5 ms·

I don't know about Telegram being nasty towards Signal but Signal brought this upon themselves. Metadata are more important than the content of the messages an

• Quiark 2y ago
  Not sure if metadata is more important but ok. Signal has launched support to use nicknames instead of phone numbers although it's true this took a long time. I think Telegram is very wide-spread for running large group chats and communities, a use case that Signal is not interested in. Personally, I want my chats end to end encrypted and I'm grateful to Signal for pioneering this and inspiring Whatsapp, facebook messenger and others to adopt the same.
  • rfoo 2y ago
    > Signal has launched support to use nicknames instead of phone numbers You will still need a phone number to sign up for Signal. Signal still knows your phone number, you just hide it from your contacts. To me this only makes it even more suspicious.
    • OSI-Auflauf 2y ago
      You need a phone number to sign up for Telegram as well. And you can correlate username to phone number not that hard in most standard setting cases.
      • nottorp 2y ago
        Yeah, basically both super duper encrypted privacy oriented services want your phone number. Sorry, but that's not privacy. I don't care what they do to encrypt your messages, they are still tied to me, which makes the super duper encryption pointless.
        • OSI-Auflauf 2y ago
          You compare apples with oranges. Because if you'd compare the apples , you'd notice one of them has no usable E2E. Yes oranges umm phone numbers is a problem. They have that both. Only one can additionally read the contents. Thats for now the price for a normie interface. First goalposts first.
          • rfoo 2y ago
            I agree with you that Telegram does not even have E2EE and that's bad. But in this thread, GP was just talking about metadata. The goalpost here is metadata. GP particularly mentioned that Signal "fixed" the phone number issue and I just want to note that currently Signal isn't any better than Telegram in this aspect. And then you moved orange back.
            • gkbrk 2y ago
              > Telegram does not even have E2EE This is incorrect. Telegram has E2EE. https://core.telegram.org/api/end-to-end https://core.telegram.org/api/end-to-end
              • rfoo 2y ago
                I don't see how I can start an E2EE chat from my PC. If a feature only ever exists on phone it does not exist. https://github.com/telegramdesktop/tdesktop/issues/871 https://github.com/telegramdesktop/tdesktop/issues/871
              • input_sh 2y ago
                ...in secret chats, that are only available in 1-to-1 conversations via mobile apps. So, not on by default (unlike Signal), no group chats (unlike Signal), no support at all in desktop apps (you've guessed it: unlike Signal).
  • kome 2y ago
    People has been killed based on metadata https://www.nybooks.com/online/2014/05/10/we-kill-people-based-metadata/ https://www.nybooks.com/online/2014/05/10/we-kill-people-bas...
    • threeseed 2y ago
      No is arguing the metadata is harmless but it's significantly less of an issue than not having E2EE.
      • paulnpace 2y ago
        When they-them-those know who you are, knowledge of the full attack surface is the better way to compromise because it leaves the first step to compromise uncompromising-appearing. (The attack surface is broader than people generally consider, as it should include over-the-shoulder attacks, XKCD's wrench attack, etc.) The success of such tactics can more easily be understood by even looking through the many, many comments right in this thread telling us Signal protects metadata because usernames are now a feature - guys, Signal has the metadata as the *services* are what is the topic of discussion here, not other users.
  • shiandow 2y ago
    Not sure if you've got your sequence of events straight. End-to-end encryption was added to Whatsapp after it was bought by Facebook, before the co-founder of Whatsapp left to found Signal. It's not as simple as Signal inspiring Facebook and Whatsapp, the sequence of events happened in reverse order.
    • tomek_ycomb 2y ago
      I think this not wrong but mildly misleading. Whatsapp started encrypting messages after significant security issues in ~2012 It was purchased by Facebook under initially some administration separation terms in ~2014? In 2016 it added e2e encryption. If I recall this was controversial because it limits fb ad potential on users. I guess what I'm trying to say is that the timeline seems to me to still be pointing towards <<e2e came from Whatsapp not FB as an initiative, even if FB owned Whatsapp at the time.>> Again you're not factually wrong, but I hope my restating of the timeline makes it more clear why i I think your reverse order point doesn't tell the same story.
      • shiandow 2y ago
        Your explanation is definitely better than mine. I just wanted to rebuke the notion that it was Signal who inspired Whatsapp to use e2e.
  • EVa5I7bHFq9mnYK 2y ago
    >> Signal has launched support to use nicknames Wow, really? ICQ had that in 1996 ...
• baq 2y ago
  > To me Telegram is going after WhatsApp, not Signal. yeah exactly so what is actually going on here?
• OSI-Auflauf 2y ago
  Signal has got Usernames now. You can block number discovery. You can't resolve username to number. Your main account ID internally is not your number anymore. If 2 users add you using 2 different links or usernames. Its now harder to confirm its the same account.
  • alexpc201 2y ago
    Tell me, can you have a Signal account WITHOUT giving them your phone number?
    • Razengan 2y ago
      Can you sign up for Telegram without a phone number?
      • kojoru 2y ago
        Yes: https://telegram.org/blog/ultimate-privacy-topics-2-0 https://telegram.org/blog/ultimate-privacy-topics-2-0
        • luuurker 2y ago
          Without "SIM card" and "without a number" are different things. Apparently you still need a number, a "blockchain-powered" number: "[...] You can have a Telegram account without a SIM card and log in using blockchain-powered anonymous numbers available on the Fragment platform."
