17 ms·

EU has been complaining about Telegram's end-to-end encryption for a long time and they want to implement some regulations to basically add backdoors into all m

by chad1n 2y ago

EU has been complaining about Telegram's end-to-end encryption for a long time and they want to implement some regulations to basically add backdoors into all messaging apps. I don't really see how this case will go on since at least private chats are encrypted so Telegram (theoretically at least) can't see the contents.

EduardoBautista 2y ago
Are they going to arrest Zuckerberg and Tim Cook next for the encryption in WhatsApp and iMessage?
- deleted 2y ago
  [deleted]
- crote 2y ago
  What makes you believe those do not have backdoors for Western powers?
- verisimi 2y ago
  Perhaps they already have backdoors, but don't tell everyone.
- rubymamis 2y ago
  Maybe not, if they already got backdoors?
  - sangnoir 2y ago
    If Apple hypothetically agreed to iMessage backdoors, why would you trust the Telegram app updates served up by Apple's app store? Western government's can pretty much hack into any device they want - the only reason for backdooring messaging apps would be for dragnet surveillance, and I don't see big tech having the appetite for the bad publicity and lawsuits that will result when that inevitably becomes public
    - codedokode 2y ago
      Apple already has a kind of "backdoor": they store the keys for encrypted cloud backups in their cloud as well. They advertise that cloud data are encrypted but prefer not to mention that they also have a key to decrypt it. Even with the highest level of security [1] your contacts list in Apple Cloud are not encrypted. Why? Probably someone asked for this. [1] https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651
      - EduardoBautista 2y ago
        No, it’s because the CardDAV standard was not created with encryption in mind. It’s also why calendar and mail are not encrypted in iCloud.
        codedokode 2y ago
        CSV or PNG weren't created with encryption in mind, but one can easily encrypt them. Apple can always make their own proprietary protocol. This doesn't explain anything. However the version that the govt wants to be able to see who is in person't contact list explains it well.
        dijit 2y ago
        If Apple did that, people like me would accuse them of EEE. We don’t trust proprietary stuff because we’ve been burned by it, if there’s an open standard, even a worse one: use it. If it’s really that bad, we need to improve the standard.
        codedokode 2y ago
        As I understand, this protocol is used between an iPhone and iCloud and it being open or not doesn't change anything because there is no alternative iCloud or iPhone.
        2y ago
- zerodensity 2y ago
  I mean I wouldn't complain if they did.
- codedokode 2y ago
  They are US citizens, nobody dares to arrest them (except for Russia and North Korea).
- talldayo 2y ago
  No, because then they'd have to acknowledge that WhatsApp and iMessage are both compromised.
vizzah 2y ago
Private chats are a hassle to initiate and not multi-device. Most use normal chats. With anonymous accounts, using anonymous +888 numbers, whose price has increased from $16 to $1000+ in a matter of a year, it is indeed a very convenient playground for all sorts of activities.
- walterbell 2y ago
  In which countries are the vendors of anonymous numbers located?
  - vizzah 2y ago
    There are no vendors, Telegram issues those numbers. So it's basically a pass to create account w/o mobile number requirement, if you're ready to pay for it.
    - walterbell 2y ago
      Interesting, https://www.theverge.com/2022/12/7/23498236/telegram-fragment-phone-number-crypto-verification-monetization https://www.theverge.com/2022/12/7/23498236/telegram-fragmen... > To get an anonymous number, you need to go purchase one through the Fragment blockchain... Durov calls Fragment “an amazing success” that already generated over $50 million in sales in less than a month.
- codedokode 2y ago
  Aren't open source apps like Jabber or Element which do not require a phone number and allow to host your own server, a much better playground?
  - zaik 2y ago
    Yes, and XMPP over Tor already seems to be popular on the dark web.
    - bydlocoder 2y ago
roomey 2y ago
Here's the thing, all the politicians use WhatsApp. They actually don't want that backdoored, guaranteed.
- perihelions 2y ago
  EU politicians did (try to) explicitly exempt themselves from their own chat surveillance laws, https://news.ycombinator.com/item?id=40063025 https://news.ycombinator.com/item?id=40063025 ("ChatControl: EU ministers want to exempt themselves (european-pirateparty.eu)", 202 comments)
  - wkat4242 2y ago
    That makes sense though. We all know all politicians are saints and would never fall prey to corruption or criminal interests. /s
    - ben_w 2y ago
      /s aside, politicians need privacy for the same reason the rest of us do: they work with sensitive information and it's really important they don't get blackmailed. Simultaneously, they need a light shone on their private lives for the same reason they want to do that to the rest of us: to make sure they're not abusing their access to sensitive information, getting blackmailed, or otherwise being nefarious. I have absolutely no idea how to fix this apparent paradox. Perhaps it can't be done. Even if it can, tech is unstable and this is all a moving target — the way GenAI is going, I suspect that we'll all have to carry always-on cameras that log and sign everything just to prove we didn't do whatever some picture or video shows us doing.
      - wkat4242 2y ago
        > I suspect that we'll all have to carry always-on cameras that log and sign everything just to prove we didn't do whatever some picture or video shows us doing. Yeah good luck with that :') PS: A change to "guilty until proven innocent" policy would require a serious constitutional change in most countries.
wkat4242 2y ago
Except Telegram has much less E2EE than Signal or Whatsapp. It's not on by default, works only between 2 devices, they both have to be online at the same time and you can't access anything from the web. And group chats don't support it at all. Private chats are not end to end encrypted by default and it's actually quite clumsy to encrypt them so almost nobody uses it. It's really weird that Telegram is singled out like this.
- klntsky 2y ago
  It's because it is in fact used for this, unlike say whatsapp that does not enjoy any trust.
- stefan_ 2y ago
  If you don't cooperate while having the data and your approach to legal compliance is "votes on your personal TG channel", expect to get arrested. At least the services with actual E2EE worth a shit can make a convincing argument they can't produce the data.
- A4ET8a8uTh0 2y ago
  That was my first thought as well. There are good uses for telegram and some things work better than signal ( API comes to mind ). But just from privacy perspective, telegram is much more easily neutered than signal. I will admit I am confused. I can only assume something else is at play. edit: The only thing I can think of is that there some rather gruesome channels showing Russia/Ukraine, Palestine/Israel toll. I wonder if it was decided that general population should not have access to these.
- sangnoir 2y ago
  I can't tell if it's just uninformed grassroots mistrust of big tech, or the result of astroturf PsyOps to get more people to use the app with weaker encryption.
  - kome 2y ago
    Encryption is really not the main issue here. I think nerds may not fully grasp Telegram's security model: it's essentially stateless, not tied to any particular country. Its infrastructure is distributed across various jurisdictions, with no official representation in many countries—no subsidiaries, nothing. As a result, it doesn't respond to authorities because it doesn't have to. However, this approach is unsustainable and unacceptable for many governments, both in the East and the West. That's why he's being accused in France: he is not "cooperating with law enforcement".
heraldgeezer 2y ago
But they recommend Signal themselves... https://www.politico.eu/article/eu-commission-to-staff-switch-to-signal-messaging-app/ https://www.politico.eu/article/eu-commission-to-staff-switc... >The European Commission has told its staff to start using Signal, an end-to-end-encrypted messaging app, in a push to increase the security of its communications. Also Telegram is not E2E by default. You need to activate it per chat. By default and in groups it is only server encrypted.
deleted 2y ago
[deleted]

