Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

I have to ask. Why Telegram specifically? I was under impression it is comparable to Signal.


Telegram is pretty bad from a privacy point of view. Only secret chats are end to end encrypted, everything else is sent in plaintext. Even if you do use secret chats they rolled their own crypto and their algorithm is controversial in the security community.

Both Signal and WhatsApp are much better if privacy is a priority for you.


It's ok to espouse your dislike for something but please do it correctly: "everything else" is not sent in plaintext. "Everything else" is encrypted to the server.


I don't think I said anything that was factually incorrect. If you read the Telegram FAQ they say that secret chats are end-to-end encrypted and regular chats are only client to server encrypted. That means the plain text of your messages is accessible to the server by default. Anyone with access to the servers including Telegram employees, governments, and cyber criminals can read your messages.

Hacker News for example is also client to server encrypted using TLS (as are most websites) but obviously our comments are still accessible in plain text.

https://telegram.org/faq#q-so-how-do-you-encrypt-data


You specifically wrote "sent in plaintext", which is factually incorrect. Telegram messages are never sent in plaintext.

But to address your digression: Cloud Chats (as opposed to E2EE Secret Chats) are both encrypted in transit and at rest [1]. The difference between the MTProto implementation between Cloud Chats and Secret Chats are, at a very high level, that part of the encryption key is held by Telegram.

To be unequivocally clear, at no point are Cloud Chat messages ever stored in plaintext or sent in plaintext.

[1] https://core.telegram.org/mtproto#authorization-and-encrypti...


Neither Signal nor Telegram are federated. You can't have an organizational or private Telegram server. Your account is managed by a party you have no control over.


Signal isn't federated because Signal tried to learn from the failure of XMPP to catch on in any meaningful way, in large part due to that federated nature. However, Signal is open source and its devs have said that anyone is perfectly free to fork it and run their own instances, as long as they remove all Signal branding and servers. In this respect, its unwillingness to allow federation does not negate it being free and libre.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: