Here’s what he said in a post on his telegram channel:
🤫 A story shared by Jack Dorsey, the founder of Twitter, uncovered that the current leaders of Signal, an allegedly “secure” messaging app, are activists used by the US state department for regime change abroad 🥷
🥸 The US government spent $3M to build Signal’s encryption, and today the exact same encryption is implemented in WhatsApp, Facebook Messenger, Google Messages and even Skype. It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕🦺
🕵️♂️ An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media. But whenever somebody raises doubt about their encryption, Signal’s typical response is “we are open source so anyone can verify that everything is all right”. That, however, is a trick 🤡
🕵️♂️ Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones. Signal refused to add reproducible builds for iOS, closing a GitHub request from the community. And WhatsApp doesn’t even publish the code of its apps, so all their talk about “privacy” is an even more obvious circus trick 💤
🛡 Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github. For the past ten years, Telegram Secret Chats have remained the only popular method of communication that is verifiably private 💪
Original post: https://t.me/durov/274
It’s hard to overstate what a nothing-burger this article really is! Let me break it down:
- Signal got $3 million from the Open Technology Fund at some point in its development
- Some anonymous source alleges that the OTF’s ultimate goal is to promote US foreign interests
- The current chairman of the board Katherine Maher worked at the National Democratic Institute and Wikipedia before
- The same anonymous source says she was recruited because of connections to the OTF
- She has at some point voiced the opinion that a completely free internet without regulation just reproduces existing power structures, and that balancing regulation and 1st amendment rights is a tough problem
- Signal doesn’t have reproducible builds on iOS (it absolutely does on Android btw)
- Some people feel like Signal chats come up more often than they should in court cases and media reports
That’s it, that’s the whole story. That’s the reason why the Telegram guy of all people thinks you should be careful, and better use his chat service instead, and the Twitter guy agrees.
I mean, reproducible builds on iOS would be nice, but that platform has much bigger problems from a privacy/security/sovereignty/freedom standpoint anyway. And the rest is just nothing turned up to 11.
Getting “Tor is pentagon spyware” vibes from OP
I guess it’s the usual Russian propaganda tactic throughout Telegram. Mixing conspiracy theories with half-truths.
The NSA indeed distributed a defected encryption library in the past. These days I’m pretty sure big techs use open source encryption to avoid this trap.
And Telegram says blah, blah, iPhone is exploited. But IF Telegram is correct on this one, Andriod versions would be defect as well.
Maybe he should focus on adding e2e encryption to the default chats and group chats instead of spreading FUD.
Looks like a push to discredit Signal right now. While I know Signal isn’t perfect, I do like it and I haven’t seen anything that is better (on the whole). The 3rd “emoji-point” is quite an accusation, and I would love to see any evidence of this kind of thing, that didn’t result from the cops unlocking a defendants phone, or having infiltrated a chat.
Tin hat time:
I wonder if Russia’s trying to get everyone on Telegram because they have control over it.
This is probably just Telegram seeing an opportunity to peel some users away from Signal during a period of heightened paranoia in the West (anti-genocide organizing).
Maybe not Russia, but they sure are working with a certain government:
While I know Signal isn’t perfect, I do like it and I haven’t seen anything that is better (on the whole).
Agreed. But it is worth mentioning that XMPP with OMEMO seems to be the current gold standard - runs almost everywhere, tons of available (free) servers, secure end to end messages, and fully auditable public source code.
I have used xmpp a lot, but I can’t really recommend it to friends and family as a secure messenger. There are too many compatibility issues between clients and servers. If your friend is on a client or server that doesn’t support the same encryption protocols, then you can’t have a secure chat. Basically there is too much user knowledge and effort required at this time, for xmpp to be a good, secure, general use chat. I very much look forward to this changing. I also really like Matrix, but it is still a bit rough around the edges as of my last check.
I use xmpp all the time. Biggest hurdle for certain fam/friends using xmpp has been certain android builds (samsung) and ios interfering with timely notifications. User knowlege is not a problem as I can recommend the apps that are compatible encryption protocols with mine.
That’s great, and I’m happy it’s working out for you. It’s still kind of a bummer that this open protocol ends up fragmented across all those clients and severs. I’ve met other Linux enthusiasts online, connected with them via xmpp only to find we can’t encrypt our chats. Neither of us wants to give up our preferred client for various reasons, so we have a non-working situation.
