6 ms·

I sort of assumed that a messaging app based in Russia should probably not be used unless you were okay with Russia reading your messages, which is currently co

I sort of assumed that a messaging app based in Russia should probably not be used unless you were okay with Russia reading your messages, which is currently considered an enemy state in most western countries. It totally shocks me that so many pro Ukrainian influencers use Telegram. I feel that this is a pretty good summary of what's going on: https://youtu.be/39rBzRd4M0k https://youtu.be/39rBzRd4M0k and explains how the encryption works etc.

konart 2y ago
Telegram is not based in Russia.
- hughesjj 2y ago
  To be fair it's not really based anywhere. The legal headquarters are in the Virgin Islands and the ops HQ is now in Dubai. Saying telegram is based in Russia is like saying the pirate bay is based in Sweden. Used to be true, but not so much anymore. Regardless, I think it's totally reasonable to be concerned about having shared symmetric cryptography keys stored on servers in Russia while claiming your app is 'secure'/end to end encrypted (not sure if they're claiming the latter anymore or if that was even official claims to begin with vs internet BS), and is especially relevant for Ukranians or Russians politically opposed to Putin.
  - throwaway48540 2y ago
    Don't use non-secure chats for your communication, then. Telegram is not just a chat app, it's also used somewhat like Facebook. Are you concerned that Facebook can see posts and comments? Facebook can also see your chats, there is no option to E2E encrypt them, unlike Telegram.
    - _djo_ 2y ago
      Meta added end-to-end encryption to Messenger some time ago. [0] [0] https://www.facebook.com/help/messenger-app/1084673321594605 https://www.facebook.com/help/messenger-app/1084673321594605
honestjohn 2y ago
This is a good instinct. Even if you're using a good E2EE messaging app like Signal, you still trust them not to mitm unless you check the other person's public key out-of-band. I suspect most people don't do that. Also, there are issues with Telegram's E2EE mode, besides it being disabled by default. More than enough reason not to use it.
- bsaul 2y ago
  i suspect this particular security hole in the signal protocol is the single reason why whatsapp hasn't been banned yet. They can eavedrop by simply adding a device to a conversation and nobody will notice. Your device will gladly send them decryption keys and provide them with a copy of the message nicely.
  - honestjohn 2y ago
    I'm not sure if they can add a participant to an existing conversation, and if they did, your client would at least know. Also don't remember if the client will send message history, but I think Signal doesn't. The simple bad scenario I have in mind is when you're initiating a new chat and the mitm it from the start. Or they could do it halfway through, which would notify you that the other end's key changed, but that message is non-threatening enough and happens enough for random other reasons that most people would probably ignore it.
    - bsaul 2y ago
      not a participant. Whatsapp is multi device ( a single user can have multiple devices, such as a web client, an iphone and a mac app). They can simply register another device as belonging to one of the participant, and everything should be forwarded to them, invisibly.
      - honestjohn 2y ago
        Multi-device mode is new enough that I might be wrong about this, but afaik the web client still needs to get the priv key from your phone, so they can't authorize a new client unilaterally. Or it'd be a really silly hole if they could. Edit: Meant to say, the web client needs to somehow be authorized by the phone, not that it takes the privkey exactly. Probably gets a new key that the phone stores, so the phone is still the "master" device. I wouldn't expect the phone client to happily send the chat history to a new device it didn't authorize locally.
Maken 2y ago
Telegram is not a Russian controlled app. Durov had to flee from Russia after the Crimea invasion because he refused to mass spy on dissidens. If anything he has a good track of not cooperating with Putin.
- AnimalMuppet 2y ago
  He's almost certainly better off getting arrested in France than he would have been getting arrested in Russia.
  - steideler 2y ago
    [flagged]
- throwaway74354 2y ago
  That's a nice cover story, but Telegram had operated for years from the same Singer House in Saint Petersburg where VK headquarters are situated. Russian Direct Investment Fund had invested in Telegram. Nikolai Durov works at Russian Academy of Sciences. As of 2024, Russia-the-state has no problems with either Pavel Durov or Telegram. That's suspicious to say the least.
  - petre 2y ago
    > As of 2024, Russia-the-state has no problems with either Pavel Durov or Telegram They only tried to ban it in 2018 and gave up in 2020 after failing to do so without cutting off access to other Internet services. The last time they blocked access to it was quite recently, on 21 August, after the Ukrainian incursion into Kursk oblast. https://understandingwar.org/backgrounder/russian-offensive-campaign-assessment-august-21-2024-0 https://understandingwar.org/backgrounder/russian-offensive-...
  - 331c8c71 2y ago
    > from the same Singer House in Saint Petersburg where VK headquarters are situated. And so? Durov happens to be the founder of VK...
GauntletWizard 2y ago
If I were a pro-Ukraninian influencer, I'd want Russia to be reading a bunch of my messages. Probably not my private ones, but using the enemy's platform to distribute propaganda is a veritable goldmine.
- steideler 2y ago
  [flagged]
selectodude 2y ago
Not that it’s a whole lot better than Russia, but I’m pretty sure it’s based in Dubai.
- negus 2y ago
  And what would be better? France?
golergka 2y ago
> unless you were okay with Russia reading your messages This is not an empty accusation, there's been several stories which could not be explained by anything else than FSB having access to Telegram. That said, however, it's only FSB. There hasn't been a single suspicious act like that on behalf of Russian police, so we can assume that this access is only used in exceptional cases. So, unless you believe that Russian intelligence is targeting you personally, you're safe.
- diggan 2y ago
  > there's been several stories which could not be explained by anything else than FSB having access to Telegram Could you share which "100% confirmed" stories this is about? Haven't really come across that before
- kgeist 2y ago
  >there's been several stories which could not be explained by anything else than FSB having access to Telegram If your device is compromised, all bets are off. Example: FSB once leaked Navalny's emails. He used gmail. And no one suspects Google of conspiring with FSB.
novakboskov 2y ago
"Tribunal Judiciaire de Paris", the court, has published the charges: https://www.tribunal-de-paris.justice.fr/sites/default/files/2024-08/2024-08-26%20-%20CP%20TELEGRAM%20.pdf https://www.tribunal-de-paris.justice.fr/sites/default/files.... It's a two-pager primary source. Maybe check that before the video.
diggan 2y ago
> I feel that this is a pretty good summary of what's going on: https://youtu.be/39rBzRd4M0k https://youtu.be/39rBzRd4M0k and explains how the encryption works etc. What makes you feel that? Never seen that channel before, and the self-description of "High-intensity code tutorials and tech news to help you ship your app faster" doesn't really inspire much confidence when it comes to talking about more nuanced topics. For example, Telegram isn't based in Russia, and I don't think it ever was. So if that's one of the takeaways from that video, it seems pretty misinformed even about the basics.
paxys 2y ago
> It totally shocks me that so many pro Ukrainian influencers use Telegram. They are using Telegram for PR, same as Twitter or Instagram. It doesn't matter if the posts get decrypted by Russia – they are anyways meant to be public.
deleted 2y ago
[deleted]
kome 2y ago
Wow, hold on there, cold warrior.
- steideler 2y ago
  [flagged]

