- cross-posted to:
- privacy@lemmy.ml
blog.cryptographyengineering.com
- cross-posted to:
- privacy@lemmy.ml
You must log in or register to comment.
No.
As a kind of a weird bonus, activating end-to-end encryption in Telegram is oddly difficult for non-expert users to actually do.
As a kind of a weird bonus, activating end-to-end encryption in Telegram is oddly difficult for non-expert users to actually do.
No, it’s not. It’s very easy. In the bottom right corner there is a pencil button to compose a new message and right there it asks which tpye of chat to start. Secret chat is the second topmost option after group chat. Really not hidden or complicated at all.
It should be a setting to always use encrypted chat, and it should probably prompt you when you first login.
Better yet, don’t have an option to not have encrypted chats. I don’t see a reason to not have everything E2EE all the time.
It should be a setting to always use encrypted chat, and it should probably prompt you when you first login.
I don’t disagree but the claim that you quoted was that it’s complicated to initiate and as I explained it’s not. Also secret chats stay in the messages list, so you can go back to an initiated secret chat and pick up there without any additional fiddling.
If you have to enable it every time, it’s complicated enough that most people won’t bother. Maybe they’ll do it once or twice out of novelty, but it’s not going to become a habit.
I only consider something “encrypted” if it’s actually encrypted by default, or at least prompts to enable it permanently on first launch. Otherwise, it’s not an “encrypted” chat, it just has the option to have some chats encrypted.
annoying != complicated
More steps required to perform something is very squarely within the definition of complicated, no matter how straightforward those steps are.
If you have to enable it every time, it’s complicated
But you don’t. As I already explained: secret chats stay in the messages list, so you can go back to an initiated secret chat and pick up there without any additional fiddling.
I have plenty of encrypted chats that I don’t have to enable every time I want to send one. I don’t understand where this misconception comes from.
Surely you talk to more than one or two people, no? If you have to manually check a box or something every time you start a new message with someone, people are going to stop doing it.
It’s not an encrypted chat app. It’s an unencrypted chat app that has an option for encrypted chats. Whether something is encrypted or not depends on how most people use it and what the defaults are.
Signal is an encrypted chat app. E2EE is the default and AFAIK only behavior. Telegram can be encrypted, but it’s not by default, and defaults matter.
Surely you talk to more than one or two people, no? If you have to manually check a box or something every time you start a new message with someone, people are going to stop doing it.
Maybe you get acquainted to 100 new people every day, so your day is a constant chore of starting secret chats all the time. I don’t. I doubt regular people do. Just start the secret chat once and then pick it up later.
Signal is an encrypted chat app.
Except for the locally stored data which is not encrypted and Signal’s attitude is that device encryption is up to the user.
Is it more complicated to achieve than in other e2ee messengers? Yes, thus saying it is complicated is justified.
As I understand it, public groups use server side encryption (so not robust), but private chats use e2e encryption that is client side. (More robust)
I don’t see a reason to not have everything E2EE all the time.
You probably didn’t ever meet non-IT person(or most of the IT people). To use e2ee means you need to keep your private key close and safe. 99.999% people can’t do that. So when they lost their key their conversation history is gone and it’s your fault not theirs.
Signal does this by having your data be unencrypted at rest on your device, and I think that’s a reasonable tradeoff because it protects the most import part: data in transit. Or you can be like Matrix and require/strongly encourage setting up multiple clients so you always have a fallback (e.g. desktop and phone). There are reasonable technical solutions to the problem of making an E2EE chat system.
It’s three clicks. And it opens a separate chat from the existing one. It’s obscure enough that you could say the UX deprioritizes (which at best is not an actively malicious design choice) usage of end-to-end encryption.
Anything harder than usual in the same application means it won’t usually be used.
And encryption is about collective immunity. So everything should be encrypted.
It’s three clicks.
So it’s only three clicks, ergo easy.
And it opens a separate chat from the existing one.