by chad1n 2y ago

EduardoBautista 2y ago

Are they going to arrest Zuckerberg and Tim Cook next for the encryption in WhatsApp and iMessage?

deleted 2y ago
[deleted]
crote 2y ago
What makes you believe those do not have backdoors for Western powers?
verisimi 2y ago
Perhaps they already have backdoors, but don't tell everyone.
rubymamis 2y ago
Maybe not, if they already got backdoors?
- sangnoir 2y ago
  If Apple hypothetically agreed to iMessage backdoors, why would you trust the Telegram app updates served up by Apple's app store? Western government's can pretty much hack into any device they want - the only reason for backdooring messaging apps would be for dragnet surveillance, and I don't see big tech having the appetite for the bad publicity and lawsuits that will result when that inevitably becomes public
  - codedokode 2y ago
    Apple already has a kind of "backdoor": they store the keys for encrypted cloud backups in their cloud as well. They advertise that cloud data are encrypted but prefer not to mention that they also have a key to decrypt it. Even with the highest level of security [1] your contacts list in Apple Cloud are not encrypted. Why? Probably someone asked for this. [1] https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651
    - EduardoBautista 2y ago
      No, it’s because the CardDAV standard was not created with encryption in mind. It’s also why calendar and mail are not encrypted in iCloud.
      - codedokode 2y ago
        CSV or PNG weren't created with encryption in mind, but one can easily encrypt them. Apple can always make their own proprietary protocol. This doesn't explain anything. However the version that the govt wants to be able to see who is in person't contact list explains it well.
        dijit 2y ago
        If Apple did that, people like me would accuse them of EEE. We don’t trust proprietary stuff because we’ve been burned by it, if there’s an open standard, even a worse one: use it. If it’s really that bad, we need to improve the standard.
        codedokode 2y ago
        As I understand, this protocol is used between an iPhone and iCloud and it being open or not doesn't change anything because there is no alternative iCloud or iPhone.
        2y ago
zerodensity 2y ago
I mean I wouldn't complain if they did.
codedokode 2y ago
They are US citizens, nobody dares to arrest them (except for Russia and North Korea).
talldayo 2y ago
No, because then they'd have to acknowledge that WhatsApp and iMessage are both compromised.