Hmm, I see. But isn’t there an obvious solution to this? One of you just run two different clients side-by-side?
Sure there are workarounds, but every one of them erases a bit of convenience or is at odds with the benefits of federation. Again, I think XMPP is great, but I wish it was better. As it is now, it doesn’t fully meet my needs better than Signal does.
Yea, I hear you. I use both.
Well if only those samsung & ios users that never get my messages until I see them and tell them to open their app had phones that didn’t interfere with it running in the background / push notifications it would be working out for me even better, but that’s not an issue with the protocol or client but with OS’s being hostile to xmpp.
client or server that doesn’t support the same encryption protocols
Outside of TLS which most any server uses by default, XMPP or not, the server is not responsible for E2EE. Conversations Compliance & Are We OMEMO Yet have existed for a long while & I never see anyone recommending a client not on these lists so while certain features may be fragmented, the communication essentials have been more or less established for years now. XMPP is an extensible format, and some applications that aren’t for chatting with your friends/family, don’t need many of these features which allows the protocol to morph into something stripped down for the task… which is why the base spec is basically barren, & community XEPs are what folks get behind for adding new features for different use cases.
Agreed on all points. It’s not the best solution when I can’t get both parties into it successfully.
That’s why I still use Signal a good bit.
- refalo ( @refalo@programming.dev ) 4•6 months ago
That may be true, but wake me up when they capture 0.5% of the messaging app market :)
Telegram: There are backdoors in Signal encryption!
Also Telegram: not encrypted
It’s encrypted though?
You are trusting their server security and them as a company, sure, but it is encrypted against the server for sure.
It’s not as good as ir could be but that’s no reason to spread misinformation.
arent telegram chats unencrypted by default?
An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media
source?? (i bet this ends up being a “they had full access to my unlocked phone” situation again)
also the whole thing abt US funded encryption is the same bullshit argument ppl use against Tor all the time. it doesnt mean shit.
this just reads like someone desperately trying to get more market share by spreading FUD
“an alarming number of important people” is the source. That’s more than enough, right?
im gonna assume ur joking. its hard to tell sarcasm on the internet.
obviously i would like an actual source like at least one of those “important” ppl talking abt what happened to them
😂. Of course I’m joking. That claim is bullshit. Hey I know a guy who sold a bridge, and he’s wealthy now. Source: trust me, he told me.
read: “all my rich white friends”
“One rich dude I met once at a dinner party. Totally legit. “
“Who work for Telegram”
Well, Telegram seems to be giving user data to the German Federal Criminal Police Office, and if they’re cooperating with the German authorities, I don’t see why I’d presume they aren’t cooperating with others as well.
All this is actually documented, compared to those nebulous “important people”.
“Signal is insecure”
- Putin probably
Go read the GitHub issue. The main difficulty in implementing reproducible builds is the code signing Apple requires as well as other tweaks Apple makes to modify the binary from what the dev submits to what gets downloaded from the App Store. Note that Android already has reproducible builds. Also the reason the GitHub issue was closed wasn’t “refusal” to implement the feature, they wanted to move the discussion to their forums.
How does Telegram ensure reproducible builds for iOS? Or is Dorsey lying
Who knows how apple decides to do anything? There may be some really stupid arbitrary reason apple modifies signal but not telegram just because apple insists on being difficult. If you don’t trust apple don’t use an iPhone and just download it on android.
that’s not a fantastic answer to my question…
This comes a few days after Jack Dorsey confirmed that he had left the board of Bluesky and then starting to use Tw(X)tter and calling Tw(X)tter “freedom technology”. Coincidence ?
???
Is this guy stupid or what, current day Twitter could not be further than “Freedom technology”.
You can barely even see Tweets while logged out for fucks sakeEarlier on Saturday, he unfollowed all but three accounts on X: Edward Snowden, Stella Assange, the wife of the WikiLeaks founder Julian, and Musk.
“Don’t depend on corporations to grant you rights,” Dorsey tweeted. “Defend them yourself using freedom technology. (you’re on one).”
Despite his promotion of alternatives to the site he founded, Dorsey has publicly shared his admiration for Musk. In 2022, he called the multibillionaire the “singular solution I trust” for the future of Twitter, though a year later he criticised Musk for his “fairly reckless” moves after taking control of the site.
