10 ms·

Telegram Hits 2B Messages Sent Daily

103 points by reddotX 11y ago

higherpurpose 11y ago
It's a little frustrating to see that the most secure (yet still usable) alternatives aren't the most popular (perhaps with the exception of iMessage, although 95% of the security of those messages is compromised anyway by the backup system that's enabled by default). I like to tell myself that this is because the really good open source options don't have enough money or clout to make themselves popular, while apps like Whatsapp or Skype or Telegram do. It's just unfortunate that the least secure apps and services get pushed to the mainstream simply because of money.
- robmcm 11y ago
  Why not promote them here? What are the "the really good open source options"?
  - darklajid 11y ago
    I think the consensus here is that TextSecure (and whatever the iOS client is called) is the Right Thing. Personally, I'm doing a last effort to use xmpp right now (just in the process to migrate to the unreleased prosody 0.10 for some features that I require) and otherwise Telegram looks like the 'sanest' option so far. Doesn't require a phone number as identifier Clients for ~all~ platforms that I care about
    - aroch 11y ago
      TextSecure doesn't work more than 50% of the time for me. Messages I send never get delivered, or they get delivered and replies disappear. Or they send and show up 2 days later. Or the client cannot cope with key changes and just fails to do anything whatsoever
    - skrowl 11y ago
      TextSecure = no web, windows, linux, or OS X client. Automatic fail for my uses.
      - e12e 11y ago
        You can help with that if you want: https://github.com/WhisperSystems/TextSecure-Browser https://github.com/WhisperSystems/TextSecure-Browser
- cynic_ 11y ago
  What's wrong with Telegram?
  - lloeki 11y ago
    Back in the day, one of the main arguments were that they're "rolling their own crypto", although I don't know how it stands today[0]. [0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-custom-protocol https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...
  - deleted 11y ago
    [deleted]
    - deleted 11y ago
      [deleted]
  - darklajid 11y ago
    Arguments as far as I'm aware (please correct me where I'm wrong): - Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven - End to end encryption isn't the default
    - SideburnsOfDoom 11y ago
      I'm looking at this: https://core.telegram.org/techfaq#q-why-are-you-mostly-relying-on-classical-crypto-algorithms https://core.telegram.org/techfaq#q-why-are-you-mostly-relyi... While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems. So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
      - Nursie 11y ago
        So to me a 'cryptosystem' is the way the elements are combined. Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem. Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either. Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
- m52go 11y ago
  Telegram is not governed by VCs or large corporations with ambiguous ties to government. Its code is open-source. It hasn't needed to spend money to make itself popular...its users did it for them. Which you could really say about all the services you mentioned. The difference is in who's footing the bill for all the other costs. The founder of Telegram is a privacy and civil liberties activist who has publicly committed to keeping Telegram as secure as possible, and that until a revenue model is determined that honors that standard, he'll continue funding it on his own (he's loaded from equity in VKontakte). What else are you looking for?
  - castratikron 11y ago
    Just thought I would mention that only the client is libre; the server is still closed.
  - maxerickson 11y ago
    The default protocol is share everything with the server: https://telegram.org/faq#q-how-secure-is-telegram https://telegram.org/faq#q-how-secure-is-telegram That is clearly prioritizing user convenience over "as secure as possible".
    - shawabawa3 11y ago
      Without prioritising user convenience you do get the best security, mainly because you have zero users to protect Yes, it could be better, but it's still better than whatsapp, facebook messenger and sms (I'm a telegram user, and wouldn't be if it didn't sync across devices)
      - maxerickson 11y ago
        When security is important, users are far better off not using anything than they are using something that they have misunderstood to be secure. So the share with server by default, brag about security approach is really bad, especially in the instances where the need for security is very clear. It also seems to be the case that Telegram is not making users aware enough of the importance of verifying the keys used to establish the secret chats (see the link here https://news.ycombinator.com/item?id=9538879 https://news.ycombinator.com/item?id=9538879 , users are sharing channel keys over the channel they are trying to establish). So there is a second level of traps that a user has to avoid to even have a chance of using Telegram securely.
- Nursie 11y ago
  What's the popularity of 'WhatsApp' like at the moment? IIRC the folks at Open Whisper Systems (TextSecure, Redphone and Signal) did some work with them to integrate the TextSecure protocol into that. So while I use TextSecure with friends who are happy to use that, I'm not upset about using WhatsApp with others as it's more mainstream and friendly, but has decent security under the hood.
  - darklajid 11y ago
    As far as I'm aware: - Your WhatsApp messages don't use that 'security' by default (or do they?) - That thing isn't open source and they could rip or swap out any encryption support they offer
    - Nursie 11y ago
      I think it's on by default. I could be wrong, it's worth checking now you mention it! And I know they didn't implement it for group chats, only 1-1 so far. And yes, you're correct, they could rip it out at any moment, in fact they could already have done so, and as a facebook subsidiary I'm not huge on the idea of trusting them. OTOH getting the whisper systems folks in was positive and from reading what they wrote about it, it didn't seem they were just being used for a PR exercise.
