe/ukraine-russ... > Ukrainian artillery targets Russian soldiers by pinpointing their phone signals. Despite the deadly results, Russian troops keep defying a ban on cellphone use near the front.

by pydry 2y ago

XorNot 2y ago

Yep. The magic of "you could turn on encryption" is that nearly all people using it won't. "Ah, but if you need encryption then you'll..." - well, two things now. Suddenly you're the person who has encryption switched on. And also more likely, someone they talk to will forget to switch it on and just blab everything into cleartext anyway. The entire importance of Signal's model is that it is always encrypted. It's why LetsEncrypt is also important: to have effective security you need to be able to hide in the crowd. If encryption usage is rare, then who's using it itself (or suddenly starts using it) becomes an extremely valuable datapoint. (so I'd add: Telegram absolutely sell timeline details of which user accounts change their frequency of encrypted chat usage).

piaste 2y ago
Addressing only one point, not your main one which I agree with: > And also more likely, someone they talk to will forget to switch it on and just blab everything into cleartext anyway. I expect that if you enable a Telegram Secret Chat with Bob, Bob cannot unilaterally un-secret it. I would be very surprised if that was the case. Of course Bob can then share the contents with Carol via an un-encrypted channel. But every encrypted channel has that weakness.
- nani8ot 2y ago
  Last I used Telegram, creating an e2ee chat with someone added an encrypted chat in addition to the unencrypted chat. This means if your not careful in which chat with a single person a message is sent to it's easy to accidentally send unencrypted data. I'd guess this is possible because Telegram e2ee chats aren't multi-device capable, so it's necessary to be able to use unencrypted chats while using Telegram on something else than the phone with e2e.

vbezhenar 2y ago

Both Russians and Ukrainians use Telegram, including confidential messaging with their agents on the foreign territory. So that's a prove enough for me, that it's safe enough.

lukan 2y ago
"including confidential messaging with their agents on the foreign territory" Possible, as many ridiculous things happened around the whole war. (Recently german generals on a video chat were targeted by the russians, wasn't too hard, they did not use any encyption at all) Sources would be nice though. But it really would not be a reason for me to trust telegrams security. Rather a confirmation again, that also secret services can show great incompetence.
- vetinari 2y ago
  > Recently german generals on a video chat were targeted by the russians, wasn't too hard, they did not use any encyption at all They used Webex. Doesn't Webex use any encryption at all?
  - lukan 2y ago
    It can use encryption. But they choose not to for probably lazy reasons. Which is bad for normal persons, even worse for generals who should lead by example - and ridiculous for generals with an background in IT who really should know better. But as far as I know, there were no real consequences so apparently it was not such a big deal. https://en.m.wikipedia.org/wiki/German_Taurus_leak https://en.m.wikipedia.org/wiki/German_Taurus_leak
ceejayoz 2y ago
Which bits of this war scream “good judgement and opsec” to you? https://www.nytimes.com/2023/01/04/world/europe/ukraine-russia-cellphones.html https://www.nytimes.com/2023/01/04/world/europe/ukraine-russ... > Ukrainian artillery targets Russian soldiers by pinpointing their phone signals. Despite the deadly results, Russian troops keep defying a ban on cellphone use near the front.