Telegram's operators reveal their true colours

https://www.independent.co.uk/news/world/europe/telegram-russia-ban-lift-messaging-app-encryption-download-a9573181.html Just in case anyone was still under the delusion that Telegram had any semblance of security, here's your wakeup call. They're now "cooperating" with governments that have just lifted bans on it.

>>11249 Telegram's core is proprietary, the service is also. I don't know why it became so popular and why people trust it.

>>11250 Timing. They got marketing right when whatsapp got bad press for being insecure. So people hopped.

>>11251 Ironically whatsapp is, and has always been, more secure than telegram. That isn't exactly saying very much and I would still never recommend whatsapp but it goes to show how readily people will fall for marketing.

>>11252 >Ironically whatsapp is, and has always been, more secure than telegram. I hope you only mean by this it is less insecure. Whatsapp is proprietary software controlled by Zuck and nothing from this disgusting human(?) can be secure nor private.

>>11254 >Whatsapp is proprietary software So is telegram. Whatsapp does stuff like end to end encryption by default, which makes it marginally more secure (up until recently telegram didn't even have e2ee). Obviously don't trust either one but that's not my point. I'm not saying its good, I'm saying its better than telegram (on paper at least, trust for the companies involved does matter but... well look at the OP).

>>11255 >>11254 Oh soykaf, sorry I misread your reply. Yes, I mean it is less insecure.

>>11252 >>11255 What does WA even mean with e2e encryption? It's impossible that they can't see your messages, they have to scrape them somehow.

>>11260 From my understanding an encrypted copy of your actual key is stored on the server, and this key is encrypted with another key that is derived from your password, so in theory they do not have access to your key or encrypted message contents. I think this is how telegram e2e works too (not to mention all those encrypted email providers like tutanota and proton, encrypted file storage like mega, basically anything "encrypted" that runs in a web browser). Of course the problem with this is whatsapp controls the entire process so they could just push whatever they want to their app and compromise you.

i dont know current state but i remember reading whatsapp had cleartext messages on server side and re-encrypted to pass on. Meaning their end2end is just redefined where the server is the end. Same way many 2factor auth systems are by no means 2factor and use just another app on the same system for example. Marketing is hijacking security terms to claim upholding standards that aren't met.

>>11262 You may actually be thinking of telegram. There was a bit of buzz a month or two ago about people realizing they do this. Whatsapp's problem is the client can decrypt your messages and send them to anyone because it is closed source. I vaguely remember reading that this is what happens if you use the app's "report" feature. It doesn't let Facebook decrypt anything, the client just decrypts the messages and then forwards them to Facebook for moderation which is frankly almost as bad. Like I said, don't use either, but I'm sure you don't need me to tell you that.

>>11263 Just checked. Whatsapp had no end2end til 2014. Shows how old my info was. They do still have however cleattext backup cloud storage for chat which you can however disable. Other interesting thing i found alongside is news that they started controlling sharing messages to "avoid spreading false info on corona". If the system registers a link is shared often it hinders further sharing. Reminds of the older fb project where they manipulated what messages people could see to test if they could control peoples mood by controlling ratio of good/bad messages shown.

>>11264 >They do still have however cleattext backup cloud storage for chat which you can however disable. In fairness to Whatsapp (something I very rarely say, I'm normally a hardcore XMPP/OMEMO guy), this plaintext backup is disabled by default on Android.

>>11264 >they started controlling sharing messages I feel like this might actually turn into the straw that starts pushing people away from conventional social media. It makes the abstract threat of surveillance and datamining more real when you're getting immediate feedback that the dragnet flagged the thing you're trying to send for wrongthink.

Mark Zuckerberg sells Facebook to Google, leaves USA to Dubai (actually doesn't leave, he keeps the top floor at Facebook HQ pretending he's abroad hiding from NSA) and starts a super secure private and anonymous messaging application for darknet drug dealers called Telephone. This is basically what Pavel Durov did in Russia.

>>11255 Telegram client is not proprietary, Telegram server is proprietary. Whatsapp client and server are both proprietary but use the Signal protocol (not proprietary).