    - StavrosK 11y ago
      WhatsApp only uses encryption if both people are using Android and if the server approves it. There's also no way to know whether you're using it or not. I feel that Silent Text is omitted from these lists too frequently, unfortunately, as it's one of the most secure texting apps currently on the market (I would know, I work for SC).
      - Tepix 11y ago
        Silent Text is $10/month or so that's why there is no mass adoption.
      - MichaelGG 11y ago
- collyw 11y ago
  I think a lot of it is timing and momentum. I just bought an Ubuntu phone only to discover there is no whatsapp on it. I am happy to use Telegram, but convincing friends is an uphill battle.
- mahouse 11y ago
  WhatsApp was first, that's all
- jszymborski 11y ago
  It 100% isn't about popularity, it's about usability. I tried to get my friends on Tox, but ultimately had to get them on Telegram because it was the only app that was truly 100% cross-platform.
  - aet 11y ago
    Text messaging is cross platform
    - jszymborski 11y ago
      It doesn't have any desktop platforms, which was a critical criteria, and it doesn't support group chat in the way we needed it.
  - e12e 11y ago
    Yeah, because xmpp doesn't exist.
    - darklajid 11y ago
      You got my upvote and I stated elsewhere in this thread that I'm currently upgrading my xmpp server (to the unreleased 0.10 version of prosody). But let's be honest: xmpp is still not there. To have something comparable to what these clients offer you need a good number of extensions, notably (ymmv) - Message carbons (i.e. a message reaches all online devices) - Stream management (because without it, people are going to consider xmpp broken. "It loses my messages") - MAM (for shared archives between clients/devices, the reason for me upgrading to an unstable server now) Given that one of these isn't even (widely) available so far, I'd say xmpp is in a bad position. I love the idea. But it's hard to imagine that it can gain traction right now, given that the 'only' thing it has to offer against all the other systems is federation. I care about that. But .. most don't.
      - e12e 11y ago
        You know, I've always been planning to set up my own xmpp server, so I haven't looked to hard at the public offerings. Unfortunately there doesn't appear to be any good list over public service providers -- one that includes things like does the server support server side archiving etc. I was hopeful when I saw that duckduckgo[ddg], fastmail[fm] and mailbox.org[m] had public chat services. But of the three, none support standard archiving [XEP-0136] and only fastmail supports a custom form of archiving (via special emails to your fastmail-account). The latter at least gives you an option to archive chats (for eg: search) -- but it appears there's a market for a good, public and full-featured xmpp/chat service. Most of the other public servers appear to a) be free-only -- not a business -- and b) focused on privacy. I find it a bit surprising that noone has tried launching a free+paid option -- say reserving some features for paying users (and charge maybe 1 USD/month?). Actually, I think duckduckgo.com would be happy to "host" a services free tier -- have a trial account mode, and point user that just want a free chat service to ddg. Ddg gets more registered users, more users of their services, and those that are willing to pay for some features (eg: server side archiving, server side notes... others?) can pay a small amount for the service. Only draw back would be no seamless transition from one to the other (change of username/domain). On the plus side, all my trial accounts can talk to each other without problem (via server side federation) -- it just works. [ddg] https://duck.co/blog/using-pidgin-with-xmpp-jabber https://duck.co/blog/using-pidgin-with-xmpp-jabber [fm] https://www.fastmail.com/help/clients/chat.html https://www.fastmail.com/help/clients/chat.html [m] https://mailbox.org/en/mailbox-org-launched-secure-instant-messaging-service/ https://mailbox.org/en/mailbox-org-launched-secure-instant-m... [l] https://list.jabber.at/ https://list.jabber.at/ [edit: And while mailbox.org has an interesting offering, like some kind of deal with yubikey -- they seem to have neglected their xmpp setup somewhat -- there are some issues with ssl certs. Pidigin can't seem to figure out that xmpp at fastmail is chat.messagingengine.com, nor that mailbox uses xmpp.mailbox.org. Both give additional certificate errors if not adjusted. I suppose fastmail hasn't set up srv-records/dns aliases for their vanity domains (I registered mm.st -- as it was the shortest). It'd be better if one could just type in <user>@mm.st and have everything work. The bug might be in Pidgin, but fm really needs to test things. Of the three, ddg was by far the easiest to get started with -- register right in the im client (which also generates an account that works for ddg); and go.]
planetjones 11y ago
My dad is still an "avid" Blackberry user (as much as anyone who uses a blackberry these days is avid) and I note Telegram does not have a Blackberry client. Until that changes, we're still on whatsapp. EDIT: I want a polished official product, not something put together in a hackathon: https://telegram.org/blog/bb-results https://telegram.org/blog/bb-results
skrowl 11y ago
Telegram is great. I've got all of my friends upgraded from WhatsApp (and SMS) and we haven't looked back.
- yfkar 11y ago