Okay first things first Jack Dorsey is a tool
The US government / CIA did in fact develop the protocol back in the day, with the goal of helping people in China and other countries message securely, probably with ulterior motives.
But the protocol itself is open source, and you can use it without any affiliation with the US government.
The claim " It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕🦺" is therefore so stupid it almost invalidates everything else being said because the person writing is either an idiot or purposely misrepresenting the facts.
Not having reproducible builds is definitely weird though. Does anybody have more information on that?
Not having reproducible builds is definitely weird though.
https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.md
Not having reproducible builds is definitely weird though. Does anybody have more information on that?
They boast this as a feature, but on the instructions for how to do this for iOS, even Telegram admits “As things stand now, you’ll need a jailbroken device, at least 1,5 hours and approximately 90GB of free space to properly set up a virtual machine for the verification process”. Browsing the steps, it’s extremely complex, and doesn’t seem like something that is very user friendly and that you’d do weekly or monthly when a new version is released.
On the GitHub issue linked to in the body, it’s disingenuous to claim they refused to implement this, and that the technical hurdles Apple has in place make this extremely difficult which halted progress. In the community forums where the conversation was moved to, someone pointed out that even if you were to reproduce it on a jailbroken iPhone, that there’s no way to confirm that non-jailbroken iPhones aren’t receiving a version with a backdoor.
And even if you are using a jailbroken device exclusively and can confirm the reproducibility of the iOS app, then the risk becomes the latest available jailbroken iOS could be outdated from the real versions, and you’d have other issues with not receiving timely security updates. This same issue applies to Telegram also.
then the risk becomes the latest available jailbroken iOS could be outdated from the real versions
Flipper0: iOS 17 Lockup Crash has entered the chat juuuust to be annoying.
EagerEagle posted a good comment under this post going over the client code stuff, pretty enlightening stuff.
Maybe fix Telegrams privacy problems.
https://www.404media.co/this-tool-shows-some-telegram-users-approximate-physical-location/
I can’t read it because of the paywall but IIRC (based on a similar article) that was such a nothing-burger issue.
People turned on an entirely optional (I think off by default setting) for some feature that allowed discovery of users by location … and shocked pikachu they could be tracked or something like that.
It’s not nothing if Telegram makes people believe they only share their location in a limited manner, but instead broadcast it to the whole world. That’s a serious breach of trust. I don’t know why Telegram users keep making excuses for that platform.
I don’t know why Telegram users keep making excuses for that platform.
Honestly? Because the others are just so bad.
- Element has an extremely clunky UX and uses Electron. The other Matrix app implementations are incomplete buggy messes.
- Signal can’t sync old messages to the desktop, uses a messy Electron interface, and lacks a bunch of features/polish I’ve come to expect.
- Discord doesn’t even pay lip service to privacy and uses a similarly doesn’t invest in native apps.
- Threema has been saying that cross-platform/multi-device connectivity is coming for like 2+ years and has had nothing but the most minor of unexciting features added.
- WhatsApp is run by Meta, has a crappy desktop experience, and has had several serious security vulnerabilities.
- Jami is … extremely glitchy.
- Session is basically Signal backed by a Crypto platform.
If someone took Telegram’s UX and feature set and paired that with Signal’s approach of “everything is encrypted”, that would be a winner. I kinda hope someday Telegram just does that and moves everything to E2EE. When Telegram was launched E2EE for group chats/at scale wasn’t really a thing … now it’s not nearly as novel but nobody has deployed E2EE with a feature set like Telegram’s.
It’s not nothing if Telegram makes people believe they only share their location in a limited manner, but instead broadcast it to the whole world.
That’s not even what happens by the way. It’s just that you can spoof a device into random locations and eventually figure out where someone is.
I mean it’s pretty bad to practice mass surveillance.
A “toot” isn’t a very persuasive piece of journalism.
I can verify that it absolutely impacts groups run by queer communities in the Gulf, because I was in one such group that was monitored and shut down by Etidal.
That claim needs a lot more investigation and context. At the very least, it needs investigated by a credible third party.
Also, do you even know what the feature you’re criticizing is? A “channel”? Because it’s not even really a part of the messaging portion of Telegram. It’s basically an in-app blogging platform.