vizzah 2y ago

Private chats are a hassle to initiate and not multi-device. Most use normal chats. With anonymous accounts, using anonymous +888 numbers, whose price has increased from $16 to $1000+ in a matter of a year, it is indeed a very convenient playground for all sorts of activities.

walterbell 2y ago
In which countries are the vendors of anonymous numbers located?
- vizzah 2y ago
  There are no vendors, Telegram issues those numbers. So it's basically a pass to create account w/o mobile number requirement, if you're ready to pay for it.
  - walterbell 2y ago
    Interesting, https://www.theverge.com/2022/12/7/23498236/telegram-fragment-phone-number-crypto-verification-monetization https://www.theverge.com/2022/12/7/23498236/telegram-fragmen... > To get an anonymous number, you need to go purchase one through the Fragment blockchain... Durov calls Fragment “an amazing success” that already generated over $50 million in sales in less than a month.
codedokode 2y ago
Aren't open source apps like Jabber or Element which do not require a phone number and allow to host your own server, a much better playground?
- zaik 2y ago
  Yes, and XMPP over Tor already seems to be popular on the dark web.
  - bydlocoder 2y ago

roomey 2y ago

Here's the thing, all the politicians use WhatsApp. They actually don't want that backdoored, guaranteed.

perihelions 2y ago
EU politicians did (try to) explicitly exempt themselves from their own chat surveillance laws, https://news.ycombinator.com/item?id=40063025 https://news.ycombinator.com/item?id=40063025 ("ChatControl: EU ministers want to exempt themselves (european-pirateparty.eu)", 202 comments)
- wkat4242 2y ago
  That makes sense though. We all know all politicians are saints and would never fall prey to corruption or criminal interests. /s
  - ben_w 2y ago
    /s aside, politicians need privacy for the same reason the rest of us do: they work with sensitive information and it's really important they don't get blackmailed. Simultaneously, they need a light shone on their private lives for the same reason they want to do that to the rest of us: to make sure they're not abusing their access to sensitive information, getting blackmailed, or otherwise being nefarious. I have absolutely no idea how to fix this apparent paradox. Perhaps it can't be done. Even if it can, tech is unstable and this is all a moving target — the way GenAI is going, I suspect that we'll all have to carry always-on cameras that log and sign everything just to prove we didn't do whatever some picture or video shows us doing.
    - wkat4242 2y ago
      > I suspect that we'll all have to carry always-on cameras that log and sign everything just to prove we didn't do whatever some picture or video shows us doing. Yeah good luck with that :') PS: A change to "guilty until proven innocent" policy would require a serious constitutional change in most countries.

wkat4242 2y ago

Except Telegram has much less E2EE than Signal or Whatsapp. It's not on by default, works only between 2 devices, they both have to be online at the same time and you can't access anything from the web. And group chats don't support it at all. Private chats are not end to end encrypted by default and it's actually quite clumsy to encrypt them so almost nobody uses it. It's really weird that Telegram is singled out like this.

klntsky 2y ago
It's because it is in fact used for this, unlike say whatsapp that does not enjoy any trust.
stefan_ 2y ago
If you don't cooperate while having the data and your approach to legal compliance is "votes on your personal TG channel", expect to get arrested. At least the services with actual E2EE worth a shit can make a convincing argument they can't produce the data.
A4ET8a8uTh0 2y ago
That was my first thought as well. There are good uses for telegram and some things work better than signal ( API comes to mind ). But just from privacy perspective, telegram is much more easily neutered than signal. I will admit I am confused. I can only assume something else is at play. edit: The only thing I can think of is that there some rather gruesome channels showing Russia/Ukraine, Palestine/Israel toll. I wonder if it was decided that general population should not have access to these.
sangnoir 2y ago
I can't tell if it's just uninformed grassroots mistrust of big tech, or the result of astroturf PsyOps to get more people to use the app with weaker encryption.
- kome 2y ago
  Encryption is really not the main issue here. I think nerds may not fully grasp Telegram's security model: it's essentially stateless, not tied to any particular country. Its infrastructure is distributed across various jurisdictions, with no official representation in many countries—no subsidiaries, nothing. As a result, it doesn't respond to authorities because it doesn't have to. However, this approach is unsustainable and unacceptable for many governments, both in the East and the West. That's why he's being accused in France: he is not "cooperating with law enforcement".

heraldgeezer 2y ago

But they recommend Signal themselves... https://www.politico.eu/article/eu-commission-to-staff-switch-to-signal-messaging-app/ https://www.politico.eu/article/eu-commission-to-staff-switc... >The European Commission has told its staff to start using Signal, an end-to-end-encrypted messaging app, in a push to increase the security of its communications. Also Telegram is not E2E by default. You need to activate it per chat. By default and in groups it is only server encrypted.

deleted 2y ago

[deleted]