  I switched to Telegram with my fiancée because of troubles with migrating WhatsApp data when she bought a new phone. When we powered up the new phone we realized that WhatsApp message history hadn't been transferred in the device migration (Windows Phone here) and there was some data that we wanted to preserve. WhatsApp on the old phone stopped working because the account had been used on the new phone so we couldn't even look at the chat history without using the SIM card to reactivate it. Reactivating WhatsApp on the old phone involved some extra hassle because the two phones had different SIM card slot sizes. After reactivation we could look at the old messages before moving the SIM card back to the new phone but couldn't transfer them, since WhatsApp chat history transfer on WP requires that both phones have an SD card slot. Being pretty fed up with WhatsApp at that point I found Telegram and have used it ever since.
levifig 11y ago
I've been trying to get friends and family to switch to Telegram from iMessage and WhatsApp. Their native apps are great platform, speed is awesome, and, above all, it's a platform-agnostic system. I highly recommend it.
- giarc 11y ago
  This is a huge hurdle in my opinion. Most of my friends own an iPhone and since I also own one, we group message on iMessage. If I wanted to switch to an Android, I would have to either convince them to switch to WhatsApp, Telegram etc etc or stop being part of that group chat, I think they call this FOMO. So having a bunch of friends with an iPhone that I regularly communicate with is a big pressure to continue buying Apple products.
  - minot 11y ago
    Isn't WhatsApp more secure than telegram now that it implements the textsecure protocol? I guess the biggest hurdle with whatsapp now is what to do when the public key for a user changes...
    - rhia 11y ago
      WhatsApp is still a complete pain to use once you are used to Telegram. Wanna switch phones? Better get ready to backup all your messages by hand. Want to use something other than a phone? Here, use our shitty web app. Your phone is out of battery? sucks for you i guess!
      - Nursie 11y ago
        >> Your phone is out of battery? sucks for you i guess! ?? Can you use telegram from another device? I think WhatsApp now has a windows client, maybe macos as well, recently announced. No idea what the security is like though. --edit-- Erm, I'm confused at the downvote, the parent raised a series of objections to WhatsApp and I asked for clarification of what they meant and suggested a non-phone client was available. I've done the research now and it turns out to be utterly useless if your phone's out of batteries as it does some sort of sync'ing and relies on the phone being on, so it's not fit for the purpose. But I'm still mystified at the downvote... --edit 2-- More downvotes! Yay! Wtf?
wahsd 11y ago
So how secure is Telegram?
- hurin 11y ago
  As far as I understand, not encrypted by default, and not very secure even when encrypted: http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-super-villain-doesnt-need-it-to-read-your-telegram-chats.html http://www.alexrad.me/discourse/a-264-attack-on-telegram-and...
  - dabeeeenster 11y ago
    Not encrypted by default? Really?
    - lxgr 11y ago
      I think it's not end-to-end encrypted by default; for "private" chats they claim to use end-to-end encryption, but use some homebew cryptographic protocol of dubious security.
      - MichaelGG 11y ago
        And, as far as I can tell, an idiotic visual key comparison only, so I've no way to call a contact and verify keys.
    - lucb1e 11y ago
      There are varying degrees of what "encrypted by default" means. WhatsApp used port 443 but sent plain text messages for years. Only fairly recently they switched around to actual encryption. Telegram messages have never been readable across the network and they claim that they also can't read the messages themselves. This is due to storing the encryption key in a different data center, but that begs for the question of how they deliver my phone the message if they don't have the decryption key. (Answering "incorrectly" that they can read my messages was how I didn't make it on the support team.) Then there is MTProto which everyone is buzzing about but which isn't even supported in all clients. This is the "secret chat" feature you see here and there, and it is actually encrypted end to end (and verifyably so). Clients are all open source so we can check that they are end to end encrypted -- WhatsApp or Facebook can ship you a backdoored version and you'd never be the wiser. Saying Telegram is "not encrypted by default" is like saying "https is not encrypted by default" because the server software can read the private messages you send to other people.
ilitirit 11y ago
The last time I read about Telegram people on HN were upset about it's security competition or something like that. IIRC, the gist of it was akin to this: T: "Our security system is so secure that we'll give you a prize if you manage to break in through the front door" HN: "But real criminals won't necessarily use the front door. What about other potential points of entry?" T: "We won't confirm or deny the existence of any other point of entry, and to be clear, the competition is strictly about the security that our front door provides" Is this still the case?
- nomel 11y ago
  Http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/
stevenleeg 11y ago
Telegram is fantastic with the glaring exception of mandatory read receipts. Am I the only one that can't stand having people know when I've read their messages? It seems like every major chat platform (except for iMessage) has read receipts enabled without any option to disable them. Why has this become so popular?
- mkr-hn 11y ago
  Everyone I talk to on Telegram understands I might read their message at one moment and respond later (or not at all). It's not an issue for me.
- discreditable 11y ago
  > Why has this become so popular? It settles the age old question of "Hey, did you get my message?". Many people like this functionality.
  - Ntrails 11y ago
    I'm more than happy to show "delivered reciepts" since that covers the question of whether the message arrived. I prefer to be able to read and reply later if I want to without feeling guilty that it'll look like I just couldn't be bothered. I mean, it's true, I couldn't be bothered, I just don't want to broadcast that fact :p
