7 ms·

Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. Th

Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. The bigger problem with Telegram is that it by default has insecure encryption settings (as opposed to Signal, where encrypted is the default, you need to manually activate it with Telegram + I think it's not possible to enable for all chats and clients) and to my knowledge, Telegram will outright co-operate with law enforcement agencies to just hand over unencrypted communications. I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default

1oooqooq 2y ago
> security dark pattern - make privacy a big selling point, but then don't activate the security by default pretty similar to whatsapp. they boast end to end encryption, but business account (all of them now) uses the facebook server's key, so that the business can give access to several other clients to answer customers. they still call it end to end encryption, and this was actually the last crap the original founder accepted before leaving with lots of money on the table.
- FiloSottile 2y ago
  “All of them” in what sense? I use WhatsApp dozens of times a day, and interact with business accounts every couple months at most.
  - 1oooqooq 2y ago
    Good for you, you probably do not live in a country under digital colonialism where the gov allowed facebook et al to force internet providers to tax the pop with absurdly low and expensive data limits and then "not count" things like facebook and whatsapp and one music app. In most of the global south, 100% of business have a whatsapp. In those places it pretty much replaced telephone and the green whatsapp icon is now what the current young generation recognize as the we did the black telephone outline on a business front next to a number. and if you own a business, or is self employed, it is even worse: you live by that app.
    - robertlagrant 2y ago
      Are you saying this is a worse alternative to other communication methods with businesses? What would you use with them that has better encryption?
      - xethos 2y ago
        The lack of encryption between myself and a business is less offensive than replacing an open standard (plain old telephone systems, eMail) with a proprietary and closed one, backed by a single, private corporation
        robertlagrant 2y ago
        I don't think they've been replaced, though?
        hughesjj 2y ago
        De jure or de facto?
        robertlagrant 2y ago
        Neither.
    - IG_Semmelweiss 2y ago
      i completely agree with your sentiment, but i will also say this. As an expat, this feature has enabled me to transact with locals from the convenience of my phone, even though i don't have any local line and i will not bother to get a local SIM card, nor do i want to have a US SIM and a local one interchangeably. It also enables me to be very effective when requesting services on demand, and cutting thru the on-hold time, disconnected calls, or the needless chitchat. I have many bad things to say about WA, but making living more difficult in a foreign country is not one of them.
      - 2y ago
ixwt 2y ago
EDIT: Disregard below. I'm an idiot when it comes to maps. The statement regarding if the developers are still Russian I believe is still relevant. Considering the state of Saudi Arabia, having it there is marginally better, but still problematic. And if the developers are still Russian, there's nothing saying they aren't being squeezed unless their families came with them to Dubai.
- rgrmrts 2y ago
  Dubai is in the UAE, not Saudi Arabia
znpy 2y ago
> I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default I think it's a great approach instead: the secure, end to end encryption is there and it's ready to be used. You can easily activated it but you aren't burdened by it for 99% of the time when e2e encryption is not needed.
- input_sh 2y ago
  > You can easily activated it but you aren't burdened by it for 99% of the time when e2e encryption is not needed. So, in those 1% of the cases when you actually need it, you're instantly flagging yourself as doing something fishy? Because if it ever comes down to it, good luck proving otherwise in a court. That's like the whole point of why it should be on by default. Not because me making dinner plans is something super-secret that needs to be e2e-encrypted, but because those two scenarios need to be indistinguishable from each other for e2e to be effective.
  - seanhunter 2y ago
    Yes. Additionally you are at bare minimum signalling that the metadata of the encrypted comms is worth further analysis. For exactly the same reason if you have a paper shredder, you don't only shred confidential material, you shred a bunch of junk as well to make it harder to find which pieces to reconstruct.
deepsun 2y ago
> because the FSB was demanding info from them But they gave the FSB info they asked for -- the vk.com website (facebook clone, at that time it had way more massive amounts of user data than telegram). They could have deleted the data, but no, they handed it over to FSB.
- scott_w 2y ago
  I will point out, in their defence, they handed it over to an organisation that has a habit of assisting people in learning how to fly from windows. This isn't to say Telegram is secure but that it's unlikely they "could have deleted the data" and remained alive.
  - deepsun 2y ago
    FSB mostly wanted to prevent people organizing, and that would serve it well. They already had another popular service (odnoklassniki.ru) where to direct people.
- proxysna 2y ago
  vk.com and telegram have nothing in common, except the founder. Durov was forced to sell his part in the vk.com and telegram development started after that as a response.
  - ceejayoz 2y ago
    > vk.com and telegram have nothing in common, except the founder. This is a deeply funny sentence. "Other than that, Mrs. Lincoln, how was the play?"
    - 5e92cb50239222b 2y ago
      You conveniently forgot about the second part of that comment. Durov was forced out of the country and had to cell vk.com for peanuts because of his refusal to cooperate with the government. He is still pissed off at the country at large (not just the government) and refused to add the Russian translation for years, for example, despite it having absolutely nothing to do with Putin. Since he is Russian in origin, it's okay to throw baseless accusations at him and spout nonsense like "maybe they're FSB agents" or "maybe they hired an FSB agent without knowing it". You see it here everywhere, and HN is one of the better sites in that regard. Well, maybe Signal has hired an NSA agent and doesn't know about it either? How does that sound?
viraptor 2y ago
> Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. I'd argue it's not giving us any certainty. They could've moved away to escape. They could've moved away to a nice FSB-sponsored location while making good publicity. Ideally the tech should be good enough for this issue to not matter.
- slac 2y ago
  To add to this: and they may have hired a FSB agent without knowing it.

