▲ 512 points
back
468 comments
Another thing that wasn't pointed out: Du Rove said "Signal messages have been exploited against them in US courts or media."
This would be the same case for Telegram as well, if someone has your phone. I believe that Signal can have a lock on the client, and the database is encrypted.
The other part that Du Rove conveniently left out: Signal went against the US courts and won [0]. When subpoenaed to give all user information they gave them all that had: the unix timestamp of when the account was created, and the last date you connected to the signal service. That was in late 2021. I'm really curious as to what Telegram has told the FSB.
[0]: https://signal.org/bigbrother/cd-california-grand-jury/
Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern.
The bigger problem with Telegram is that it by default has insecure encryption settings (as opposed to Signal, where encrypted is the default, you need to manually activate it with Telegram + I think it's not possible to enable for all chats and clients) and to my knowledge, Telegram will outright co-operate with law enforcement agencies to just hand over unencrypted communications. I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default
"Winning" would mean not having to comply with the subpoena...
> they gave them all that had: the unix timestamp of when the account was created, and the last date you connected to the signal service.
I'm confused. Signal also has your phone number because they require it, that's the primary privacy criticism against Signal.
Telegram has moved to Dubai long ago so no idea where you get the idea that FSB can strong-arm them from.
The database is encrypted, and the password is right next to the database in a json file.
On Signal vs Telegram:
Telegrams Encryption is off most of the time. They have serverside access to messages. The optional E2E is annoying to use and isnt even available on every platform. For example Tdesktop afaik still has no E2E support. (And has a very brittle software architecture.) You can't register Telegram accounts with the open source client anymore. This should be a non-Discussion.
MG implying that just because other messengers like Whatsapp use Signals encryption scheme does not make them more more trustworthy.
Yes you can verify in a binary if the stuff is implemented well. But if a vendor has control over the update channel or beta rollout features its kinda easy to hide targeted features. Wasn't Whatsapp caught exfiltrating chats in ways that don't involve the normal channel bypassing E2E?
Btw there is no Signal in Fdroid but nowadays there is an accepted by upstream third party implementation. You could separate software and infra vendor. Look at Molly.im
Better to bring non tech folk to Signal than to other messengers that do the same but less protected.
Matrix? Lol!
A nitter instance that still works? What is this sorcery?
Woah, people are still doing that thing where they break a post into 10+ tweets?
Telegram were claiming they were more secure even when they had their own home-rolled crypto. Security is not Telegram's strong point and it never was.
It’s a Telegram psyop that uses emotion, particularly fear and paranoia, to switch to their shite platform.
> An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media.
Any sources for this except the private testimony of a Signal competitor talking about his important friends? (ETA: Or is it when the court/media obtains your unlocked phone, in which case Telegram won't protect you either...)
Given the location of Telegram's servers (Dubai), and the nature of the government (neutral dictatorship) and the lack of encryption, my default assumption would be that not only are they selling access to your data to major governments, they've probably even streamlined the bidding process.
There are multiple layers where interception can happen:
1) On-screen keyboard - by default most phones do send what is being typed - a lot of phones also have 3rd party keyboards of doubtful origin preinstalled
2) "Enable backup" scam - on starting an app (like Google Photos or WhatsApp) chances you or your wife accidentally press "ok" on a pop up message
3) Hardware drivers - non open source binary blobs with back doors
4) Operating system - you basically don't know what information is logged and sent back to phone's vendor
This is a response to the following post from Telegram creator Durov
I think Signal could stand to gain popularity by either prioritizing overall niceness and polish in their clients (especially on desktop) or by allowing third parties to build clients which prioritize those things.
iMessage, Telegram, and Signal all get usage from me, with the vast majority of that usage weighted heavily on the former two because that’s where most people in my circles are. When comparing user experience between the three, it’s easy to see why.
Durov's exile and distancing from Russia after the VK takeover may be just for show and for selling Telegram as 'the dissident app'. It is popular, easy to use and insecure.
They want to do this because they want more traction for their blockchain: TRON, which, IIRC, is the payment method for ads, usernames and "stuff" inside Telegram.
However Du Rove is right about a bunch of things:
- Signal clients suck, specially the Desktop one where they ship (or used to) pre-built binaries like their own lib: https://github.com/signalapp/ringrtc - Also you can't have Signal without Google Play Store - Signal client suck in usability. I wish I had Telegram client (android) and desktop (qt) instead of this electron garbage. Telegram clients are super-duper-awesome - I would say that removing phone number requirement is their #1 request. yet they take so much time to address it, specially when they cry about phone number validation SMS costs - BTW, telegram is implementing a very nice idea of a crowd sourced sms validation, where they use their users phone numbers to send the validation sms - They have a very questionable crypto integration with MobileCoin, which have a obscure value: they depend on IntelSGX and is 95% pre-mined
Telegram is full of scammers. Something something bricks and a glass house.
Not being in either Telegram/Signal camp I see a lot of tribalism in the comments.
It seems that any arguments for/against either one end up in politics.
