4 ms·

Only the secret chat is e2e encrypted. All the other chat options are not. I think calls are also not encrypted since they appear in the normal chat history not

Only the secret chat is e2e encrypted. All the other chat options are not. I think calls are also not encrypted since they appear in the normal chat history not in the e2e chat. Obviously if your phone is compromised your e2ee chat is not safe.

jeroenhd 2y ago
Calls seem tm be e2e encrypted: https://core.telegram.org/api/end-to-end/video-calls https://core.telegram.org/api/end-to-end/video-calls No idea how secure the encryption is, but calling someone on Telegram is safer than sending texts.
- lxgr 2y ago
  Depends on who your adversary is and how much you trust their protocol (some weird homegrown thing with clever/questionable cryptographic choices, the last time I checked) and implementation. Your texts don't generally run through Telegram's infrastructure, for example.
- aquatica 2y ago
  Only 1-1 calls are encrypted, voice chats (group calls) are not
- maqp 2y ago
  Too bad I can't send a secure text from my Telegram desktop client. Lucky for me, there's Signal.
tamimio 2y ago
> Obviously if your phone is compromised your e2ee chat is not safe. Pretty much, a lot of people think that seeing E2EE means everything is safe, which I believe gives a false sense of security. You can have your phone compromised (especially when I know your phone number, Signal I’m looking at you) or be subject to other means of attacks, exposing everything. I would rather know that this app is not secure so I don’t share anything important, while keeping secure communication to other means.
- qskousen 2y ago
  Stealing someone's phone number wouldn't give you any Signal data, as all the messages have perfect forward secrecy, though, right? And all contacts would see an alert that your security number had changed. Not completely foolproof, and I would like Signal to use something other than phone numbers for accounts, but it's pretty good.
  - tamimio 2y ago
    Knowing someone's phone number is enough to potentially compromise it. Sophisticated methods can involve zero-click attacks, where just sending you an SMS that you won’t even see can lead to a compromised device. You can check how Tucker got his Signal conversation exposed. Matrix is far better in terms of security than Signal, but Matrix is far behind compared to Telegram features.
    - qskousen 2y ago
      That's a good point. I looked into using Matrix before I switched to Signal, but the user experience just in creating an account was pretty abysmal, at least at the time. As I was recommending it to non-tech people, I ended up going with Signal.
      - tamimio 2y ago
        > but the user experience just in creating an account was pretty abysmal I agree it was, probably better now, but for the average person, it’s too much to “process” compared to just adding your phone number and signing up.
    - maqp 2y ago
      You seem to be living on this weird balance of having no threat model. This is what your post implies 1. Signal is bad and insecure because registering user account requires giving a phone number. 2. Matrix is better, it fixes this by registering with emails (although emails also have zero click vulnerabilities) 3. Telegram is better than Matrix, it's more usable (even though it also requires a phone number like Signal) So pick a lane, is requiring a phone-number a litmus-test for you or not. Is zero-click vulnerability something that needs to be addressed? How do you deal with malicious contacts or people in public groups sending zero-click links?
NayamAmarshe 2y ago
> Obviously if your phone is compromised your e2ee chat is not safe. Yes, and that's where the 'practical' argument pops up. With all the E2EE buzz, is it really helping in the scenarios where it's supposed to work the best? This thread gives an overview on why Signal and other apps are not really practical: https://x.com/Pinboard/status/1474096410383421452 https://x.com/Pinboard/status/1474096410383421452 > The broader problem of ephemeral or spur of the moment protest activity leaving a permanent data trail that can be forensically analyzed and target individuals many years after the fact is unsolved and poses a serious risk to dissent. But E2E is not the solution to it. > I feel like Moxie and a lot of end-to-end encryption purists fall into the same intellectual tarpit as the cryptocurrency people, which is that it should be possible to design technical systems that require zero trust, and that the benefits of these designs are self-evident
johnisgood 2y ago
Does Telegram support E2E on anything other than Android and iOS? Last time I checked it was not available for desktop.

jeroenhd 2y ago

Calls seem tm be e2e encrypted: https://core.telegram.org/api/end-to-end/video-calls https://core.telegram.org/api/end-to-end/video-calls No idea how secure the encryption is, but calling someone on Telegram is safer than sending texts.

lxgr 2y ago
Depends on who your adversary is and how much you trust their protocol (some weird homegrown thing with clever/questionable cryptographic choices, the last time I checked) and implementation. Your texts don't generally run through Telegram's infrastructure, for example.
aquatica 2y ago
Only 1-1 calls are encrypted, voice chats (group calls) are not
maqp 2y ago
Too bad I can't send a secure text from my Telegram desktop client. Lucky for me, there's Signal.

tamimio 2y ago

> Obviously if your phone is compromised your e2ee chat is not safe. Pretty much, a lot of people think that seeing E2EE means everything is safe, which I believe gives a false sense of security. You can have your phone compromised (especially when I know your phone number, Signal I’m looking at you) or be subject to other means of attacks, exposing everything. I would rather know that this app is not secure so I don’t share anything important, while keeping secure communication to other means.

qskousen 2y ago
Stealing someone's phone number wouldn't give you any Signal data, as all the messages have perfect forward secrecy, though, right? And all contacts would see an alert that your security number had changed. Not completely foolproof, and I would like Signal to use something other than phone numbers for accounts, but it's pretty good.
- tamimio 2y ago
  Knowing someone's phone number is enough to potentially compromise it. Sophisticated methods can involve zero-click attacks, where just sending you an SMS that you won’t even see can lead to a compromised device. You can check how Tucker got his Signal conversation exposed. Matrix is far better in terms of security than Signal, but Matrix is far behind compared to Telegram features.
  - qskousen 2y ago
    That's a good point. I looked into using Matrix before I switched to Signal, but the user experience just in creating an account was pretty abysmal, at least at the time. As I was recommending it to non-tech people, I ended up going with Signal.
    - tamimio 2y ago
      > but the user experience just in creating an account was pretty abysmal I agree it was, probably better now, but for the average person, it’s too much to “process” compared to just adding your phone number and signing up.
  - maqp 2y ago
    You seem to be living on this weird balance of having no threat model. This is what your post implies 1. Signal is bad and insecure because registering user account requires giving a phone number. 2. Matrix is better, it fixes this by registering with emails (although emails also have zero click vulnerabilities) 3. Telegram is better than Matrix, it's more usable (even though it also requires a phone number like Signal) So pick a lane, is requiring a phone-number a litmus-test for you or not. Is zero-click vulnerability something that needs to be addressed? How do you deal with malicious contacts or people in public groups sending zero-click links?

NayamAmarshe 2y ago

> Obviously if your phone is compromised your e2ee chat is not safe. Yes, and that's where the 'practical' argument pops up. With all the E2EE buzz, is it really helping in the scenarios where it's supposed to work the best? This thread gives an overview on why Signal and other apps are not really practical: https://x.com/Pinboard/status/1474096410383421452 https://x.com/Pinboard/status/1474096410383421452 > The broader problem of ephemeral or spur of the moment protest activity leaving a permanent data trail that can be forensically analyzed and target individuals many years after the fact is unsolved and poses a serious risk to dissent. But E2E is not the solution to it. > I feel like Moxie and a lot of end-to-end encryption purists fall into the same intellectual tarpit as the cryptocurrency people, which is that it should be possible to design technical systems that require zero trust, and that the benefits of these designs are self-evident

johnisgood 2y ago

Does Telegram support E2E on anything other than Android and iOS? Last time I checked it was not available for desktop.