I don’t see the problem. The secret one has the lock icon to clearly mark it. There’s no way one would accidentally pick the wrong chat. Delete the old, unencrypted one to be sure.
It’s obscure enough that you could say the UX deprioritizes (which at best is not an actively malicious design choice) usage of end-to-end encryption.
I agreed in another comment that there should be an “encrypted by default” option somewhere. I’m not claiming that it’s perfect but the claim in the blog that it’s super complicated is just not true. At least calls are P2P-encrypted by default.
Ah good point, gotta delete the old unencrypted chat too to avoid confusion. That’s definitely more than just 3 clicks.
If you’re talking to 30 people, it’s 90 clicks. It might be 3 clicks if you know where to look, but end of the day, even if you know where to find it, that’s still that many clicks times how many people you chat with. It’s not ideal. I wouldn’t say it’s complicated sure, but it’s not easy.
If you’re talking to 30 people, it’s 90 clicks.
Uh, so? A “compose message” button is the approach many communication apps use, including e-mail. Don’t get me started how many clicks it is to GPG-encrypt e-mails…
It’s not ideal.
I don’t know how many times I have to repeat myself that I agree on that part. You act as I would disagree. I don’t. It could be better but it’s also not a complicated nightmare as the blog author makes it out to be.
Right. But it’s also not exactly “easy” which is what you’re saying it is.
If easy was a sliding scale. Easy would be enabled by default. Hard would be making it obscure and hard to find. I would say it’s definitely closer to the harder to find side. But that’s just me. But 3 clicks, and having to switch chats and maybe delete the old one to avoid confusion, none of that is easy.
Right. But it’s also not exactly “easy” which is what you’re saying it is.
I said it’s as easy as tapping the compose button and selecting secret chat. I nowhere claimed that it’s easier than that but it’s also not more complicated than that.
Encryption is part of defense strategy, otherwise it’s like a steel door in a house with wall panels made of paper.
That strategy involves all communications being encrypted. Otherwise rubber hose cryptanalysis becomes practical.
also their encryption is proprietary. you can’t actually know its good.
That’s incorrect, their client is opensource, you can check their e2ee yourself.
deleted by creator
Again, it’s not, go to their github, check the code of the client, compile it yourself, and make a reproducible build to check that the client they ship to your phone is the same. You are talking nonsense.
Todd is a known bullshitter
deleted by creator
If Telegram is considered an encrypted messenger, then FB messenger should be too. Works exactly the same. I don’t know about you, but being the same level as FB messenger should speak volumes to whether Telegram is “encrypted” or not 🙄
FB messenger should be too. Works exactly the same. 🙄
Facebook licensed Signal’s encryption: https://signal.org/blog/facebook-messenger/
Yeah, the fact that FB messenger uses Signal protocol, means the encryption is better recognized than the one used in Telegram. But the lack of on-by-default or the need to drill in a few options before enabling secret chats… I mean it’s even named the same thing as Telegram.
the fact that FB messenger uses Signal protocol, means the encryption is better than the one used in Telegram.
MTProto 2 has not been cracked. MTProto 1 had a weakness and Telegram addressed it. That was many years ago. I’m not aware that MTProto 2 has ever been cracked in all these years. Telegram’s unwillingness to cooperate with governments is an additional security layer.
MTProto 2 has not been cracked.
What’s important is that it hasn’t been confirmed good by actual normal cryptographers. It’s science, not school debates.
Telegram’s unwillingness to cooperate with governments is an additional security layer.
No person ever instructed in security would say something this childishly asinine!
What’s important is that it hasn’t been confirmed good by actual normal cryptographers.
Why not?
I dunno. It’s just not.
Shows like “we have a reward to crack it, nobody’s done this, so we’re very cool” are not sufficient.
In my OP, I was merely referring to how FB Messenger and Telegram functions the same.
Speaking to the protocol used for encryption is a moot point… because even if MTProto 2 was better, it’s still not enabled by default in both messengers.