>>11276 yeah and whatsapp's e2ee is more mature and enabled by default (also uses axolotl ratchet). its going to depend on which features are more important to you but at the end of the day they're both bad for different reasons. discord's client is open source too but that doesn't mean it's magically secure or respects your privacy, given that we have no idea what the server is doing.

>>11261 Exactly this, when encryption and keys are fully managed, it's almost same as no encryption.

>>11273 lol i forgot about telegram's origin story. russian big tech is some crazy soykaf. seemingly a lot more of a revolving door between public and private sectors, kind of like united states military contractors.

>>11277 Is discords client fully open source or just some compiled library with public api? Seems strange they would give people the chance to avoid data gathering client side.

>>11285 it is nowhere near open source. Their license explicitly says that you can't use any other client.

>>11286 Does that matter? Did a search and found a different client on github that doesnt use electron, there seems to be a lot of bot clients too. The important question is if its possible to use your custom client and get away with it.

>>11287 yes, yes it is. Ripcord is a popular one at the moment although it's proprietary. as for the terms of service it mentions modifications to the official client not being allowed and nothing about third-party clients leaving them in a gray area

>>11288 What i meant is ToS is irrelevant as long its not enforced correctly. So the question is if they actually catch custom client users quick or not.

>>11290 I've been using the Ripcord client for a few months now and have had zero issues with any of my accounts getting deactivated, though that's just me. Use custom clients at your own risk but for the most part you should be fine if your client isn't abusing any part of the Discord API.

>>11276 Telegram "team" failed to follow GPL license rules, they did not publish code commits properly, and source code lagged one version behind current binary builds for desktop client last time this crap made into big news and I bothered to care to read about it.

>>11286 >>11285 My mistake. I assumed it was open source because there are quite a few alternate clients (betterdiscord, ripcord, etc.)

>>11276 >you can't run none of those servicese on your own absolutely proprietary

>>11261 >From my understanding an encrypted copy of your actual key is stored on the server Telegram has asymmetric encryption. The key you share with somebody using telegrma is public and cannot be used for decrypting data, only encryption in one side.

>>11255 >>Whatsapp is proprietary software >So is telegram. Telegram client is FOSS >up until recently telegram didn't even have e2ee Telegram has had E2E for years. >trust for the companies involved does matter but... well look at the OP Facebook has no shortage of cases where they bent over for the government time and time again. In terms of general user experience, Telegram is clearly the better program. Whatsapp still doesn't have a standalone desktop client. People give Telegram soykaf for having Secret Chats, i.e. the E2E is opt-in per conversation, but your Whatsapp convos are stored in cleartext too because you or your conversation partner will have icloud/gdrive backups enabled. You have to "opt in" to E2E in WA's case by disabling the backups, which is a lot less clear. The difference is that if you start a Secret Chat in Telegram, it will be secret on both ends. If you message someone on Whatsapp and you have backups disabled, there's no telling whether the recipient has it too. For security and privacy it clearly goes Signal > Telegram > Whatsapp Even though most people would swap the last two because muh russians

>>11276 isn't whatsapp's locked up server based on ejabberd?

>>11373 xmpp > signal tho

>>11273 Whatever. Russia can't send a team of thugs to my house, seize all my assets, or throw me in prison nearly as easily as the US can, since that's where I live. >>11261 Key or no key Facebook is mining your WhatsApp metadata for ads. So when they see you talking to someone on WhatsApp that likes X, Y, and Z on Facebook they'll show you ads for X, Y, and Z all across the web, even though they can't read your conversation. Even though the approval of the Facebook-WhatsApp merger forbid doing exactly this.

>>11373 >Telegram client is FOSS This doesn't exactly say much when the service in question has a large server-side component. That's like saying facebook is FOSS because I loaded it up in firefox. >Telegram has had E2E for years. Does it have e2e group chat yet? I tried looking it up but couldn't find a clear, recent answer. Whatsapp and imessage do afaik. >Facebook has no shortage of cases where they bent over for the government time and time again. Very true. >but your Whatsapp convos are stored in cleartext too because you or your conversation partner will have icloud/gdrive backups enabled Wait, are you telling me icloud/gdrive sync conversation logs in cleartext? That's insane but I believe it. I'm not surprised gdrive does that given how google handles people's email accounts, but i was under the impression that icloud encrypted your drive with a key they can't access. Wasn't that the whole point of that court case about the mass shooter's phone? Glad I don't use any of that soykaf. >>11454 Facebook chat used to be at least. Idk if you're thinking of that.