1oooqooq 2y ago

> security dark pattern - make privacy a big selling point, but then don't activate the security by default pretty similar to whatsapp. they boast end to end encryption, but business account (all of them now) uses the facebook server's key, so that the business can give access to several other clients to answer customers. they still call it end to end encryption, and this was actually the last crap the original founder accepted before leaving with lots of money on the table.

FiloSottile 2y ago
“All of them” in what sense? I use WhatsApp dozens of times a day, and interact with business accounts every couple months at most.
- 1oooqooq 2y ago
  Good for you, you probably do not live in a country under digital colonialism where the gov allowed facebook et al to force internet providers to tax the pop with absurdly low and expensive data limits and then "not count" things like facebook and whatsapp and one music app. In most of the global south, 100% of business have a whatsapp. In those places it pretty much replaced telephone and the green whatsapp icon is now what the current young generation recognize as the we did the black telephone outline on a business front next to a number. and if you own a business, or is self employed, it is even worse: you live by that app.
  - robertlagrant 2y ago
    Are you saying this is a worse alternative to other communication methods with businesses? What would you use with them that has better encryption?
    - xethos 2y ago
      The lack of encryption between myself and a business is less offensive than replacing an open standard (plain old telephone systems, eMail) with a proprietary and closed one, backed by a single, private corporation
      - robertlagrant 2y ago
        I don't think they've been replaced, though?
        hughesjj 2y ago
        De jure or de facto?
        robertlagrant 2y ago
        Neither.
  - IG_Semmelweiss 2y ago
    i completely agree with your sentiment, but i will also say this. As an expat, this feature has enabled me to transact with locals from the convenience of my phone, even though i don't have any local line and i will not bother to get a local SIM card, nor do i want to have a US SIM and a local one interchangeably. It also enables me to be very effective when requesting services on demand, and cutting thru the on-hold time, disconnected calls, or the needless chitchat. I have many bad things to say about WA, but making living more difficult in a foreign country is not one of them.
    - 2y ago

ixwt 2y ago

EDIT: Disregard below. I'm an idiot when it comes to maps. The statement regarding if the developers are still Russian I believe is still relevant. Considering the state of Saudi Arabia, having it there is marginally better, but still problematic. And if the developers are still Russian, there's nothing saying they aren't being squeezed unless their families came with them to Dubai.

rgrmrts 2y ago
Dubai is in the UAE, not Saudi Arabia

znpy 2y ago

> I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default I think it's a great approach instead: the secure, end to end encryption is there and it's ready to be used. You can easily activated it but you aren't burdened by it for 99% of the time when e2e encryption is not needed.

input_sh 2y ago
> You can easily activated it but you aren't burdened by it for 99% of the time when e2e encryption is not needed. So, in those 1% of the cases when you actually need it, you're instantly flagging yourself as doing something fishy? Because if it ever comes down to it, good luck proving otherwise in a court. That's like the whole point of why it should be on by default. Not because me making dinner plans is something super-secret that needs to be e2e-encrypted, but because those two scenarios need to be indistinguishable from each other for e2e to be effective.
- seanhunter 2y ago
  Yes. Additionally you are at bare minimum signalling that the metadata of the encrypted comms is worth further analysis. For exactly the same reason if you have a paper shredder, you don't only shred confidential material, you shred a bunch of junk as well to make it harder to find which pieces to reconstruct.

deepsun 2y ago

> because the FSB was demanding info from them But they gave the FSB info they asked for -- the vk.com website (facebook clone, at that time it had way more massive amounts of user data than telegram). They could have deleted the data, but no, they handed it over to FSB.

scott_w 2y ago
I will point out, in their defence, they handed it over to an organisation that has a habit of assisting people in learning how to fly from windows. This isn't to say Telegram is secure but that it's unlikely they "could have deleted the data" and remained alive.
- deepsun 2y ago
  FSB mostly wanted to prevent people organizing, and that would serve it well. They already had another popular service (odnoklassniki.ru) where to direct people.
proxysna 2y ago
vk.com and telegram have nothing in common, except the founder. Durov was forced to sell his part in the vk.com and telegram development started after that as a response.
- ceejayoz 2y ago
  > vk.com and telegram have nothing in common, except the founder. This is a deeply funny sentence. "Other than that, Mrs. Lincoln, how was the play?"
  - 5e92cb50239222b 2y ago
    You conveniently forgot about the second part of that comment. Durov was forced out of the country and had to cell vk.com for peanuts because of his refusal to cooperate with the government. He is still pissed off at the country at large (not just the government) and refused to add the Russian translation for years, for example, despite it having absolutely nothing to do with Putin. Since he is Russian in origin, it's okay to throw baseless accusations at him and spout nonsense like "maybe they're FSB agents" or "maybe they hired an FSB agent without knowing it". You see it here everywhere, and HN is one of the better sites in that regard. Well, maybe Signal has hired an NSA agent and doesn't know about it either? How does that sound?

viraptor 2y ago

> Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern. I'd argue it's not giving us any certainty. They could've moved away to escape. They could've moved away to a nice FSB-sponsored location while making good publicity. Ideally the tech should be good enough for this issue to not matter.

slac 2y ago
To add to this: and they may have hired a FSB agent without knowing it.