konart 2y ago

Telegram is not based in Russia.

hughesjj 2y ago
To be fair it's not really based anywhere. The legal headquarters are in the Virgin Islands and the ops HQ is now in Dubai. Saying telegram is based in Russia is like saying the pirate bay is based in Sweden. Used to be true, but not so much anymore. Regardless, I think it's totally reasonable to be concerned about having shared symmetric cryptography keys stored on servers in Russia while claiming your app is 'secure'/end to end encrypted (not sure if they're claiming the latter anymore or if that was even official claims to begin with vs internet BS), and is especially relevant for Ukranians or Russians politically opposed to Putin.
- throwaway48540 2y ago
  Don't use non-secure chats for your communication, then. Telegram is not just a chat app, it's also used somewhat like Facebook. Are you concerned that Facebook can see posts and comments? Facebook can also see your chats, there is no option to E2E encrypt them, unlike Telegram.
  - _djo_ 2y ago
    Meta added end-to-end encryption to Messenger some time ago. [0] [0] https://www.facebook.com/help/messenger-app/1084673321594605 https://www.facebook.com/help/messenger-app/1084673321594605

honestjohn 2y ago

This is a good instinct. Even if you're using a good E2EE messaging app like Signal, you still trust them not to mitm unless you check the other person's public key out-of-band. I suspect most people don't do that. Also, there are issues with Telegram's E2EE mode, besides it being disabled by default. More than enough reason not to use it.

