I wouldn’t put a lot of trust in Telegram. Not only is their cryptography off by default, it’s a bespoke hand-rolled non-standard algorithm that might not work as well as they say. Oh, and it’s been potentially backdoored by the FSB (Russia’s CIA) for six years.
Oh, and it’s been potentially backdoored by the FSB (Russia’s CIA) for six years.
From the very start rather.
And there’s been a few cases where not FSB, but mundane police was reading suspects’ messages before arresting them.
Don’t trust Telegram, I use it because, eh, most people use either that or VK DMs in Russia as the default IM. But never trust it for something which should be secret.
You can even have “opposition”-themed channels there or call for rebellions, but don’t ever expect anything to be secret or even pseudonymous. Even without ill intent regularly flaws are found which allow to get a lot of information, and the code quality is sewer-level.
non-standard algorithm
thats exactely the point lol. Why would you use an algorithm designed and proposed by the US government in a “secure” messenger?
Which algorithm are you referring to exactly?
In general, people are wise to use ciphers and protocols that have been examined by the global cryptography community and have held up to that scrutiny.
The algorithm was neither proposed nor designed by the US government, it was made by (what is now known as) Signal, a 501c nonprofit.
The claims of signal being “state-sponsored” come from assuming how money flows through the OTF - Open Tech Fund - which has gotten grants from government programs before. (IIRC)
It wouldn’t make sense for the US Gov. to make such a grant to make a flawed protocol, as any backdoor they introduce for themselves would work for any outside attacker too - it’s mathematics. It works for everyone or for no one. Would they really wanna make tools that they themselves use, just to have it backdoored by other state actors?
And again, Durov’s claims are entirely assumptions, and that coming from someone that has had [various](https://mtpsym.github.io// different vulnerabilities and weird bugs on their platform
The CEO also claims that users’ Signal messages have popped up in court cases or in the media, and implies that this has happened because the app’s encryption isn’t completely secure. However, Durov cites “important people I’ve spoken to” and doesn’t mention any specific instance of this happening.
[…]
The Register could not find public reports of Signal messages leaking due to faulty encryption.
Claims made without evidence can be dismissed without evidence.
Durov’s entire criticism seems to be based on implications and have no actual evidence of any technical problems with Signal. He’s basically just throwing shade at a competing business, which amounts to whining.
Funny how first association is “end-to-end encryption is broken” and not, you know, that whoever used the message got hold of one of the “ends”.
Yeah, I’m going to take this with a massive dose of salt. At least, Signal has encryption on by default for people. Where Telegram does not.
Even Facebook Messenger has E2EE on by default now. Pavel Durov talks a lot of shit considering Telegram still treats encryption as an afterthought.
You can’t even sync encrypted chats between devices. Lose your device or have a desktop client? Bye bye encrypted chat!
Yeah, being able to seamlessly switch between the desktop app and mobile is a must for me so that’s something I already prefer in Signal.
No backup no mercy 🤷♂️
I know that Telegram has a lot of users, so I’m not describing all of them here. But I’ve noticed that it seems especially popular among people who kind of like to “play pretend” as underground hackers. You know, the kind of person who likes to imagine that the government would be after them.
This mudslinging feels like more of a marketing campaign than anything else. An info op that will work well on the Telegram users who like to imagine that they have outmaneuvered all the info ops.
Yes. And those pretenders are always people who can’t install Synapse and “delete” their messages thinking that’s very smart.
If one is to compare apple to apples, imho the decision to choose between Signal, Whatsapp and Telegram and other “messengers” is obvious and clear.
Signal is fully open source! You can run it on-premises, if you know your business!
Why are we not talking about it?
I hope my comment will not be discarded/removed as not being in sync with the narative… 😉
Signal is fully open source! You can run it on-premises, if you know your business!
Why are we not talking about it?
Unless something has drastically changed recently, the official Signal service won’t interoperate with anyone else’s instance. That makes its source code practically useless for general-purpose messaging, which might explain why few are talking about it.
My point is that you have all the open source software components needed to run secure communications, on your own premises, for your own users/community in case you are not trusting Signal’s infrastructure.
If you know any other similar alternative with strong encryption open source protocols please let me know! I love learning new things everyday!
Cheers!
on your own premises, for your own users/community in case you are not trusting Signal’s infrastructure.
Yes, that’s an example of data (and infrastructure) sovereignty. It’s good for self-contained groups, but is not general-purpose messaging, since it doesn’t allow communication with anyone outside your group.
If you know any other similar alternative with strong encryption open source protocols please let me know! I love learning new things everyday!
Matrix can do this. It also has support for communicating across different server instances worldwide (both public and private), and actively supports interoperability with other messaging networks, both in the short term through bridges and in the long term through the IETF’s More Instant Messaging Interoperability (MIMI) working group.
XMPP can do on-premise encrypted messaging, too. Technically, it can also support global encrypted messaging with fairly modern features, with the help of carefully selected extensions and server software and clients, although this quickly becomes impractical for general-purpose messaging, mainly because of availability and usability: Managed free servers with the right components are in short supply and often don’t last for long, and the general public doesn’t have the tech skills to do it themselves. (Availability was not a problem when Google and Facebook supported it, but that support ended years ago.) It’s still useful for relatively small groups, though, if you have a skilled admin to maintain the servers and help the users.
Thank you very much for the info!
simplex ;)
I think Telegram has always been a honeypot
An FSB (or AP, don’t know which, the main thing is it’s Russian) honeypot at that.
Ma-trix! Ma-trix!
Blaming the Americans is a signature “Russia has fucked with this company” trademark.
There is also Matrix, which has advantages over both of them.
Anyone see if self hosted server ever got easy enough? For realsies.
Pot trying to call out Kettle.
F. Doubt.
This is the best summary I could come up with:
Telegram CEO Pavel Durov issued a scathing criticism of Signal, alleging the messaging service is not secure and has ties to US intelligence agencies.
Durov made his remarks on his Telegram channel on Wednesday, pushing a variety of points against the rival messenger app, including alleging it has ongoing ties to the US government, casting doubt over its end-to-end encryption, and claiming a lack of software transparency, as well as describing Signal as "an allegedly “secure” messaging app.
The comments seem to have been inspired by a City Journal report that detailed the origins of Signal, which was kickstarted by a $3 million grant from the US government’s Open Technology Fund.
The report says that Maher was an “agent of regime change” during the Arab Spring, and communicated with dissidents in the Middle East and North Africa.
The CEO also claims that users’ Signal messages have popped up in court cases or in the media, and implies that this has happened because the app’s encryption isn’t completely secure.
It’s hard to say, but Durov may be making a reference to Sam Bankman-Fried, whose Signal messages were a key part of the trial that resulted in the ex-CEO being convicted.
The original article contains 671 words, the summary contains 199 words. Saved 70%. I’m a bot and I’m open source!
They’ve never been shy about saying this.
sighs