I have no affiliation I just like helping people make informed decisions.
Telegram is one of the few major platforms that actually deletes your account data, including messages, from their servers when you delete your account. Phone number will be disassociated with the account in a few days and not kept for “2 - 3 years for legal compliance”. Most other apps (not referring to e2ee only apps) just anonymize you and leave all your messages/data sitting on their server.
Yup, changing usernames doesn’t fool them at all. And if deleting the account was because you wanted to get away from people you need to completely disassociate.
There’s no way you can possibly know the telegram DB just doesn’t mark the data as deleted.
The only way to ensure the server doesn’t know the data is to not share it in the first place.
You’re doing disservice to readers by pitching a tool that again is indistinguishable from an FSB honeypot. How willing an FSB honeypot is to hand out data to foreign courts doesn’t make it less of a honeypot.
The only thing you’re supposed to trust is the code that you can verify and run on your device: how is that code protecting your content and metadata.
These are again the minimum requirements on messaging systems for privacyguides recommendations:
The solution then isn’t to have one chat that is E2EE and another that is stored in cleartext.
The solution is to do what Messenger does these days:
E2EE everything AND allow you to create no-multi-device chats. The fact that Facebook beat them to it is strange as hell.
It’s really odd that anyone would come to this space of the internet to defend/promote an app that is well known to be inferior in this same space of the internet. I understand posting information about a particular case that involved Telegram, but it feels like the agenda of ego has overtaken the agenda of good advice a long time ago and that one instance of something can turn into speculation about all instances of something. Why are we here?
At least one person is here to advertise, it seems…
My post was a simple warning to users of Telegram. Then the top telegram critic (look at their old posts) started commenting under my post so I posted additional information. Knowing exactly what information a provider gives can help people make better informed decisions.
Many people stay on Telegram or WhatsApp simply because that’s where their groups and contacts already are. Telling them to all move to insert new app overnight usually doesn’t work.
Yeah and I provided the parts you conveniently left out. There’s such thing as lying by omission. You were trying to make it seem like Telegram is safer than it actually is. Like I showed you in the last post, Telegram doesn’t pass the minimum criteria for private messengers in this community.
Yup, and that a massive problem. Educating people about the problems of Telegram is helping people understand there is a problem, and that will increase the demands in groups to get out of the roach motel.
Yeah imagine that. I develop a secure messaging system, and I advocate and help develop good tools, and I call out bad tools. It’s almost like I passionately care about people and the topic.
You are talking about what Telegram could possibly do I’m talking about what the majority of legal documents are showing. All of these companies can possibly do anything that is not a threat unique to Telegram.
Yes but what does that have to do with information that Telegram gives to law enforcement?
Yes, that is the standard, in case you didn’t know. They can read your messages. That’s bad. If you can’t grasp that, I don’t know what to tell you.
No they can’t. I can check Signal’s source code to check the E2EE is working. I can compile the source to a binary and install and run it. Hiding a backdoor into Signal’s git log is incredibly risky for the project’s reputation.
Everything. Telegram is indistinguishable from a authoritarian, foreign government’s law enforcement honeypot operation. Telegram has data it can hand out that it hasn’t yet been forced to hand out. And you’re trying to imply it’s somehow safe, until that happens.
You can’t create a thread that paints a rosier picture when the entire field has binned Telegram as snake oil a decade ago.
You’ve bent over backwards, enough to impress Sofie Dossi, to defend Telegram across the valid critique, which makes this thread look more like a disinformation op and Telegram’s typical grassroots marketing, than actual, well grounded analysis.
I wouldn’t mind if you had brought what I said yourself to provide proper context, reached the correct conclusion, and when the reader was protected from getting the wrong impression, you had then said what has happened so far with the US courts. But you did not bring any context to the discussion and just wanted really hard to argue Telegram wasn’t handing out metadata, apparently hoping that would convince readers it was safe.
The attacks I described aren’t hypothetical. Snowden explained this 13 years ago https://www.youtube.com/watch?v=UIhS9aB-qgU&t=2983s Nation state actors were compromising computer systems daily even back then. Now they have Mythos that’s dropped 0-day costs to fraction of what they used to be. Systems with lot’s of intelligence are tempting targets for data-hungry intelligence agencies. Telegram doesn’t have nation state powers to stop them. FVEY exchanges information with each other, so even if TG’s Miami server has some legal protections from NSA TAO, it most certainly doesn’t have those from GCHQ hacking teams, and these agencies routinely exchange information.