    - blerk 11y ago
      If you're on android, read the messages in the popup status window, it'll leave it "unread" until you open the conversation. You might need to enable the preview function for popups and/or popups for out to work. Kind of works unless someone sends a massive amount of messages/text.
- deleted 11y ago
  [deleted]
- teahat 11y ago
  Almost certainly because it increases engagement. By optimizing purely on metrics, psychologically undesirable effects creep in (guilt, in this case). c.f. online gaming apps and their addiction inducing behaviour.
4k 11y ago
I am really happy to see Telegram growing. I am one of those people who deleted Whatsapp (and lost touch with 30-40 people and several groups) when Facebook bought it. So far I have been happy with it, even though only like 5 of my friends use it. Yeah, it may (or may not) have security flaws like many on HN complain, but I would take it anyday over FB owned give-us-all-your-data product.
- lucb1e 11y ago
  Same here, except the people I wanted to communicate with are either the same or kind enough to install it also. If they don't care about WhatsApp already why should they care about installing Telegram next to it? Doesn't make a difference (to them anyway).
- Rainymood 11y ago
  Why did you delete Whatsapp?
  - lucb1e 11y ago
    Not the person you're asking, but for me personally I never wanted it. I installed it because a group in school wanted to kick me from the project because I'm "unreachable" (which meant I had no WhatsApp -- email, telegram, IRC, sms, calling, anything would have worked, but no WhatsApp was a reason to make me fail my year). I was sad that I couldn't uninstall it before Facebook bought it.
    - deleted 11y ago
      [deleted]
  - mcagl 11y ago
    I deleted it when this happened: https://4d43.wordpress.com/2014/05/29/whatsapp-and-facebook-apps-bad-things-happening/ https://4d43.wordpress.com/2014/05/29/whatsapp-and-facebook-...
spacefight 11y ago
Threema FTW.
- lucb1e 11y ago
  Why?
- darklajid 11y ago
  Why is another closed source/paid product better than this one? I'm okay with a price for something that I might use every day, but if I'm accepting closed source solutions - what's the benefit of Threema here?
  - mrmister1 11y ago
    Telegram is as good as closed source too. Look more into what they've actually open sourced...
    - darklajid 11y ago
      I know. [1] Which is a pity. If you'd want to believe their promise [2] they do plan to open up everything, but at the moment they're a closed source IM provider. But that's irrelevant. The GP hijacked a thread about Telegram with Threema, with a three letter acronym and nothing else. For me, Telegram and Threema have the same flaw (not open). If I'd have to pick one of the two, I'd go with Telegram I guess - it's free (as in beer) and offers clients for nearly every platform I could care about. So 'Telegram isn't open either' is correct, but misses the point: Given 'Threema FTW' my reaction was 'Why'? 1: When I wrote Why is another closed source/paid product better than this one? I tried to say (not my native language) Why is Threema, a closed source/paid product, better than this (closed source) one? 2: https://telegram.org/faq#q-why-not-open-source-everything https://telegram.org/faq#q-why-not-open-source-everything
- subliminalpanda 11y ago
  I actually like Threema. But convincing others to pay $2 when whatsapp is free is a tough sell.
deleted 11y ago
[deleted]
mrmister1 11y ago
They market themselves as open source but as far as I can tell none of their server side code is available. And if you want to build an app using the telegram system it's basically using their cloud servers. Does anyone know what their tech stack is?
- beckler 11y ago
  Where does it say open source? I see where it says they have an open API and protocol, but nothing about source code.
  - darklajid 11y ago
    https://telegram.org/faq#q-why-not-open-source-everything https://telegram.org/faq#q-why-not-open-source-everything
leni536 11y ago
I wonder why isn't there a "text messaging mobile app" out there which just uses openPGP signed and encrypted email as the backend. Email is not that far from text messaging anyway.
- otibom 11y ago
  I believe the reason is that exchanging public keys is, unfortunatly, to much work for the average user.
- uph 11y ago
  The answer is forward secrecy. If an attacker were to record all of a target’s ciphertext traffic over some extended period of time, and then compromise that one key at any point in the future (perhaps by seizing the device it’s on), they would have the ability to decrypt all of the previously recorded ciphertext traffic belonging to the target. https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/asynchronous-security/
pdevr 11y ago
The link here says that WhatsApp hit 800 million users last month: https://news.ycombinator.com/item?id=9538717 https://news.ycombinator.com/item?id=9538717 Telegram hit 1 billion messages in December 2014, and had 50 million active users at that time[1]. So, is it reasonable to assume that WhatsApp sends around 16 billion messages every day? [1] https://telegram.org/blog/billion https://telegram.org/blog/billion
dorfsmay 11y ago
It's multiplatform, but, you have to have a phone number to be able to get an account, right?
- SliderUp 11y ago
  True.
  - dorfsmay 11y ago
    Weird for a service that wants to be universal and independent...
iloveluce 11y ago
"Telegram is free forever. No ads. No subscription fees." How is that sustainable?
- Freeboots 11y ago
  +1, 2b messages is not cheap, where is their revenue if not from subscribers or from selling data? My only guess is that they are planning to charge for their api when they hit scale.
- Aoyagi 11y ago
  https://telegram.org/faq#q-how-are-you-going-to-make-money-out-of-this https://telegram.org/faq#q-how-are-you-going-to-make-money-o...