          • OSI-Auflauf 2y ago
            Irs super complicated to use. And you need an existing Telegram account to actually handle that cryptocurrency to buy these pseudo-numbers outside of the telephone namespace. Guess what you need to register those. An actual working phone number.
        • NicuCalcea 2y ago
• spoiler 2y ago
  [flagged]
  • FabHK 2y ago
    > Telegram doesn't enable E2E out of the box because it wanted users to compare some image matches in person (akin to the idea of PGP sign parties I suppose?) That makes sense only in the context of e2ee to avoid MITM attacks, unless I'm mistaken.
• grandchild 2y ago
  As of a few weeks ago, you can hide your phone number on Signal, and it's even the default, even for existing accounts. You can even opt in to disable discovery by someone who already knows your number.[0] > To me Telegram is going after WhatsApp, not Signal. They mention Signal by name in the referenced post. [0] https://signal.org/blog/phone-number-privacy-usernames/ https://signal.org/blog/phone-number-privacy-usernames/
• rahen 2y ago
  Telegram also exchanges metadata. Only Sessions and Tox achieve full and decentralized privacy.
• raspyberr 2y ago
  But Signal specifically used phone numbers to leverage the already existing social graph on your phone. The numbers were never transferred or stored by Signal. You can literally see what information they gave when they were subpoenad: https://signal.org/bigbrother/central-california-grand-jury/ https://signal.org/bigbrother/central-california-grand-jury/
  • dooglius 2y ago
    If you read the PDF, the phone numbers are in the subpoena as the key for what's being requested, so yes they clearly were stored in a way Signal can access.
    • _djo_ 2y ago
      Your account phone number, yes. But, most importantly, Signal doesn't store your social network in its servers in a way that it could give authorities the phone numbers of all the people you communicate with. Or, worse, the times and dates of those conversations. So all it can tell authorities is that a person with x phone number uses Signal and still uses it.
  • nottorp 2y ago
    > to leverage the already existing social graph on your phone I have little trust in an entity that "leverages the social graph" though... Your encryption may be great, but if you act like Farmville I'm going to trust you as much as I trust those facebook games that spam your friend list.
• ecocentrik 2y ago
  Signal is still a significant improvement in security and privacy over SMS, Telegram, Discord, X, Whatsapp... It achieved the level of privacy that solutions like PGP tried and mostly failed to achieve for decades. Being tied to a phone number was part of the convenience of their solution. Allowing for nicknames now, might improve on the metadata leakage problem slightly. I'm sure reactionists will immediately drop Signal because Elon the great said they should without considering that it still might be their best solution to communicate privately with their friends and family. But X makes *all* of it's money from collecting a lot more than metadata from their users, Tesla collects driving data and metadata from all of its customers, Grok trains it's AI on all of the data collected from X, Tesla and other sources without asking if users want to opt out of those training datasets. So I'm not sure Elon has a leg to stand on in this conversation.
  • GuB-42 2y ago
    > I'm sure reactionists will immediately drop Signal because Elon the great said they should Signal got a massive boost in popularity because "Elon the great" literally told people to "Use Signal".
    • deleted 2y ago
      [deleted]
    • ecocentrik 2y ago
      Did it really, or did he just jump on the Signal train after it had already left the station? Can you tell the difference? I'm sure he drove some users to the platform, but the technology and the platform have mostly spoken for themselves.
• craigmart 2y ago
  You are speaking of metadata as if all metadata is equal. Signal does collect phone numbers (even though, since usernames have been introduced [1], this can be made opt in from now on), but not the contacts or social graph, neither many other relevant metadata [2]. What they can gather from this, is only when the specified phone number registered to signal services and its last connection to the server [3]. So, if you can call "metadata exchanging app" an app that simply has a list of numbers registered to the service, without any metadata assigned to them except their last access, the same label could be assigned to a much larger number of services. It may not be anonymous, but it can hardly be disregarded as private. [1] https://signal.org/blog/phone-number-privacy-usernames/ https://signal.org/blog/phone-number-privacy-usernames/ [2] https://signal.org/blog/sealed-sender/ https://signal.org/blog/sealed-sender/ [3] https://signal.org/bigbrother/central-california-grand-jury/ https://signal.org/bigbrother/central-california-grand-jury/
  • hifromwork 2y ago
    >but not the contacts or social graph, neither many other relevant metadata [2]. Assuming you trust them (notice all your links point to signal.org own publications). Most of the privacy people are cautious/paranoid and assume that everything that can be collected is collected. Even assuming a lack of malicious intent, what's stopping NSA from hacking into Signal's infrastructure and logging who's talking to who along with timestamps? That's not to say I don't trust signal (it's the best mainstream solution right now), but it could do better to hide metadata from the protocol.
    • craigmart 2y ago
      The point is that you don't have to trust them because the client (where the relevant cryptography is performed) is open source and the fact that my links point to signal.org is completely irrelevant, those blog posts are just ways to advertise facts that are freely verifiable. You can read the source code to check the implementation of sealed senders or how the social graph is handled. NSA can hack into Signal's infrastructure, and what they will be able to gather are the same information provided by Signal in reply to subpoenas (the whole list here https://signal.org/bigbrother/ https://signal.org/bigbrother/), because everything else is end-to-end encrypted.
• deleted 2y ago
  [deleted]