She links to a news article: https://www.saudigazette.com.sa/article/641746/SAUDI-ARABIA/Etidal-Telegram-remove-over-16-million-extremist-contents-in-early-2024
I don’t think Telegram denies doing mass surveillance. They might deny targeting queer groups and claim to only target extremist, whatever that means.
That news article talks nothing about targeting groups unfairly and only talks about removal of extremist activity from what’s a social media platform (which is standard practice for all social media platforms). Specially that article talks about targeting “combating the online propaganda of ISIS, Hay’at Tahrir Al-Sham, and Al-Qaeda” which I believe is uncontroversial for all decent and reasonable people.
What polish and features is signal missing?
- Signal can’t sync old messages to the desktop
- Persistent voice rooms
- Custom emoji
- Animated emoji
- Location sharing
- Chat folders
- Topics/rooms for larger group chats
- Support for larger group chats
- Quoted replies (i.e., quote part of a reply or create an arbitrary quote block)
- Code snippets
- Message forwarding
- Polls
- Animations in the UI
- Detailed custom theming
- Chat room theming
- A content index (e.g., view only the files, links, videos, etc that were sent in this chat)
- Group invite links to people you don’t have in your contacts
- Channels (i.e., micro-ish blogging)
- A nice bot API
- Subjective UI/UX changes to put things in more reasonable places (e.g, why can’t I right click on a chat to pin it in the desktop client, why is the Electron menu bar shown by default)
And probably several other things I’ve forgotten because … basically nobody I know is still using Signal.
Thanks for the detailed reply. Signal does have location sharing and invite links, FWIW.
Signal’s location share AFAIK can’t be a live location share (which is useful during events like amusement park trips and stuff)
They have invite links to group chats? I don’t know how that would work
Also Simplex.chat
Yes, sorry, but I can’t take something seriously if every paragraph begins and ends with an emoji. I know it’s dismissive, but all my Facebook lunatic conspiracy theory alarm bells are blaring.
It’s more normal in Russian-speaking Web.
Shouldn’t trust this guy anyway, it’s VK’s founder talking.
I don’t care about dorsey or whatever, but a lot of privacy advocates don’t consider signal secure, drew devault for example. I’m def among them, you should not trust any centralized US-hosted service.
Linking to their post to say it’s a little bit more complicated that “it isn’t secure” https://drewdevault.com/2018/08/08/Signal.html
I’m all for Jami, and XMPP.
The kettle calls the pot black…
Is telegram not providing reproduce builds?
Telegram isn’t encrypting chats (only secret chats).
As far as reproducible builds telegram has got instructions and caveats or excuses around builds for the same issues signal does: https://core.telegram.org/reproducible-builds#reproducible-builds-for-ios
Both easily make Android reproducible builds. This Twitter message is a rock being thrown in a glass house, knowing most people who consume Twitter like it’s a firehose, won’t swallow the nuance of the details.
I don’t even, not to complete lengths.
I don’t know about reproducible builds, but Telegram has a slew of other problems. For example, they advertise that your messages are “heavily encrypted”, but this feature is restricted to secret chats which is NOT the default method of communication and they use their own weird-ass algorhythm called ProtoMT instead of one of many existing algorhythms which have been audited and verified. Not to mention you need to give them your phone number to use the app.
This is also just a few days after Durov published Nazi dogwhistles in the latest Telegram update blog post.
mostly because he got interviewed by tucker carlson, he said he has also given interview to a liberal reporter so as to show he is neutral and everyone has right to free speech
Where’s the interview with the liberal reporter, lol?
Haven’t seen it published in his channel either
Dammit… Thank you for sharing this.
Telegram: We keep you private. Now enter your phone number to sign up.
Signal does the same
Signal is the same in that regards.
Was
Signal still requires a phone number to use it. What they recently added is the ability to message people without needing to know their phone number.
Oh, that sucks. My bad.
That breaks anonymity, not privacy
It breaks both
You mean “confidentiality”, not privacy.
Just the metadata related to whether you personally, traceable to your full name and address, have a Signal account and how much you use it might be considered a privacy breach already, even if the content of the messages is confidential.
Points 0 and 1: None of this is new. This goes back to 2011 or 2012.
Point 2: If someone gets hold of your phone and unlocks it (meaning, they can interact with it), they have access to your Signal messages on-board. This is why additional security measures (not using biometrics, encrypting your phone natively) are recommended. If your phone is off and someone dumps the data from it, they get encrypted data.