maqp

28 ms·

301.
by maqp 5y ago
That's defeatist thinking. Just because some agencies of major governments can break into many devices doesn't necessarily mean they do. And there are other threats you'll want to defend from as well, including governments an
302.
by maqp 5y ago
>So yeah, it's virtually public. Let's stop saying that as it implies users are somehow aware the service provider has access to the content, and that they make an informed decisions wrt their privacy. >Even your private mes
303.
by maqp 5y ago
Sure, that works for public groups but generally the private group chats with sensitive private information about peoples' personal/business life are not public.
304.
by maqp 5y ago
>Telegram moved out of Russia precisely so they wouldn't be under their influence Yes, because if you're an FSB operation, the rule #1 is to operate from Russia, that way nobody suspects you. >moved to Dubai Yet journalists
305.
by maqp 5y ago
That is the thousand dollar question. How would we know Telegram isn't an FSB front * The CEO isn't a developer * We know practically nothing about their developers, they're all anonymous * The server has access to overwhelmi
306.
by maqp 5y ago
It's also the case doing that securely required pushing the boundaries of modern cryptographic protocols. Telegram's protocol graphs are novices' doodles compared to Signal's group encryption stuff formally described her
307.
by maqp 5y ago
Yeah, with client-server encryption. Which doesn't matter at all. Encryption where the service provider has the key, which is the case for * all Telegram chats by default * all Telegram group chats * all Telegram Win/Linux desktop
308.
by maqp 5y ago
>if they can convince Telegram to hand over the data. Or if they hack Telegram's servers. Or ask some other agency like the NSA (that hacks systems all the time) to do that for them. As for the legal aspects, I'm fairly sure Te
309.
by maqp 5y ago
It's great that insecure fast RNGs are improving, but it's extremely important to be responsible about how they should be promoted. 1. Insecurity needs to be in the name: Make it Insecure<Your RNG Name Here>. This is extreme
310.
by maqp 5y ago
Well, I can't choose for you or your peers, but you can say to them those who have looked into it, think iMessage is a security nightmare and there are better options that help you all sleep better at night. It's not that Telegram
311.
by maqp 5y ago
You're right in that the 1:1 video chats are E2EE, but not group video chats. This is my concern, but since you weren't making the claim, it's my mistake and now fixed. It's not my intention to be aggressive towards you
312.
by maqp 5y ago
No forward secrecy. No future secrecy. No deniability. No metadata protection. PGP for secure communication needs to die. We've had better architecture for the past 17 years when OTR was introduced.
313.
by maqp 5y ago
So to return to your original post: >"Actual multi-session clients across devices." Not available with E2EE >"No Electron." Sure, because you need all 32GB of RAM but not your human right to privacy. Also, this is
314.
by maqp 5y ago
The problem isn't the message log itself, it's the fact you pay for the privilege of having the cloud backup of conversation history, by giving that history to Telegram as a company. It doesn't have to be this way, as WA&#x27
315.
by maqp 5y ago
"By default it's not e2ee" And Win/Linux desktop chats are groups are not E2EE even if you want, so it's not just about it not being default, it's about the complete lack of E2EE for those. "but this makes
316.
by maqp 5y ago
iMessage has several problems I have outlined here: https://news.ycombinator.com/item?id=21425897 After reading it, you might want to reconsider Signal again.
317.
by maqp 5y ago
>but he has a much better public record on standing up for ethical causes than Zuck. Paying lip service is not the same as practicing what you preach. I'm not saying Mark Zuckerberg is on your side. I'm saying WA team managed t
318.
by maqp 5y ago
Oh please. You're complaining about technical person evaluating technical product on technical level, on a technical forum. E2EE is the bare minimum for security these days, as so carefully explained by the message you're replying
319.
by maqp 5y ago
Still fraction of the size of the Tor network. Let's take another look in 5..10 years.
320.
by maqp 5y ago
Tens of millions, 50 million to be more precise. <:
321.
by maqp 5y ago
The backdoor only applies to WhatsApp for Business, where companies want a fail-safe to open employee messages e.g. after they've left the company. The fact they're transparent about it should be enough. Do not use WA for Business
322.
by maqp 5y ago
Let's do an apples to apples comparison -End-to-end encrypted by default (WA yes, Telegram No) -End-to-end encrypted group chats (WA yes, Telegram No) -End-to-end encrypted group video calls (WA yes, Telegram No) -End-to-end encrypted
323.
by maqp 5y ago
Metadata-wise, yes. For protecting content, it's still pretty good. Also, WA seems to add features pretty close to Signal, which could indicate WA supports Signal in testing some of the features Signal provides consultation wrt secure
324.
by maqp 5y ago
It's also not supported for majority of desktop clients, so if you want to continue the "secret chat" you had on mobile on laptop when you get to work/school/whatnot, guess what, you're shit out of luck and nee
325.
by maqp 5y ago
-Not end-to-end encrypted by default (on any platform) -No end-to-end encryption for groups (on any platform) -No end-to-end encrypted desktop chats (Win/Linux) -No cross-platform end-to-end encrypted chats (iOS) -No end-to-end encrypt
326.
by maqp 5y ago
Nope. WA uses server-side group management, with Signal its purely on user-side. The message is revealed to be a group message on client-side. In theory, since the group messages are a burst of packets of the same size, the server can disti
327.
by maqp 5y ago
You're of course allowed to criticize but, as your "There is no excuse" shows you're not aware of the tradeoffs, especially to security agility centralized platforms do, there isn't too much insight in your categori
328.
by maqp 5y ago
Bought Threema in Jan 2017. Still 0 contacts so I guess the answer is no. Even Matrix has three contacts. Closer to 100 contacts on Signal though.
329.
by maqp 5y ago
You might want to remind people what commercial VPNs are good for: it masks the IP from _COMMERCIAL_ entities. It doesn't protect from the NSAs of the world because they have no restrictions in what VPN foreign servers they compromise,
330.
by maqp 5y ago
IIRC the funny thing is, the system that provides the codenames is random in order for the system to not leak information about what the code name is for. But since there's no limit to how many times you can request a code name, the sy

More ›