It doesn’t matter what Facebook or WhatsApp say they use, their source code is closed, you can’t prove their words, meaning they don’t have e2ee. You can with Signal, you can with Telegram.
Telegram needs to enable e2ee by default, cause the way it is now, you may as well not have it.
If Telegram is considered an encrypted messenger, then FB messenger should be too.
But strangely only one is being prosecuted.
I suspect that’s because Telegram’s marketing and it’s users consistently try to place Telegram in the same categories as actually secure and encrypted messengers. Whereas I don’t see tech blogs claiming that FB messenger is secure.
Then is not than
Good catch 🫡
That’s ridiculous, Telegram client is opensource, Facebook is not. We know for a fact that Facebook shares their data with… well, anyone. The reason of the recent arrest of the Telegram CEO seems to be that he apparently doesn’t share anything.
I mean that is a fair point. But open source client only matters if people were using Telegram’s secret chats consistently. The closed source server is what’s most important when almost all communication happens plain text.
One of the most important rules of cybersecurity is: never roll your own encryption.
And what did the guys at Telegram do? Rolled their own encryption.
If you are into Telegram because you think it’s secure, think again. There are much better alternatives out there, adopting proved industry standards. Signal or Matrix just to name a few.
No, it’s not the rule itself. It’s rather an advice not to do as rolling own crypto is very tricky and complicated thing. You have to be very aware of many possible attacks, how they do work, to create own crypto properly
What does ‘rolling encryption’ mean (if it’s possible to ELI15).
OP probably meant “to roll out”, meaning: “to deploy”.
Nah, it’s I guess jargon at this point, but it really just means to make up your own crypto algos.
if the people you want to talk to are using telegram then you don’t have much of a choice
Maybe tell them you are using signal and that they don’t have a choice but to use it
that doesn’t work with clients. or vendors. or any other type of business partner, really. maybe your staff and your grandma and steven?
It would if everyone already had it installed.
It can be that. But it is also a medium for public forums.
Somehow it has public groups and requires your phone number. Not really sure how to find the groups though.
But unlike Signal, nobody can see your number
You can hide your phone number now with the release of usernames in Signal. Still need it for registration tho.
Oh here we go.
Manufacturing Consent to tear it down because victims around the world use it to get their voices out when everything else is shut down. People organizing against oppressive governments using it when nothing else is safe.
It can’t be allowed to exist. This is them social engineering your acceptance of their tyranny. Don’t bite the bait.
What is this nonsense? This is a technical post explaining why it’s not encrypted.
Plus there’s plenty of other services like matrix which can do the same thing better without enriching a billionaire
Sure its is. Russia has the keys so they can snoop. Its encrypted though so just the kremlin can read it. Enjoy.
Its funny how what is out there can’t be comprehended by those who only see what they want to see. If he wasn’t in putins pocket he would have fell out a window by now. The rest is just a sad song and dance that the weak minded buy into.
The comment where everything’s made up and the points don’t matter
Telegram CEO Pavel Durov’s Arrest Upends Kremlin Military Communications https://tech.slashdot.org/story/24/08/26/2233226/telegram-ceo-pavel-durovs-arrest-upends-kremlin-military-communications I’m sure its nice with your head in the sand but it doesn’t make any of you right.
The idea that any of them are secure is a pipe dream.
Durov has been blacklisted in Russia because he refused to cooperate with Putin’s government on several occasions.
Yet he is still alive. Misdirection nothing more nothing less.
What was your methodology to determine that?
Racism.
Aha that’s why telegram is banned and blocked in Russia
Wasn’t it unblocked again soon after?
It was “blocked” for 2 years, though there was a problem accessing it for only a month or so as Telegram developers implemented ways to avoid the ban. In 2 years the government officials decided that Telegram made enough effort to block extremist materials to remove themselves from the embarrassment. Now they probably think “why didn’t we trick Durov to visit us and just arrest him like France did”.
Its not and it wasn’t banned for very long unofficially.
