8 ms·

Well of course, but this is a feature of Telegram. It's the only messaging app where messages are stored on the cloud. This of course has security implications,

• pandog 2y ago
  I think a high definition photo taken on a recent phone takes up an awful lot more device memory than a "big number of chats"
  • SonOfLilit 2y ago
    Yeah, but Whatsapp chats tend to be full of those... and videos.
    • akx 2y ago
      (On Android), if you don't care about the (old) WhatsApp media, just delete it from your phone. It's all just loose files in `/storage/android/data/com.whatsapp` (or thereabouts). The text content of the chats will remain available.
    • lukan 2y ago
      Whatsapp automatically resizes them (in standard settings) But it still gets big.
• hn_throwaway_99 2y ago
  But that's literally the entire point of this article. That is, in this day and age, when people talk about "secure messaging apps" they are usually implying end-to-end encryption, which Telegram most certainly is not for the vast majority of usages.
  • KennyBlanken 2y ago
    Also, iMessage is very secure...but then all your stuff is backed up on iCloud servers unless you specifically disable it. That includes all your iCloud encryption keys and plaintext messages. Worse, iPhones immediately start backing up to iCloud when set up for a new user - the only way to keep your network passwords and all manner of other stuff from hitting iCloud servers is to set the phone up with no network connection or even a SIM card installed. Did I mention there's no longer a SIM slot, so you can't even control that? And that iPhones by default if they detect a 'weak' wifi network will switch to cellular, so you can't connect the phone to a sandboxed wifi network? You shouldn't have to put your phone in a faraday cage to keep it from uploading plaintext versions of your private communications and network passwords.
    • xattt 2y ago
      Luckily, microwave ovens make easy Faraday cages.
      • talldayo 2y ago
        15 seconds on low, then 120 seconds on high. Oh, you meant... oh.
    • jofla_net 2y ago
      Well summed-up. Its crazy how efficient theese things are at working together to strip users of any agency or control, across many different domains.
    • walterbell 2y ago
      iCLoud can be disabled by MDM profile installed by Apple Configurator at setup.
      • codetrotter 2y ago
        Can I enroll my personal iPhone in MDM myself? And if I can have MDM with just my personal phone, do I need to buy some kind of subscription for it from Apple? Or pay some third-party? I thought MDM was only for enterprise businesses and schools and universities, but I may very well be mistaken about that.
• 3np 2y ago
  > It's the only messaging app where messages are stored on the cloud. Instagram. FB Messenger. Skype. LINE. KakaoTalk. Discord. Slack. Teams. iMessage.
  • out_of_protocol 2y ago
    Google talk/Hangouts/Google Chat/Duo/Allo/Meet/another Meet/etc. Counts as one
• Dalewyn 2y ago
  >It's the only messaging app where messages are stored on the cloud. So do all the others with the exception of something like IRC.
  • wkat4242 2y ago
    Not really. WhatsApp only keep them temporarily (and E2EE!) until they're delivered to each device. Signal too. Telegram keeps everything for all time. Which is kinda handy too I have to say. Of course you can send your backup to Google for WhatsApp and signal but that's optional. You can keep it locally too. And it's encrypted too. With WhatsApp you can even choose to keep the key locally only.
    • ASalazarMX 2y ago
      WhatsApp? The closed source app that AFAIK has never been externally audited, owned by one of the most privacy-disrespecting corporations in the world? You say I can trust it wholeheartedly as long as I don't upload backups to the cloud?
      • LtWorf 2y ago
        I 100% trust they implement the signal protocol as they claim. I am also similarly sure that they ALSO have a sidechannel for everything.
      • r00fus 2y ago
        The founder departing Meta on very bad terms is quite a signal to me: https://www.forbes.com/sites/parmyolson/2018/09/26/exclusive-whatsapp-cofounder-brian-acton-gives-the-inside-story-on-deletefacebook-and-why-he-left-850-million-behind/ https://www.forbes.com/sites/parmyolson/2018/09/26/exclusive...
• lolinder 2y ago
  > It's the only messaging app where messages are stored on the cloud. Besides Slack and Discord and Teams and whatever the heck Google has these days and iMessage and... I think you mean it's the only messaging app that purports to have a focus on security where messages are stored in the cloud, which is true, but also sus. There's a reason why none of the others are doing it that way, and Telegram isn't really claiming to have solved a technical hurdle that the E2E apps didn't, it's just claiming that you can trust them more than you can trust the major messaging apps. Maybe you can and maybe you can't, the point is that you can't know that they're actually a safer choice than any of the other cloud providers.