103 points by reddotX 11y ago

It's a little frustrating to see that the most secure (yet still usable) alternatives aren't the most popular (perhaps with the exception of iMessage, although 95% of the security of those messages is compromised anyway by the backup system that's enabled by default). I like to tell myself that this is because the really good open source options don't have enough money or clout to make themselves popular, while apps like Whatsapp or Skype or Telegram do. It's just unfortunate that the least secure apps and services get pushed to the mainstream simply because of money.

robmcm 11y ago
Why not promote them here? What are the "the really good open source options"?
- darklajid 11y ago
  I think the consensus here is that TextSecure (and whatever the iOS client is called) is the Right Thing. Personally, I'm doing a last effort to use xmpp right now (just in the process to migrate to the unreleased prosody 0.10 for some features that I require) and otherwise Telegram looks like the 'sanest' option so far. Doesn't require a phone number as identifier Clients for ~all~ platforms that I care about
  - aroch 11y ago
    TextSecure doesn't work more than 50% of the time for me. Messages I send never get delivered, or they get delivered and replies disappear. Or they send and show up 2 days later. Or the client cannot cope with key changes and just fails to do anything whatsoever
  - skrowl 11y ago
    TextSecure = no web, windows, linux, or OS X client. Automatic fail for my uses.
    - e12e 11y ago
      You can help with that if you want: https://github.com/WhisperSystems/TextSecure-Browser https://github.com/WhisperSystems/TextSecure-Browser
cynic_ 11y ago
What's wrong with Telegram?
- lloeki 11y ago
  Back in the day, one of the main arguments were that they're "rolling their own crypto", although I don't know how it stands today[0]. [0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-custom-protocol https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...
- deleted 11y ago
  [deleted]
  - deleted 11y ago
    [deleted]
- darklajid 11y ago
  Arguments as far as I'm aware (please correct me where I'm wrong): - Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven - End to end encryption isn't the default
  - SideburnsOfDoom 11y ago
    I'm looking at this: https://core.telegram.org/techfaq#q-why-are-you-mostly-relying-on-classical-crypto-algorithms https://core.telegram.org/techfaq#q-why-are-you-mostly-relyi... While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems. So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
    - Nursie 11y ago
      So to me a 'cryptosystem' is the way the elements are combined. Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem. Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either. Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
m52go 11y ago
Telegram is not governed by VCs or large corporations with ambiguous ties to government. Its code is open-source. It hasn't needed to spend money to make itself popular...its users did it for them. Which you could really say about all the services you mentioned. The difference is in who's footing the bill for all the other costs. The founder of Telegram is a privacy and civil liberties activist who has publicly committed to keeping Telegram as secure as possible, and that until a revenue model is determined that honors that standard, he'll continue funding it on his own (he's loaded from equity in VKontakte). What else are you looking for?
- castratikron 11y ago
  Just thought I would mention that only the client is libre; the server is still closed.
- maxerickson 11y ago
  The default protocol is share everything with the server: https://telegram.org/faq#q-how-secure-is-telegram https://telegram.org/faq#q-how-secure-is-telegram That is clearly prioritizing user convenience over "as secure as possible".
  - shawabawa3 11y ago
    Without prioritising user convenience you do get the best security, mainly because you have zero users to protect Yes, it could be better, but it's still better than whatsapp, facebook messenger and sms (I'm a telegram user, and wouldn't be if it didn't sync across devices)
    - maxerickson 11y ago
      When security is important, users are far better off not using anything than they are using something that they have misunderstood to be secure. So the share with server by default, brag about security approach is really bad, especially in the instances where the need for security is very clear. It also seems to be the case that Telegram is not making users aware enough of the importance of verifying the keys used to establish the secret chats (see the link here https://news.ycombinator.com/item?id=9538879 https://news.ycombinator.com/item?id=9538879 , users are sharing channel keys over the channel they are trying to establish). So there is a second level of traps that a user has to avoid to even have a chance of using Telegram securely.
Nursie 11y ago
What's the popularity of 'WhatsApp' like at the moment? IIRC the folks at Open Whisper Systems (TextSecure, Redphone and Signal) did some work with them to integrate the TextSecure protocol into that. So while I use TextSecure with friends who are happy to use that, I'm not upset about using WhatsApp with others as it's more mainstream and friendly, but has decent security under the hood.
- darklajid 11y ago
  As far as I'm aware: - Your WhatsApp messages don't use that 'security' by default (or do they?) - That thing isn't open source and they could rip or swap out any encryption support they offer