Like I understand that Telegram is probably not very secure, but seeing what proponents of Signal are saying doesn't really make me trust Signal either.
I've always at least strongly suspected that Telegram is a FSB honeypot.
It's insecure by default so I guess it could be an everyone-honeypot. I'll keep using Signal for my secure messaging thank you very much. Honestly I trust Apple iMessage encryption more than Telegram.
isn’t telegram the one that uses a wonky/sus custom encryption algorithm?
So since Signal has a board member who worked at a place that some people don't like then the Signal app must be backdoored/compromised/honeypot?
That's one hell of a leap. How far has our requirement for evidence fallen?
There seems to be a concerted effort to discredit Matthew's claims. Even here on HN. I find this suspicious. The Signal protocol has been heavily audited by many different people from many different countries. It's usually found to be sound. The telegram protocol has been found to have issues that are, if not malicious, amateur level mistakes.
Once again, this is not my opinion. This is the result of independent auditors who have no affiliation with either the USA or Russia.
There are positives to the UI of Telegram, there are negatives to the UI of Signal. None of these has much to do with the underlying protocol of either.
Personally I'd rather we all put our collective efforts into something like the protocol suggested by Matrix, but if only given the choice of Telegram or Signal, I'd avoid Telegram like the plague. They are either malicious or amateur. Either one isn't a good choice for security.
FSB vs CIA?
You can check this thread where his claims are debunked https://discuss.privacyguides.net/t/according-to-elon-musk-s...
Let me set a few things straight: Telegram is for the most part tiktok for people that don't mind putting some effort into reading on a few odd occasions. Saying that I have a lot of Ukrainian friends would be an understatement and the are the only reason I have telegram-all of them favor it, which, all things considered, is a grave mistake. In practice, telegram is far more closely related to tiktok and twitter than a messaging app and by extension it is heavily used to spread misinformation: telegram channels are ultimately under the complete control of their admins and they have the ultimate authority with no way of doing anything about it. Twitter was forced to put some effort into it through community notes but that hasn't even made a dent: it literally takes two google searches to find tens of thousands of bot accounts spreading misinformation. In that regard, telegram is much worse since it's an infinite source of cognitive dissonance: People are willfully joining echo chambers, which are openly advertised as such.
I am really glad that telegram is nowhere nearly as big in western countries compared to eastern Europe. It pains me to say this but, but even till this day, us eastern Europeans are way more susceptible to propaganda than the western world, although, for a million and one reasons that seems to have a huge effect on the western world as well. In that sense, telegram is an active contributor.
10/10 times I'll sit firmly behind Signal, despite the many shortcomings: there is no developer integration, if you want to create a signal account for your own personal bots or whatever, you can but only through a hacky repo that's on github.
Yes, the people behind telegram know all this very well and they don't like the fact that people who are aware of it as well are favoring signal infinitely more than telegram.
I really like Telegram from a UI/UX standpoint (so much better than Signal), but Pavel Durov is such a sketchy character that it's starting to turn me off. How can he be touting about being secure when they still haven't implemented end-to-end encryption by default? Also so many other things if you follow Durov's channel.
(I use Telegram and Signal each for about 45% of my messaging, even though I'm in Europe where WhatsApp is so prevalent.)
I can only see the first message in this thread. What does it say?
It seems like a twitter thread of multiple messages. How can I read the rest of the messages, not just /1? There's no links to them.
Go on, keep defending the overlord you believe have your best interests at heart while the other 57 of us go worry-free, using Matrix or XMPP.
Not a huge fan of Signal (phone number requirement [0], crypto push a while ago), but there are worlds between those two, and every time the Telegram CEO makes a post it looks more like a scam than before.
[0]: Yeah, might be changing or has already. Now, after ages.
Non X version?
Telegram has never AFAIK been open, and is thus insecure and always has been
In theory somebody could just make a client that takes your message, generates a random string, XORs your message by that, and sends the XOR via Signal and the rest via Telegram.
Telegram is a cesspit full of spammy bots & scams. Easy pass…
Which big centralized messenger operator can be more trusted to run the SW they say they are running is always a contentious shifting argument. If you host your own or use a small hoster, these arguments about who might have been compromised or compelled are not relevant. Decentralized and federated protocols such as Simplex.chat, XMPP, Nextcloud Talk, Matrix, Session, and Delta Chat eliminate this concern.
> Telegram has launched a pretty intense campaign to malign Signal as insecure, with assistance from Elon Musk
I got a bit confused here! Didn't Musk support and encourage people to "Use Signal" three years ago?! https://twitter.com/elonmusk/status/1347165127036977153
As far as we can tell, they are both insecure: Telegram is closed source and Signal published their source but basically forces users to use the Google Play version which lags behind the OS version and you can never be 100% sure what it does, not to mention things like SGX.
Maybe just don't use either one and switch to briar or tox instead?
If you really have secrets which you don't wanna share, then you should not trust any of these services. Develop your own service or stick to PGP mails.
Which messaging app applies US, Russian and Chinese encryption on each message/metadata at the same time that neither agency can break it alone?