All of this context is necessary to understand that the court orders do not mean anything. Parallel constructions exist in the West too. The current, Christo-fascist, GOP-led intelligence apparatus may be accessing TG messages long before a case is built. Which is terrifying.
I appreciate your insight to what’s happening in the courts, but that’s not really seeing the big picture, and you not communicating that big picture is leaving out some pretty fucking important information.
Telegram provides message-privacy by policy: it can disclose messages to LE if it wants, but is has a policy to not do that, and court documents prove it doesn’t disclose them.
Oh lol we’re at the point where you’re desperately digging into my post history to try to find some contradiction or something to weaponize. Ok so let me explain.
Content privacy by policy is absolutely fine, if and only if Telegram is upfront about its threat model. If Telegram’s
Front page said “We can read every message you send to us by default” instead of “heavily encrypted”. As cryptographer Matt Green points out here:
However, when we talk about encryption in the context of modern private messaging services, the word typically has a very specific meaning: it refers to the use of default end-to-end encryption to protect users’ message content.
To users, heavily encrypted does not mean “barely-industry standard tier client-server encryption”, but, “nobody but me and my contact can read it”, i.e. E2EE.
E2EE protocol had distinct name so it wouldn’t be the case client-server and end-to-end encryption were both called MTProto, and that wouldn’t cause unnecessary confusion.
FAQ did not have this highly misleading statement
marketing did not place itself as more private than content-private by design (as opposed to policy) messengers like WhatsApp,
I’d be fine with it.
Yes that’s why Telegram’s site famously says it has access to messages and can hand them out by saying
They are implying there is technical mechanisms to protect content, when it’s not technically possible to encrypt data to NAS without having the key present on the CPU’s registers. So they are lying about the key splitting system. Users think there’s more protection for their content than there is actually.
Telegram’s marketing is thus highly misleading, and they don’t even have a threat model so users can assess if it’s secure enough for their needs.
Privacy by policy requires being upfront and honest about your policy.
I went to your profile history because you remind me of the banned user @nihilist
This bias in this blog post starts immediately with the title because Telegram doesn’t refer to itself as an encrypted messaging app and has a easy to read FAQ.
Instead, provide thoughtful insights that improve the conversation
Let’s leave it to the mods to decide if I’ve provided thoughtful insights.
Durov said he came up with the idea of an encrypted messaging app as a way to communicate while he was under pressure in Russia. His younger brother, Nikolai, designed the encryption.
So I thought, it could be a good idea to actually come up with a decently encrypted messaging app
And it looks like you just dismissed the entire critique by one of the most famous cryptographers based that untrue claim. I would appreaciate if you would be intellectually honest and weigh his arguments as a whole instead instead of dismissing it before you make it past the title.
Hello, I believe everyone should be allowed to comment without being focussed with personal attacks.
but besides that. An actual criminal case example showing what information was obtained/exchanged is an interesting topic by itself. We often play out scenarios in our heads but this case in the original topic is an example of the Law Enforcement not managing to get much information.
I’m afraid it’s no longer just scenarios in our heads: we had whistleblowers talking about it on the world stage over decade ago. Please read the thread and consider the big picture.
@maqp I am sure I’m not only speaking for myself in saying this: you’re being entirely, unnecessarily toxic
Ok account that was created yesterday.
First I have to say that the personal attacks against you are completely inappropriate and uncalled for.
Secondly, I think the disagreement in this thread is ultimately down to threat modeling. Specifically, who is a likely adversary.
If Western LEA is your primary threat, then the history of TG not disclosing data in Western criminal cases is relevant. It is a piece of information that can be considered among everything else to make an informed decision on TG usage.
For those of us who do not view Western LEA as a significantly or likely threat in our threat models then this is less relevant. Additionally, for those of us who see the Russian government as a primary adversary then TG looks equivalent to outright spyware.
I’m not worried about U.S. law enforcement or U.S. intelligence agencies. I am very concerned about remote attacks from governments hostile to the U.S. with Russia sharing the top spot with the PRC.
Therefore usage of a Russian origin app for sensitive usage is off the table. But you aren’t me. It could be totally rational for you to make a different decision.
At some point all accounts were created yesterday.
You can make your well reasoned technical points about TG with resorting to being a jerk about it.