  - Nursie 11y ago
    I think it's on by default. I could be wrong, it's worth checking now you mention it! And I know they didn't implement it for group chats, only 1-1 so far. And yes, you're correct, they could rip it out at any moment, in fact they could already have done so, and as a facebook subsidiary I'm not huge on the idea of trusting them. OTOH getting the whisper systems folks in was positive and from reading what they wrote about it, it didn't seem they were just being used for a PR exercise.
  - StavrosK 11y ago
    WhatsApp only uses encryption if both people are using Android and if the server approves it. There's also no way to know whether you're using it or not. I feel that Silent Text is omitted from these lists too frequently, unfortunately, as it's one of the most secure texting apps currently on the market (I would know, I work for SC).
    - Tepix 11y ago
      Silent Text is $10/month or so that's why there is no mass adoption.
    - MichaelGG 11y ago
collyw 11y ago
I think a lot of it is timing and momentum. I just bought an Ubuntu phone only to discover there is no whatsapp on it. I am happy to use Telegram, but convincing friends is an uphill battle.
mahouse 11y ago
WhatsApp was first, that's all
jszymborski 11y ago
It 100% isn't about popularity, it's about usability. I tried to get my friends on Tox, but ultimately had to get them on Telegram because it was the only app that was truly 100% cross-platform.
- aet 11y ago
  Text messaging is cross platform
  - jszymborski 11y ago
    It doesn't have any desktop platforms, which was a critical criteria, and it doesn't support group chat in the way we needed it.
- e12e 11y ago
  Yeah, because xmpp doesn't exist.
  - darklajid 11y ago
    You got my upvote and I stated elsewhere in this thread that I'm currently upgrading my xmpp server (to the unreleased 0.10 version of prosody). But let's be honest: xmpp is still not there. To have something comparable to what these clients offer you need a good number of extensions, notably (ymmv) - Message carbons (i.e. a message reaches all online devices) - Stream management (because without it, people are going to consider xmpp broken. "It loses my messages") - MAM (for shared archives between clients/devices, the reason for me upgrading to an unstable server now) Given that one of these isn't even (widely) available so far, I'd say xmpp is in a bad position. I love the idea. But it's hard to imagine that it can gain traction right now, given that the 'only' thing it has to offer against all the other systems is federation. I care about that. But .. most don't.
    - e12e 11y ago
      You know, I've always been planning to set up my own xmpp server, so I haven't looked to hard at the public offerings. Unfortunately there doesn't appear to be any good list over public service providers -- one that includes things like does the server support server side archiving etc. I was hopeful when I saw that duckduckgo[ddg], fastmail[fm] and mailbox.org[m] had public chat services. But of the three, none support standard archiving [XEP-0136] and only fastmail supports a custom form of archiving (via special emails to your fastmail-account). The latter at least gives you an option to archive chats (for eg: search) -- but it appears there's a market for a good, public and full-featured xmpp/chat service. Most of the other public servers appear to a) be free-only -- not a business -- and b) focused on privacy. I find it a bit surprising that noone has tried launching a free+paid option -- say reserving some features for paying users (and charge maybe 1 USD/month?). Actually, I think duckduckgo.com would be happy to "host" a services free tier -- have a trial account mode, and point user that just want a free chat service to ddg. Ddg gets more registered users, more users of their services, and those that are willing to pay for some features (eg: server side archiving, server side notes... others?) can pay a small amount for the service. Only draw back would be no seamless transition from one to the other (change of username/domain). On the plus side, all my trial accounts can talk to each other without problem (via server side federation) -- it just works. [ddg] https://duck.co/blog/using-pidgin-with-xmpp-jabber https://duck.co/blog/using-pidgin-with-xmpp-jabber [fm] https://www.fastmail.com/help/clients/chat.html https://www.fastmail.com/help/clients/chat.html [m] https://mailbox.org/en/mailbox-org-launched-secure-instant-messaging-service/ https://mailbox.org/en/mailbox-org-launched-secure-instant-m... [l] https://list.jabber.at/ https://list.jabber.at/ [edit: And while mailbox.org has an interesting offering, like some kind of deal with yubikey -- they seem to have neglected their xmpp setup somewhat -- there are some issues with ssl certs. Pidigin can't seem to figure out that xmpp at fastmail is chat.messagingengine.com, nor that mailbox uses xmpp.mailbox.org. Both give additional certificate errors if not adjusted. I suppose fastmail hasn't set up srv-records/dns aliases for their vanity domains (I registered mm.st -- as it was the shortest). It'd be better if one could just type in <user>@mm.st and have everything work. The bug might be in Pidgin, but fm really needs to test things. Of the three, ddg was by far the easiest to get started with -- register right in the im client (which also generates an account that works for ddg); and go.]