  • maqp 2y ago
    >it's just claiming that you can trust them more than you can trust the major messaging apps. All the cool kids in the block eliminated the need to trust the provider decades ago. PGP: 33 years ago, OTR 20 years ago, Signal 14 years ago.
    • dijit 2y ago
      You have to trust the provider with signal; they are fiercely anti-third party clients, control the network and have released version of the code that are not tracked by sources- in extreme cases we’re aware of years old code being in there (mobile coin for example). Signal evangelicalism needs to halt, you mean the Whisper protocol.
      • maqp 2y ago
        No serious project wants to collaborate with a bunch of hobbyist projects who may or may not keep their code up-to-date. Years ago, the Matrix ecosystem was a prime example of even basic features like end-to-end encryption being in many cases missing. Having a single client gives you insane boost to security agility over decentralized alternatives. Feel free to strive towards functional decentralized ecosystem that feels as good to use, then switching will be a no-brainer.
      • A4ET8a8uTh0 2y ago
• maqp 2y ago
  This is such a misrepresentation. Telegram could at-will feed the cloud-2FA password to password hashing function like Argon2 to derive a client-side encryption key. Everything could be backed up to the cloud in encrypted state only you can access. Do they do that? No. So it's not as much as trade-off, as it is half-assed security design.
  • thisisabore 2y ago
    I'll have you know they had maths PhDs design their security, sir. Eight of them! Yeah, it's a bit of a joke.
    • maqp 2y ago
      Yeah, put a geometrician* to do the job of a cryptographer. This is what you get. * I'm being serious, Nikolai Durov's PhD dissertation title was "New Approach to Arakelov Geometry" https://bonndoc.ulb.uni-bonn.de/xmlui/handle/20.500.11811/3110 https://bonndoc.ulb.uni-bonn.de/xmlui/handle/20.500.11811/31... https://arxiv.org/pdf/0704.2030 https://arxiv.org/pdf/0704.2030
      • codedokode 2y ago
        Advanced math is actually more difficult (in my opinion) than programming languages.
        • joshuamorton 2y ago
          Sure, but cryptography is its own subfield of advanced math (and also a bunch of more CS and UX based implementation challenges like avoiding side channels).
        • maqp 2y ago
          Cryptography is nightmare magic math that cares about the color of the pencil you write it with. It's not enough you know how to design a cipher that is actually secure, you need to know how to implement it so that the calculator you run it on consumes exactly the right amount of time, and in some cases power, per operation. Then you need to know how to use the primitives together, their modes of operation, and then you get to business, designing protocols. And 10% of your code is calling the libraries that handle all that stuff above, 90% is key management. There's a good amount of misuse resistant libraries available, but Nikolai was too proud to not look into how the experts do this, and he failed even with trivial stuff: He went with SHA-1 instead of SHA-256. He didn't implement proper fingerprints. His protocol wasn't IND-CCA secure. He went with weird AES-IGE instead of AES-GCM which is best practice. He used the weird nonces with the FF-DH, instead of going with more robust stuff like x25519. One thing you learn early in academia, is that expertise is very narrow. I bet he knows a lot about geometry. Maybe even quite a bit about math in general. But it's clear he doesn't know enough to design cryptographic protocols. The cobbler should have stuck to his last. EDIT, to add, the real work with cryptographic protocols starts with designing everyday things that seem easy on the paper, with cryptographic assurance. Take group management that the server isn't controlling. For Telegram it's a few boolean flags for admin status and then it's down to writing the code that removes the user from the group and prevents them from fetching group's messages. For Signal it's a 58 page whitepaper on the design of how that is done properly https://eprint.iacr.org/2019/1416.pdf https://eprint.iacr.org/2019/1416.pdf This is ultimately what separates the good from the bad, figuring out how to accomplish things with cryptography that first seem almost impossible to do.
• avery17 2y ago
  You never know what may suddenly become illegal.
• vehementi 2y ago
  > It's the only messaging app where messages are stored on the cloud Unreal. Please share how you came to this world view.
  • inquirerGeneral 2y ago
    [dead]
• tcfhgj 2y ago
  > Well of course, but this is a feature of Telegram. It's the only messaging app where messages are stored on the cloud. Wrong, Matrix does it too, but fully e2ee. > and allows you to access your chats from any device. No it doesn't, because it is possible withh e2ee as well