3 ms·

> Telegram encryption is off by default This is false. Telegram's non-secret chats use MTProto 2.0 Cloud. "Encryption is off by default" is a false claim. 1.

> Telegram encryption is off by default This is false. Telegram's non-secret chats use MTProto 2.0 Cloud. "Encryption is off by default" is a false claim. 1. https://telegram.org/faq#q-do-you-process-data-requests https://telegram.org/faq#q-do-you-process-data-requests 2. https://core.telegram.org/mtproto/description https://core.telegram.org/mtproto/description

sanbor 2y ago
Using https would already mean encryption is not off by default. There are so many layers that can be encrypted. But at the end data is stored somewhere, and the keys must be available to the infrastructure to decrypt and serve the content. Maybe the parent content meant E2E is off by default, which is what your first link states: > Secret chats use end-to-end encryption, thanks to which we don't have any data to disclose. Then the next paragraphs elaborate about the non-E2E encryption, and how would it be harder —- while not impossible —- to disclose data. From the same link you shared: > Thanks to this structure, we can ensure that no single government or block of like-minded countries can intrude on people's privacy and freedom of expression. Telegram can be forced to give up data only if an issue is grave and universal enough to pass the scrutiny of several different legal systems around the world. Maybe getting the CEO of the company arrested is what it gets to disclose that data they want. After all he controls infrastructure and deployments. Meanwhile, unlike Telegram, everything in Signal is E2E by default[1]. 1: https://signal.org/bigbrother/santa-clara-county/ https://signal.org/bigbrother/santa-clara-county/
Stagnant 2y ago
Well, they are "encrypted", but not end-to-end encrypted. Encryption does not really mean much if someone else has the keys. So it is reasonable to treat non-secret chat messages as if they were unencrypted.
maqp 2y ago
Encryption between you and the service provider isn't encryption protecting you from the service provider. No end-to-end encryption means no encryption for messaging. The only context where client-server encryption matters is when I want secure e-commerce, or to shield from my ISP what searches I make or what I do on sites.

sanbor 2y ago

Using https would already mean encryption is not off by default. There are so many layers that can be encrypted. But at the end data is stored somewhere, and the keys must be available to the infrastructure to decrypt and serve the content. Maybe the parent content meant E2E is off by default, which is what your first link states: > Secret chats use end-to-end encryption, thanks to which we don't have any data to disclose. Then the next paragraphs elaborate about the non-E2E encryption, and how would it be harder —- while not impossible —- to disclose data. From the same link you shared: > Thanks to this structure, we can ensure that no single government or block of like-minded countries can intrude on people's privacy and freedom of expression. Telegram can be forced to give up data only if an issue is grave and universal enough to pass the scrutiny of several different legal systems around the world. Maybe getting the CEO of the company arrested is what it gets to disclose that data they want. After all he controls infrastructure and deployments. Meanwhile, unlike Telegram, everything in Signal is E2E by default[1]. 1: https://signal.org/bigbrother/santa-clara-county/ https://signal.org/bigbrother/santa-clara-county/

Stagnant 2y ago

Well, they are "encrypted", but not end-to-end encrypted. Encryption does not really mean much if someone else has the keys. So it is reasonable to treat non-secret chat messages as if they were unencrypted.

maqp 2y ago

Encryption between you and the service provider isn't encryption protecting you from the service provider. No end-to-end encryption means no encryption for messaging. The only context where client-server encryption matters is when I want secure e-commerce, or to shield from my ISP what searches I make or what I do on sites.