planetjones 11y ago

My dad is still an "avid" Blackberry user (as much as anyone who uses a blackberry these days is avid) and I note Telegram does not have a Blackberry client. Until that changes, we're still on whatsapp. EDIT: I want a polished official product, not something put together in a hackathon: https://telegram.org/blog/bb-results https://telegram.org/blog/bb-results

skrowl 11y ago

Telegram is great. I've got all of my friends upgraded from WhatsApp (and SMS) and we haven't looked back.

yfkar 11y ago
I switched to Telegram with my fiancée because of troubles with migrating WhatsApp data when she bought a new phone. When we powered up the new phone we realized that WhatsApp message history hadn't been transferred in the device migration (Windows Phone here) and there was some data that we wanted to preserve. WhatsApp on the old phone stopped working because the account had been used on the new phone so we couldn't even look at the chat history without using the SIM card to reactivate it. Reactivating WhatsApp on the old phone involved some extra hassle because the two phones had different SIM card slot sizes. After reactivation we could look at the old messages before moving the SIM card back to the new phone but couldn't transfer them, since WhatsApp chat history transfer on WP requires that both phones have an SD card slot. Being pretty fed up with WhatsApp at that point I found Telegram and have used it ever since.

levifig 11y ago

I've been trying to get friends and family to switch to Telegram from iMessage and WhatsApp. Their native apps are great platform, speed is awesome, and, above all, it's a platform-agnostic system. I highly recommend it.

giarc 11y ago
This is a huge hurdle in my opinion. Most of my friends own an iPhone and since I also own one, we group message on iMessage. If I wanted to switch to an Android, I would have to either convince them to switch to WhatsApp, Telegram etc etc or stop being part of that group chat, I think they call this FOMO. So having a bunch of friends with an iPhone that I regularly communicate with is a big pressure to continue buying Apple products.
- minot 11y ago
  Isn't WhatsApp more secure than telegram now that it implements the textsecure protocol? I guess the biggest hurdle with whatsapp now is what to do when the public key for a user changes...
  - rhia 11y ago
    WhatsApp is still a complete pain to use once you are used to Telegram. Wanna switch phones? Better get ready to backup all your messages by hand. Want to use something other than a phone? Here, use our shitty web app. Your phone is out of battery? sucks for you i guess!
    - Nursie 11y ago
      >> Your phone is out of battery? sucks for you i guess! ?? Can you use telegram from another device? I think WhatsApp now has a windows client, maybe macos as well, recently announced. No idea what the security is like though. --edit-- Erm, I'm confused at the downvote, the parent raised a series of objections to WhatsApp and I asked for clarification of what they meant and suggested a non-phone client was available. I've done the research now and it turns out to be utterly useless if your phone's out of batteries as it does some sort of sync'ing and relies on the phone being on, so it's not fit for the purpose. But I'm still mystified at the downvote... --edit 2-- More downvotes! Yay! Wtf?

wahsd 11y ago

So how secure is Telegram?

hurin 11y ago
As far as I understand, not encrypted by default, and not very secure even when encrypted: http://www.alexrad.me/discourse/a-264-attack-on-telegram-and-why-a-super-villain-doesnt-need-it-to-read-your-telegram-chats.html http://www.alexrad.me/discourse/a-264-attack-on-telegram-and...
- dabeeeenster 11y ago
  Not encrypted by default? Really?
  - lxgr 11y ago
    I think it's not end-to-end encrypted by default; for "private" chats they claim to use end-to-end encryption, but use some homebew cryptographic protocol of dubious security.
    - MichaelGG 11y ago
      And, as far as I can tell, an idiotic visual key comparison only, so I've no way to call a contact and verify keys.
  - lucb1e 11y ago
    There are varying degrees of what "encrypted by default" means. WhatsApp used port 443 but sent plain text messages for years. Only fairly recently they switched around to actual encryption. Telegram messages have never been readable across the network and they claim that they also can't read the messages themselves. This is due to storing the encryption key in a different data center, but that begs for the question of how they deliver my phone the message if they don't have the decryption key. (Answering "incorrectly" that they can read my messages was how I didn't make it on the support team.) Then there is MTProto which everyone is buzzing about but which isn't even supported in all clients. This is the "secret chat" feature you see here and there, and it is actually encrypted end to end (and verifyably so). Clients are all open source so we can check that they are end to end encrypted -- WhatsApp or Facebook can ship you a backdoored version and you'd never be the wiser. Saying Telegram is "not encrypted by default" is like saying "https is not encrypted by default" because the server software can read the private messages you send to other people.

ilitirit 11y ago

The last time I read about Telegram people on HN were upset about it's security competition or something like that. IIRC, the gist of it was akin to this: T: "Our security system is so secure that we'll give you a prize if you manage to break in through the front door" HN: "But real criminals won't necessarily use the front door. What about other potential points of entry?" T: "We won't confirm or deny the existence of any other point of entry, and to be clear, the competition is strictly about the security that our front door provides" Is this still the case?

nomel 11y ago
Http://unhandledexpression.com/2013/12/17/telegram-stand-back-we-know-maths/

stevenleeg 11y ago

Telegram is fantastic with the glaring exception of mandatory read receipts. Am I the only one that can't stand having people know when I've read their messages? It seems like every major chat platform (except for iMessage) has read receipts enabled without any option to disable them. Why has this become so popular?

mkr-hn 11y ago
Everyone I talk to on Telegram understands I might read their message at one moment and respond later (or not at all). It's not an issue for me.
discreditable 11y ago
> Why has this become so popular? It settles the age old question of "Hey, did you get my message?". Many people like this functionality.
- Ntrails 11y ago
  I'm more than happy to show "delivered reciepts" since that covers the question of whether the message arrived. I prefer to be able to read and reply later if I want to without feeling guilty that it'll look like I just couldn't be bothered. I mean, it's true, I couldn't be bothered, I just don't want to broadcast that fact :p
  - blerk 11y ago
    If you're on android, read the messages in the popup status window, it'll leave it "unread" until you open the conversation. You might need to enable the preview function for popups and/or popups for out to work. Kind of works unless someone sends a massive amount of messages/text.
deleted 11y ago
[deleted]
teahat 11y ago
Almost certainly because it increases engagement. By optimizing purely on metrics, psychologically undesirable effects creep in (guilt, in this case). c.f. online gaming apps and their addiction inducing behaviour.

