4 ms·

I really disagree. There's simply no good secure cross-platform messaging app available. Telegram has fantastic clients on all the platforms, but isn't secure.

I really disagree. There's simply no good secure cross-platform messaging app available. Telegram has fantastic clients on all the platforms, but isn't secure. TextSecure is secure, but has only a mediocre app on a single platform (Android). The other alternatives are even worse. Tox is looking really promising though: https://wiki.tox.im/FAQ https://wiki.tox.im/FAQ

Pamar 12y ago
What about Threema? (https://threema.ch/en https://threema.ch/en)
- kristofferR 12y ago
  It's not cross-platform unfortunately, it's only on mobile devices.
- lmedinas 12y ago
  tbh I trust on Threema the same way I trust on Whatsapp or any other client which promises encryption. Threema is closed sourced and thus I don't know which/how encryption are they actually using.
bugsbunny123 12y ago
Telegram isn't secure? Source please.
- hucker 12y ago
  http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-contest http://www.cryptofails.com/post/70546720222/telegrams-crypta... Also, messages are not encrypted by default, and there is afaik no way to encrypt group chats. You have to create a special "secret" chat for the messages to be encrypted.
  - jhasse 12y ago
    All messages are encrypted by default, but not client-client (in order to make cloud sync work): https://telegram.org/faq#q-why-not-just-make-all-chats-secret https://telegram.org/faq#q-why-not-just-make-all-chats-secre...
    - kristofferR 12y ago
      It is possible to create synced messages without depending on a server decrypting the messages. Here's how Tox is going to implement that: https://github.com/Quoturnix/ProjectTox-Core/wiki/Multiple-devices https://github.com/Quoturnix/ProjectTox-Core/wiki/Multiple-d...
      - jhasse 12y ago
        True, but Tox requires a password for that. Telegram tries to be an alternative to WhatsApp so forcing people to sign up with an account isn't an option.
- furyg3 12y ago
  It's the other way around. Messaging apps need to demonstrate their own security by releasing the source code. So far only TextSecure does this.
  - jhasse 12y ago
    Telegram's client code is also open source.
  - eps 12y ago
    One doesn't demonstrate security by releasing the source. One needs to have source released, audited and verified to match prebuilt binaries that are actually used by the unwashed gray masses. Without all three checked for each public build you have zero assurance that you are running a binary built from the released source and that the source doesn't have anything fishy in it. The only app that checks all three, somewhat ironically, is TrueCrypt. PGPfone checked #1 and #3. TextSecure checks just #1 unless I am missing something, so objectively its "demonstrated security" is exactly the same as that of any another app that simply describes what it does in plain English and has a traffic to prove it.
    - kissickas 12y ago
      The Truecrypt audit still hasn't been finished yet, has it?
- b3tta 12y ago
  I guess stuff like that: http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
- JonoBB 12y ago
  https://news.ycombinator.com/item?id=8686868 https://news.ycombinator.com/item?id=8686868
lewispb 12y ago
WhatsApp is starting to implement TextSecure technology in it's cross-platform apps and has 600m users. http://www.bbc.co.uk/news/technology-30114346 http://www.bbc.co.uk/news/technology-30114346
- kristofferR 12y ago
  Yeah, but WhatsApp isn't actually cross platform. It's only on mobile devices. And the article you linked points out several times that the encryption is only going to be enabled for WhatsApp's Android client for the time being.
- aw3c2 12y ago
  It is still a closed source application that I do not trust.
e12e 12y ago
I'm not sure I understand what you mean by "cross-platform app". Sounds like a contradiction in terms, to me. We have XMPP and OTR, and with chatsecure on Android or various clients on Linux it's pretty pleasant. I believe there are a few OS X clients as well, not sure about iOS.

Pamar 12y ago

What about Threema? (https://threema.ch/en https://threema.ch/en)

kristofferR 12y ago
It's not cross-platform unfortunately, it's only on mobile devices.
lmedinas 12y ago
tbh I trust on Threema the same way I trust on Whatsapp or any other client which promises encryption. Threema is closed sourced and thus I don't know which/how encryption are they actually using.

bugsbunny123 12y ago

Telegram isn't secure? Source please.

hucker 12y ago
http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-contest http://www.cryptofails.com/post/70546720222/telegrams-crypta... Also, messages are not encrypted by default, and there is afaik no way to encrypt group chats. You have to create a special "secret" chat for the messages to be encrypted.
- jhasse 12y ago
  All messages are encrypted by default, but not client-client (in order to make cloud sync work): https://telegram.org/faq#q-why-not-just-make-all-chats-secret https://telegram.org/faq#q-why-not-just-make-all-chats-secre...
  - kristofferR 12y ago
    It is possible to create synced messages without depending on a server decrypting the messages. Here's how Tox is going to implement that: https://github.com/Quoturnix/ProjectTox-Core/wiki/Multiple-devices https://github.com/Quoturnix/ProjectTox-Core/wiki/Multiple-d...
    - jhasse 12y ago
      True, but Tox requires a password for that. Telegram tries to be an alternative to WhatsApp so forcing people to sign up with an account isn't an option.
furyg3 12y ago
It's the other way around. Messaging apps need to demonstrate their own security by releasing the source code. So far only TextSecure does this.
- jhasse 12y ago
  Telegram's client code is also open source.
- eps 12y ago
  One doesn't demonstrate security by releasing the source. One needs to have source released, audited and verified to match prebuilt binaries that are actually used by the unwashed gray masses. Without all three checked for each public build you have zero assurance that you are running a binary built from the released source and that the source doesn't have anything fishy in it. The only app that checks all three, somewhat ironically, is TrueCrypt. PGPfone checked #1 and #3. TextSecure checks just #1 unless I am missing something, so objectively its "demonstrated security" is exactly the same as that of any another app that simply describes what it does in plain English and has a traffic to prove it.
  - kissickas 12y ago
    The Truecrypt audit still hasn't been finished yet, has it?
b3tta 12y ago
I guess stuff like that: http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/ http://unhandledexpression.com/2013/12/17/telegram-stand-bac...
JonoBB 12y ago
https://news.ycombinator.com/item?id=8686868 https://news.ycombinator.com/item?id=8686868

lewispb 12y ago

WhatsApp is starting to implement TextSecure technology in it's cross-platform apps and has 600m users. http://www.bbc.co.uk/news/technology-30114346 http://www.bbc.co.uk/news/technology-30114346

kristofferR 12y ago
Yeah, but WhatsApp isn't actually cross platform. It's only on mobile devices. And the article you linked points out several times that the encryption is only going to be enabled for WhatsApp's Android client for the time being.
aw3c2 12y ago
It is still a closed source application that I do not trust.

e12e 12y ago

I'm not sure I understand what you mean by "cross-platform app". Sounds like a contradiction in terms, to me. We have XMPP and OTR, and with chatsecure on Android or various clients on Linux it's pretty pleasant. I believe there are a few OS X clients as well, not sure about iOS.