bsaul 2y ago
i suspect this particular security hole in the signal protocol is the single reason why whatsapp hasn't been banned yet. They can eavedrop by simply adding a device to a conversation and nobody will notice. Your device will gladly send them decryption keys and provide them with a copy of the message nicely.
- honestjohn 2y ago
  I'm not sure if they can add a participant to an existing conversation, and if they did, your client would at least know. Also don't remember if the client will send message history, but I think Signal doesn't. The simple bad scenario I have in mind is when you're initiating a new chat and the mitm it from the start. Or they could do it halfway through, which would notify you that the other end's key changed, but that message is non-threatening enough and happens enough for random other reasons that most people would probably ignore it.
  - bsaul 2y ago
    not a participant. Whatsapp is multi device ( a single user can have multiple devices, such as a web client, an iphone and a mac app). They can simply register another device as belonging to one of the participant, and everything should be forwarded to them, invisibly.
    - honestjohn 2y ago
      Multi-device mode is new enough that I might be wrong about this, but afaik the web client still needs to get the priv key from your phone, so they can't authorize a new client unilaterally. Or it'd be a really silly hole if they could. Edit: Meant to say, the web client needs to somehow be authorized by the phone, not that it takes the privkey exactly. Probably gets a new key that the phone stores, so the phone is still the "master" device. I wouldn't expect the phone client to happily send the chat history to a new device it didn't authorize locally.

Maken 2y ago

Telegram is not a Russian controlled app. Durov had to flee from Russia after the Crimea invasion because he refused to mass spy on dissidens. If anything he has a good track of not cooperating with Putin.

AnimalMuppet 2y ago
He's almost certainly better off getting arrested in France than he would have been getting arrested in Russia.
- steideler 2y ago
  [flagged]
throwaway74354 2y ago
That's a nice cover story, but Telegram had operated for years from the same Singer House in Saint Petersburg where VK headquarters are situated. Russian Direct Investment Fund had invested in Telegram. Nikolai Durov works at Russian Academy of Sciences. As of 2024, Russia-the-state has no problems with either Pavel Durov or Telegram. That's suspicious to say the least.
- petre 2y ago
  > As of 2024, Russia-the-state has no problems with either Pavel Durov or Telegram They only tried to ban it in 2018 and gave up in 2020 after failing to do so without cutting off access to other Internet services. The last time they blocked access to it was quite recently, on 21 August, after the Ukrainian incursion into Kursk oblast. https://understandingwar.org/backgrounder/russian-offensive-campaign-assessment-august-21-2024-0 https://understandingwar.org/backgrounder/russian-offensive-...
- 331c8c71 2y ago
  > from the same Singer House in Saint Petersburg where VK headquarters are situated. And so? Durov happens to be the founder of VK...

GauntletWizard 2y ago

If I were a pro-Ukraninian influencer, I'd want Russia to be reading a bunch of my messages. Probably not my private ones, but using the enemy's platform to distribute propaganda is a veritable goldmine.

steideler 2y ago
[flagged]

selectodude 2y ago

Not that it’s a whole lot better than Russia, but I’m pretty sure it’s based in Dubai.

negus 2y ago
And what would be better? France?

golergka 2y ago

> unless you were okay with Russia reading your messages This is not an empty accusation, there's been several stories which could not be explained by anything else than FSB having access to Telegram. That said, however, it's only FSB. There hasn't been a single suspicious act like that on behalf of Russian police, so we can assume that this access is only used in exceptional cases. So, unless you believe that Russian intelligence is targeting you personally, you're safe.

diggan 2y ago
> there's been several stories which could not be explained by anything else than FSB having access to Telegram Could you share which "100% confirmed" stories this is about? Haven't really come across that before
kgeist 2y ago
>there's been several stories which could not be explained by anything else than FSB having access to Telegram If your device is compromised, all bets are off. Example: FSB once leaked Navalny's emails. He used gmail. And no one suspects Google of conspiring with FSB.

novakboskov 2y ago

"Tribunal Judiciaire de Paris", the court, has published the charges: https://www.tribunal-de-paris.justice.fr/sites/default/files/2024-08/2024-08-26%20-%20CP%20TELEGRAM%20.pdf https://www.tribunal-de-paris.justice.fr/sites/default/files.... It's a two-pager primary source. Maybe check that before the video.

diggan 2y ago

> I feel that this is a pretty good summary of what's going on: https://youtu.be/39rBzRd4M0k https://youtu.be/39rBzRd4M0k and explains how the encryption works etc. What makes you feel that? Never seen that channel before, and the self-description of "High-intensity code tutorials and tech news to help you ship your app faster" doesn't really inspire much confidence when it comes to talking about more nuanced topics. For example, Telegram isn't based in Russia, and I don't think it ever was. So if that's one of the takeaways from that video, it seems pretty misinformed even about the basics.

paxys 2y ago

> It totally shocks me that so many pro Ukrainian influencers use Telegram. They are using Telegram for PR, same as Twitter or Instagram. It doesn't matter if the posts get decrypted by Russia – they are anyways meant to be public.

deleted 2y ago

[deleted]

kome 2y ago

Wow, hold on there, cold warrior.

steideler 2y ago
[flagged]