Im using Telegram to interact with my lawyer. I need two things:
- Phone calls and chat
- Sharing encrypted files
Using Telegram with the “secret chat” feature is a good idea? From what I can tell, it does avoid that your stuff is hosted on Telegram servers, things stay encrypted p2p. Im not sure if chats are encrypted by default and Telegram cannot access details even if it goes into the cloud through the default “non-secret chat” mode, in any case, if we were to use “secret chat”, I assume this would be better.
As far as the audio call, does it change if it’s made within a “secret chat” or is it the same? Are audio calls hosted anywhere or they are always sent p2p encrypted?
In terms of sharing encrypted compressed files, I was thinking of hosting them somewhere with a free plan. What pro-privacy services exist where I could hold this anonymously? I just need a small amount for documents so any free plans should do.
What im trying to avoid is to have conversations which would include my personal details shared with my lawyer as well as any financial records hosted in some dodgy server somewhere, even if encrypted. So if I enable “secret chat” in Telegram it all would stay within our devices and we are both reasonably tech savvy to keep them safe, and if I use a privacy-friendly hosting service I would have control of the file and I would delete them when he downloads it, I would also be diversifying by not sharing files within the app coupled with the decryption password.
TL;DR: Trying to improve how I communicate with my lawyer. Im thinking Telegram in “secret chat” mode for chats and phone calls, and I would use some privacy-friendly file sharing site to share any documents which would be uploaded encrypted by myself. I know you cannot be perfect but this should be good enough, however im asking about your opinion here specially in terms of Telegram alternative if you think it’s worth it for the chats and phone calls, as well as a file-sharing site to temporarily host encrypted files that I would delete after he saves them, in order to have more control of the files. This would also avoid sharing the encrypted files and the decryption password within the same app.
If you can’t use Signal (or SimpleX or similar), then that’s probably the best you can get.
https://www.privacyguides.org/en/file-sharing/
Yeah I could use Signal. So Signal is downloaded from the Google Store? Just to confirm im downloading the right thing, is it “Signal” from “Signal Foundation”? I see there are other Signal apps.
And could you explain in which ways does it improve Telegram in “secret chat” mode? Specially for the phone call and file sharing too.
If we end up using Telegram in “secret chat” mode, are audio calls also p2p and not saved anywhere? I mean, they are just streamed during the call and not stored anywhere and encrypted on the fly? If you do a phone call in “non-secret chat” mode what happens?
As far as SimpleX, I reckon it does not have phone calls.
Btw, I’ve read people complaining about Signal and SimpleX not being as sharp as Telegram, like problems during calls or chats that don’t show up.
If you’re concerned about getting a scam app, you can go to Signal >> Download Signal to get the official links.
One thing that Signal is built to be E2EE completely, not having it tacked on as a separate feature. There are also potential issues with metadata collection (a record of when and how much you talk to your lawyer) which Signal does not collect according to the subpoenas they’ve received (SimpleX is more metadata-resistant by its architecture though).
It supports calls.
I think I may go with Signal. SimpleX sounds great and it will be a great app if they keep working on it, but I don’t know a single person that uses it. My lawyer is familiar with Signal, and I don’t want to involve him into learning a new software, this may add additional risks due a mistake. I think Signal should do.
Have you tested Signal for phone calls? is it good quality with no lag and so on? And chat is also reliable?
As far privacy, the calls are encrypted end to end and streamed on the fly so there is no chance that they would be stored in the devices right? (unless someone recorded it I guess, but you are supposed to trust your lawyer, plus I believe Signal does put some protections in place to avoid recording software to do it so you would need to use some secondary phone to record and take screenshots)
Also, in terms of file sharing, do you reckon is it reasonable to share files within Signal? Again, I would encrypt the files myself, but what I mean is, you would be sharing the file there as well as the decryption password. Should I host the file somewhere else and share the password there, so everything is not within the same place?
If I end up using Signal to upload the file and delete the file from the conversation (I assume it’s sent within the conversation like an attachment, link or something) is it permanently deleted from the other end?
How does Signal deal with anything that it stores locally? I mean, if you delete chats and files, there are any remains that someone could use to access to them if they could get access physically to the device? Where are such files located at if you use an Android phone?
You could use TresoritSend to send your lawyer the files. They will be encrypted, and you can set a password, or limit how many times they can open them and/or how many days the link is available for.
I have tried your suggestion. Im not sure about it. How do you permanently delete files? Looks like it just creates a link that is send to your email, which creates it’s own problem as you now have to make sure no relevant data is seen there. I would prefer more control on the files, because I don’t think I can choose when to delete files from what im seeing here.
About Signal, it’s a bit annoying that you cannot force-delete the other person’s messages. You can enable the timer, but the other person can disable the timer at any times, which is kind of dumb. I want total control which means deleting other people’s messages too, as you can do on Telegram’s secret-chat, even tho it’s a bit buggy, because sometimes you can still see the message on the chat’s preview. Both also unnecessarily add “the timer has been changed” messages. The host of the chat should have control over these things, the other party just agrees to them. And both should be able to delete each other’s messages for increased protection.
As mentioned, you can limit how many times the link is accessed. You can send the link, and then tell them they only have 1 access to the files before it’s revoked.
Its E2EE, so only the person who receives the link can access the files, they can only access a certain number of times that you set, or for a certain number of days that you set, and you can also set a password that you can supply via a separate secure communication method.