- cross-posted to:
- [email protected]
blog.cryptographyengineering.com
- cross-posted to:
- [email protected]
You must log in or register to comment.
If Telegram is considered an encrypted messenger, then FB messenger should be too. Works exactly the same. I don’t know about you, but being the same level as FB messenger should speak volumes to whether Telegram is “encrypted” or not 🙄
FB messenger should be too. Works exactly the same. 🙄
Facebook licensed Signal’s encryption: https://signal.org/blog/facebook-messenger/
Yeah, the fact that FB messenger uses Signal protocol, means the encryption is better recognized than the one used in Telegram. But the lack of on-by-default or the need to drill in a few options before enabling secret chats… I mean it’s even named the same thing as Telegram.
It doesn’t matter what Facebook or WhatsApp say they use, their source code is closed, you can’t prove their words, meaning they don’t have e2ee. You can with Signal, you can with Telegram.
That’s ridiculous, Telegram client is opensource, Facebook is not. We know for a fact that Facebook shares their data with… well, anyone. The reason of the recent arrest of the Telegram CEO seems to be that he apparently doesn’t share anything.
One of the most important rules of cybersecurity is: never roll your own encryption.
And what did the guys at Telegram do? Rolled their own encryption.
If you are into Telegram because you think it’s secure, think again. There are much better alternatives out there, adopting proved industry standards. Signal or Matrix just to name a few.
if the people you want to talk to are using telegram then you don’t have much of a choice
Maybe tell them you are using signal and that they don’t have a choice but to use it
that doesn’t work with clients. or vendors. or any other type of business partner, really. maybe your staff and your grandma and steven?
It would if everyone already had it installed.
No.
As a kind of a weird bonus, activating end-to-end encryption in Telegram is oddly difficult for non-expert users to actually do.
As a kind of a weird bonus, activating end-to-end encryption in Telegram is oddly difficult for non-expert users to actually do.
No, it’s not. It’s very easy. In the bottom right corner there is a pencil button to compose a new message and right there it asks which tpye of chat to start. Secret chat is the second topmost option after group chat. Really not hidden or complicated at all.
It should be a setting to always use encrypted chat, and it should probably prompt you when you first login.
Better yet, don’t have an option to not have encrypted chats. I don’t see a reason to not have everything E2EE all the time.
As I understand it, public groups use server side encryption (so not robust), but private chats use e2e encryption that is client side. (More robust)
They’ve implemented it in such a way that you only have access to an encrypted chat on a single device, so no syncing between devices. Syncing E2EE chats across devices is more difficult to pull off, but it’s definitely possible and other services do that by default.
Syncing E2EE chats across devices is more difficult to pull off, but it’s definitely possible and other services do that by default.
That’s because if you are able to get your private key on another device, then Google, Apple or Microsoft, and that means anyone, also have access to your private key. And you don’t have e2ee, literally.
It should be a setting to always use encrypted chat, and it should probably prompt you when you first login.
I don’t disagree but the claim that you quoted was that it’s complicated to initiate and as I explained it’s not. Also secret chats stay in the messages list, so you can go back to an initiated secret chat and pick up there without any additional fiddling.
If you have to enable it every time, it’s complicated enough that most people won’t bother. Maybe they’ll do it once or twice out of novelty, but it’s not going to become a habit.
I only consider something “encrypted” if it’s actually encrypted by default, or at least prompts to enable it permanently on first launch. Otherwise, it’s not an “encrypted” chat, it just has the option to have some chats encrypted.
If you have to enable it every time, it’s complicated
But you don’t. As I already explained: secret chats stay in the messages list, so you can go back to an initiated secret chat and pick up there without any additional fiddling.
I have plenty of encrypted chats that I don’t have to enable every time I want to send one. I don’t understand where this misconception comes from.
Surely you talk to more than one or two people, no? If you have to manually check a box or something every time you start a new message with someone, people are going to stop doing it.
It’s not an encrypted chat app. It’s an unencrypted chat app that has an option for encrypted chats. Whether something is encrypted or not depends on how most people use it and what the defaults are.
Signal is an encrypted chat app. E2EE is the default and AFAIK only behavior. Telegram can be encrypted, but it’s not by default, and defaults matter.
Surely you talk to more than one or two people, no? If you have to manually check a box or something every time you start a new message with someone, people are going to stop doing it.