4k 11y ago

I am really happy to see Telegram growing. I am one of those people who deleted Whatsapp (and lost touch with 30-40 people and several groups) when Facebook bought it. So far I have been happy with it, even though only like 5 of my friends use it. Yeah, it may (or may not) have security flaws like many on HN complain, but I would take it anyday over FB owned give-us-all-your-data product.

lucb1e 11y ago
Same here, except the people I wanted to communicate with are either the same or kind enough to install it also. If they don't care about WhatsApp already why should they care about installing Telegram next to it? Doesn't make a difference (to them anyway).
Rainymood 11y ago
Why did you delete Whatsapp?
- lucb1e 11y ago
  Not the person you're asking, but for me personally I never wanted it. I installed it because a group in school wanted to kick me from the project because I'm "unreachable" (which meant I had no WhatsApp -- email, telegram, IRC, sms, calling, anything would have worked, but no WhatsApp was a reason to make me fail my year). I was sad that I couldn't uninstall it before Facebook bought it.
  - deleted 11y ago
    [deleted]
- mcagl 11y ago
  I deleted it when this happened: https://4d43.wordpress.com/2014/05/29/whatsapp-and-facebook-apps-bad-things-happening/ https://4d43.wordpress.com/2014/05/29/whatsapp-and-facebook-...

spacefight 11y ago

Threema FTW.

lucb1e 11y ago
Why?
darklajid 11y ago
Why is another closed source/paid product better than this one? I'm okay with a price for something that I might use every day, but if I'm accepting closed source solutions - what's the benefit of Threema here?
- mrmister1 11y ago
  Telegram is as good as closed source too. Look more into what they've actually open sourced...
  - darklajid 11y ago
    I know. [1] Which is a pity. If you'd want to believe their promise [2] they do plan to open up everything, but at the moment they're a closed source IM provider. But that's irrelevant. The GP hijacked a thread about Telegram with Threema, with a three letter acronym and nothing else. For me, Telegram and Threema have the same flaw (not open). If I'd have to pick one of the two, I'd go with Telegram I guess - it's free (as in beer) and offers clients for nearly every platform I could care about. So 'Telegram isn't open either' is correct, but misses the point: Given 'Threema FTW' my reaction was 'Why'? 1: When I wrote Why is another closed source/paid product better than this one? I tried to say (not my native language) Why is Threema, a closed source/paid product, better than this (closed source) one? 2: https://telegram.org/faq#q-why-not-open-source-everything https://telegram.org/faq#q-why-not-open-source-everything
subliminalpanda 11y ago
I actually like Threema. But convincing others to pay $2 when whatsapp is free is a tough sell.

deleted 11y ago

[deleted]

mrmister1 11y ago

They market themselves as open source but as far as I can tell none of their server side code is available. And if you want to build an app using the telegram system it's basically using their cloud servers. Does anyone know what their tech stack is?

beckler 11y ago
Where does it say open source? I see where it says they have an open API and protocol, but nothing about source code.
- darklajid 11y ago
  https://telegram.org/faq#q-why-not-open-source-everything https://telegram.org/faq#q-why-not-open-source-everything

leni536 11y ago

I wonder why isn't there a "text messaging mobile app" out there which just uses openPGP signed and encrypted email as the backend. Email is not that far from text messaging anyway.

otibom 11y ago
I believe the reason is that exchanging public keys is, unfortunatly, to much work for the average user.
uph 11y ago
The answer is forward secrecy. If an attacker were to record all of a target’s ciphertext traffic over some extended period of time, and then compromise that one key at any point in the future (perhaps by seizing the device it’s on), they would have the ability to decrypt all of the previously recorded ciphertext traffic belonging to the target. https://whispersystems.org/blog/asynchronous-security/ https://whispersystems.org/blog/asynchronous-security/

pdevr 11y ago

The link here says that WhatsApp hit 800 million users last month: https://news.ycombinator.com/item?id=9538717 https://news.ycombinator.com/item?id=9538717 Telegram hit 1 billion messages in December 2014, and had 50 million active users at that time[1]. So, is it reasonable to assume that WhatsApp sends around 16 billion messages every day? [1] https://telegram.org/blog/billion https://telegram.org/blog/billion

dorfsmay 11y ago

It's multiplatform, but, you have to have a phone number to be able to get an account, right?

SliderUp 11y ago
True.
- dorfsmay 11y ago
  Weird for a service that wants to be universal and independent...

iloveluce 11y ago

"Telegram is free forever. No ads. No subscription fees." How is that sustainable?

Freeboots 11y ago
+1, 2b messages is not cheap, where is their revenue if not from subscribers or from selling data? My only guess is that they are planning to charge for their api when they hit scale.
Aoyagi 11y ago
https://telegram.org/faq#q-how-are-you-going-to-make-money-out-of-this https://telegram.org/faq#q-how-are-you-going-to-make-money-o...