Main telegram userbase is Russians and they use it because: 1. It's convenient, all you have to have is your mobile phone which now everyone owns and is hard for 3rd party to break into. You can only intercept SMS, which Russians did until Durov implemented passwords. 2. It offers a decent alternative to vk.com which is alike to facebook now but with music and documents. For the rest it is enough to know they use their own cryptography, it's useless to discuss whether it's secure from this point. Not just that secret chats are not implemented in their desktop client (only Mac version). So you should not view it as anything else than another ICQ, despite whatever claims it makes. Some interesting history from Telegram (all sources in Russian, unfortunately): Telegram crash dump collector domain was cracked with sql injection: https://habr.com/ru/post/460655/ Not that crash dumps are so precious, but makes you wonder what level of defence their other resources have. Phone client with PIN can be cracked with johntheripper in minutes. Durov argumented weak phone encryption with that having a physical access to the phone you already have everything. As a side effect it allowed you to clone telegram client to another mobile device and join secret chat conversation as a 3rd party, having an ability to talk and write from the account of person you cracked. https://habr.com/ru/post/419551/ https://habr.com/ru/post/442586/ Also a court of Durov with his ex-worker, Rozenberg, where Durov used his root privileges to delete all chat history with Rozenberg, erasing all the evidence but restoring it back when Rozenberg shown he had everything recorded. Durov denied he had any relations to Russian company named Telegraph, which in the end turned out to be true, all while Durov himself made loud claims he will not have any business in Russia ever again. https://www.vedomosti.ru/technology/articles/2017/09/18/734319-durov-obvineniya-bivshego-top-menedzhera-telegram https://vc.ru/flood/27155-anton-rozenberg-opublikoval-dokumenty-ob-uchastii-durova-v-sozdanii-ooo-telegraf Several years later this (history erasement from one side without agreement of another) was implemented as feature in the client itself. People protested against and Durov made a poll. Poll ended up with majority (>55% or so) disagreeing and was left like that for several days, pretty sure it was a week, but Durov was not going to close the poll yet... for whatever reason? And indeed, in one day sides magically switched, votes "for" magically started to increment like crazy and the majority ends up voting for feature implementation. There were no comments on situation because the feature was already in the client and the poll 'win' meant he was just not going to remove it.

>>11493 Ahahhaha, lol... Wait. AHHAHAHAHHAHAHA. There now! https://roskomsvoboda.org/61109/ >4. То, что Дуров не дает (пока) ответа на этот вопрос и, в то же время, демонстративно сближается с российским государством — очень и очень напрягает и настораживает. AAAAAAAAAAhahaha, fuarrrk, lol. Nyu ya ze govoril syka blad.

>Comrade lieutenant Durov works for FSB 2008 news.

https:// core.telegram.org/tdlib/notification-api/ >Android and iOS clients can opt-in to receive end-to-end encrypted push notifications via a Firebase Cloud Messaging or Apple Push... Pwned Luuuul. Notification encryption is opt-in? While service uses botnet server notification framework leaking everything but hey it's opt-in to encrypt it just don't forget! Present Day, Present Time! AHAHAHAHAHA! Present Day, Present Time! AHAHAHAHAHA!

As a Mexican, I'm more worried about USA getting my data than Russia to be honest.

>>12690 The world is literally in a rat-chase to build the first Panopticon. This is the full glory of information age.

>>12693 LITERALLY???/!!!!!! Where are all the rats?

>>12694 In Camus' Plague.

>>11373 >Telegram client is FOSS But their servers aren't you stupid dumb dumb dummy

>>12802 It doesn't matter what license software on someone else's computer abides to, what matters is a freedom-respecting way of interacting with this computer. Telegram clients are not free software in the first place, never were and never planned to, the devs do not update public source code with binary releases, there are no reproducible builds, there is no real way of interacting with Telegram's servers in freedom-respecting way. I don't know why people keep repeating the same chant over and over again about great end-to-end encrypted and private open source messaging app from former Russian Zuckerberg copycat and FSB intern. Must be kremlin bots or legit brain damaged retards or sumthin.