Maybe you get acquainted to 100 new people every day, so your day is a constant chore of starting secret chats all the time. I don’t. I doubt regular people do. Just start the secret chat once and then pick it up later.
Signal is an encrypted chat app.
Except for the locally stored data which is not encrypted and Signal’s attitude is that device encryption is up to the user.
I don’t see a reason to not have everything E2EE all the time.
You probably didn’t ever meet non-IT person(or most of the IT people). To use e2ee means you need to keep your private key close and safe. 99.999% people can’t do that. So when they lost their key their conversation history is gone and it’s your fault not theirs.
Why would it even be an option to have a non-encryted chat if the app can do encrypted?
Telegram isn’t made to be a full E2EE messenger. They have things like public channels which you can’t do with E2EE. What kind of idiots thought that Telegram was intended to be a fully E2EE messenger? People use it cause it is native and good for its purposes. It has secret chats if you need them at times. Why all the hate from the Signal CIA fanbois?
My man, have you ever worked in tech support? I admire your optimism.
That’s my day job and I’m good at it. People understand when I explain three clicks.
People understand when I explain three clicks.
This is the problem. You have to explain it. Feel like talking to several million people to get them to use it?
Feel like talking to several million people to get them to use it?
I already made a one-line excessive tutorial in another comment. Feel free to link it.
You should put it on tiktok and yt shorts, lol
Maybe when you share it, and explain, and be ready to support the millions of users, then we’ll have e2ee. But even then we probably won’t.
Maybe when you share it
I already did.
and explain
I already did.
and be ready to support the millions of users
Of course. As I already explained, this sort of thing is my job. Millions of people signing support contracts with me: Awesome! I’ll be creating so many jobs. Happy to expand into enterprise communication by offering Teamgram hosting services.
also their encryption is proprietary. you can’t actually know its good.
That’s incorrect, their client is opensource, you can check their e2ee yourself.
The encryption algorithm may be open source, but they rolled it themselves. It is proprietary encryption.
Again, it’s not, go to their github, check the code of the client, compile it yourself, and make a reproducible build to check that the client they ship to your phone is the same. You are talking nonsense.
You’re not getting what I’m saying, because you don’t understand what “proprietary” means in this context.
Proprietary encryption ≠ Proprietary code.
You can roll your own shitty novel encryption algorithm and license it under GPL if you want, it’s still proprietary encryption in that Signal has its own unvetted encryption algorithm instead of using a trusted existing algorithm.
EDIT: How are people not understanding this?
Proprietary licensing is different from a proprietary way of doing things.
If you folks think that a GitHub repo and GPL license are all you need to vet an encryption algorithm, and you think that absolves an novel untested algo from being called “proprietary encryption” you’re gonna get burned one day because your trust was built on not understanding encryption.
Signal built their own encryption algorithm. That’s proprietary encryption. If you still think I’m wrong, pick up a dictionary, look up “proprietary” and “encryption”, and you might just have a chance at understanding that “proprietary” is an adjective that can apply to a lot of different words.
Sure its is. Russia has the keys so they can snoop. Its encrypted though so just the kremlin can read it. Enjoy.
Its funny how what is out there can’t be comprehended by those who only see what they want to see. If he wasn’t in putins pocket he would have fell out a window by now. The rest is just a sad song and dance that the weak minded buy into.
Aha that’s why telegram is banned and blocked in Russia
Wasn’t it unblocked again soon after?
It was “blocked” for 2 years, though there was a problem accessing it for only a month or so as Telegram developers implemented ways to avoid the ban. In 2 years the government officials decided that Telegram made enough effort to block extremist materials to remove themselves from the embarrassment. Now they probably think “why didn’t we trick Durov to visit us and just arrest him like France did”.
I am fairly convinced that it was either theater from the beginning, or some agreement was reached before it was “unblocked”. RKN doesn’t care about “embarrassment” or collateral damage if they want to do something.
I don’t see any agreement possible just because Russia had literally nothing to offer to Telegram.
Telegram is VERY popular there. What it has to offer are users who would see ads and pay for the subscription.
But the ban was only somewhat effective for like a month, then Telegram found a way to avoid it. In two years no one even felt like it was banned. So what could Russia offer to Telegram? Literally nothing.
What was your methodology to determine that?
Racism.
The comment where everything’s made up and the points don’t matter
