3 ms·

Yes it does. Show me another non-profit Open Source (mostly) IM service that invests this heavily in seamless encryption and I'll change my opinion. The weaknes

Yes it does. Show me another non-profit Open Source (mostly) IM service that invests this heavily in seamless encryption and I'll change my opinion. The weakness that they found could have easily been brushed off as non-exploitable, yet they didn't, instead encouraging more security experts to become involved by paying out immediately.

ceejayoz 13y ago
Investing heavily is meaningless if you're investing badly. Building an encrypted IM service with bad crypto is like investing in blacksmiths in the early 1900s.
- m_mueller 13y ago
  The question whether their Crypto is bad is still out IMO - these recent findings still don't seem to be that big of a deal to me - as with all other IM services I have to trust the service provider for their integrity - yet here I have an alternative provided by a non-profit organization with some scientific credentials that offer an open API - as opposed to Skype, WhatsApp, Facebook et al. We currently use Skype for business purposes, but Microsoft's investment away from P2P makes me think that for privacy reasons alone, it's a bad idea. I'm always open for suggestions, but so far I haven't found anything really viable (well designed clients, well integrated encryption, open APIs). That's why I'm excited for Telegram.
  - ceejayoz 13y ago
    What's wrong with encrypted Jabber?
    - m_mueller 13y ago
      On OSX I'm happy with Adium, but last time I've used Pidgin it was a lot of work to configure it the way I want. That would still work for me, but to roll it out for an organization it would meet quite some resistance. So the problem with XMPP for me is the client situation.
      - pgeorgi 13y ago
        > So the problem with XMPP for me is the client situation ... which is fixed by a better client. That requires skills, but different ones from designing a new crypto protocol. Given the PR efforts of the telegram people, they might actually be better XMPP+OTR+TextSecure+... client implementers than crypto designers (and maybe even better client implementers than most of the people who build clients right now since the situation _is_ bad).
        m_mueller 13y ago
        I agree with that. Why they didn't go with this route is something I'd like to know as well - Telegram's FAQ is quite vague on this issue. But still, I prefer a reasonably secure service with great clients on all platforms, over a perfectly secure service with ugly clients that I can never 'sell' to decision makers.
  - prostoalex 13y ago
    > provided by a non-profit organization huh?
makomk 13y ago
To name just one alternative, the OTR developers have done far more to make seamless, open source encryption of IMs possible than Telegram - regardless of how much cash Telegram are willing to throw around. Even if the secret chat feature worked perfectly as intended, it'd still be both less usable and less secure than OTR. It requires users to manually validate key hashes in order to stay secure, a requirement the OTR developers dealt with years ago because they found users simply didn't do it. It also lacks forward secrecy which is especially important for mobile devices that can be stolen or lost.
- m_mueller 13y ago
  OTR sounds great, I just wish I'd find an easy-to-setup-and-use, good looking Windows client, such that I could convince non technical decision makers to adopt it. Adium does that for me on OSX, but I don't think Pidgin is a good match, except if something big has changed since 2-3 years ago when I last gave it a try.
h0cked 13y ago
Are you trolling or for real? 1) Telegram is NOT open soure. 2) OTR has been around for years.
JimDabell 13y ago
> Show me another non-profit Open Source (mostly) IM service that invests this heavily in seamless encryption and I'll change my opinion. You can't measure how secure something is by looking at how much money has been invested in it.

ceejayoz 13y ago

Investing heavily is meaningless if you're investing badly. Building an encrypted IM service with bad crypto is like investing in blacksmiths in the early 1900s.

m_mueller 13y ago
The question whether their Crypto is bad is still out IMO - these recent findings still don't seem to be that big of a deal to me - as with all other IM services I have to trust the service provider for their integrity - yet here I have an alternative provided by a non-profit organization with some scientific credentials that offer an open API - as opposed to Skype, WhatsApp, Facebook et al. We currently use Skype for business purposes, but Microsoft's investment away from P2P makes me think that for privacy reasons alone, it's a bad idea. I'm always open for suggestions, but so far I haven't found anything really viable (well designed clients, well integrated encryption, open APIs). That's why I'm excited for Telegram.
- ceejayoz 13y ago
  What's wrong with encrypted Jabber?
  - m_mueller 13y ago
    On OSX I'm happy with Adium, but last time I've used Pidgin it was a lot of work to configure it the way I want. That would still work for me, but to roll it out for an organization it would meet quite some resistance. So the problem with XMPP for me is the client situation.
    - pgeorgi 13y ago
      > So the problem with XMPP for me is the client situation ... which is fixed by a better client. That requires skills, but different ones from designing a new crypto protocol. Given the PR efforts of the telegram people, they might actually be better XMPP+OTR+TextSecure+... client implementers than crypto designers (and maybe even better client implementers than most of the people who build clients right now since the situation _is_ bad).
      - m_mueller 13y ago
        I agree with that. Why they didn't go with this route is something I'd like to know as well - Telegram's FAQ is quite vague on this issue. But still, I prefer a reasonably secure service with great clients on all platforms, over a perfectly secure service with ugly clients that I can never 'sell' to decision makers.
- prostoalex 13y ago
  > provided by a non-profit organization huh?

makomk 13y ago

To name just one alternative, the OTR developers have done far more to make seamless, open source encryption of IMs possible than Telegram - regardless of how much cash Telegram are willing to throw around. Even if the secret chat feature worked perfectly as intended, it'd still be both less usable and less secure than OTR. It requires users to manually validate key hashes in order to stay secure, a requirement the OTR developers dealt with years ago because they found users simply didn't do it. It also lacks forward secrecy which is especially important for mobile devices that can be stolen or lost.

m_mueller 13y ago
OTR sounds great, I just wish I'd find an easy-to-setup-and-use, good looking Windows client, such that I could convince non technical decision makers to adopt it. Adium does that for me on OSX, but I don't think Pidgin is a good match, except if something big has changed since 2-3 years ago when I last gave it a try.

h0cked 13y ago

Are you trolling or for real? 1) Telegram is NOT open soure. 2) OTR has been around for years.

JimDabell 13y ago

> Show me another non-profit Open Source (mostly) IM service that invests this heavily in seamless encryption and I'll change my opinion. You can't measure how secure something is by looking at how much money has been invested in it.