You’re skating over the fact the data still sits on the servers from where intelligence agencies hack hack it from en mass.
It is, and Telegram is misleading users about the threat model it is suitable for. They’re not telling their users they have no idea how to protect their servers and that it’s a risk. Tools that lie about their security and threat model are universally considered snake oil.
If Telegram was ubiquitously E2EE, it would matter a lot less when we didn’t have to care about the political leanings of the company.
Yes but I rarely judge people the moment I enter the circles. At least until I know where they’re coming from. I’ve given Telegram the benefit of the doubt in 2013. I’ve watched them get criticized. I’ve watched Durov get screamed about his poor security at HN and watched him retreat to his ivory tower and never make things better. I’ve been doing privacy stuff since 2010. I’ve had dozens of discussions on Reddit about Telegram over the years and I’ve seen how Telegram is pitched. I’ve seen the same arguments over and over. I’ve yet to see one expert recommend them. What I now see is a weird thread with awful lot of leeway given to Telegram all of a sudden even though it’s design goes, again, against the minimum standards expeted for anything to get recommended here, and even though the company misleads its users about its security. I can’t help but note that this looks like an opinion shaping operation.
It’s a bit weird you’re not at all concerned about the much larger damage people pitching dangerous tools are doing. Are you sure your priorities are in order?
The first is that law enforcement agencies are distinct from intelligence agencies. If the NSA has compromised TG servers and fully backdoors them, that does not mean the data on the servers is admissible in a U.S. court of law or that the fact of such access is even known by the FBI. Evidence in a criminal case has to have a clear origin and chain of custody. This means using intelligence information for criminal prosecution requires divulging the access to the information.
If such a huge breach was accomplished by an intelligence agency they would be very unlikely to be ok with it being exposed in order to prosecute a single individual unless they are the second coming of Osama bin Laden. The on going exploitation for counter terrorism/counter intelligence purposes would be too valuable.
The second point is that if your intent is to inform people, then sounding like a jerk goes against that purpose. A valid point put forward in an unpleasant and hostile manner is going to be ignored by a lot of people.
It allows parallel constructions. Basically cheating where you look for clues how to stumble upon other evidence that is admissible in court. That way it won’t be exposed.
And this is again stepping from the issue that if Telegram is an FSB op, they can collect kompromat about users, and extort those people if they rise to positions of power. E.g. if KGB collected evidence on Epstein island, they could control Trump to much further extent.
If you defend a known snake oil product bending over backwards to the extent this guy did given everything we know about Telegram’s “security”, I will question your motives and affiliation. I did not succumb to ad-hominems, or call then names. Maybe it’s a Finnish thing. Torvalds is equally blunt in his delivery and faces criticism for that sometimes. I don’t really care if don’t like my tone, I stand for users and their privacy without the need to be friendly to those who advocate something dangerous. Tone policing is also against the rules here, just so you know. If you have a problem with my arguments against Telegram, let’s focus on the technical aspect.
Well if you can’t consider there’s a reason someone is getting called out sternly and you just get lost in the weeds of tone, I can’t help you. I’ll keep calling Telegram out politely but without holding back on being stern.
Perhaps if Pavel Durov joined us to hear the concerns and improved on his product, we wouldn’t be in this mess. He thinks he’s above us non-oligarch peasants. If you want to point fingers at shit attitude, let’s start from where the buck stops.
They’re all listed in this thread but I’ve listed them e.g. at
If you’re referring to which vulnerabilities aren’t patched on the servers, I wouldn’t know. Not my area of expertise and gray hat hacking to find out is illegal. Neither nation state attackers nor Telegram are telling. The relevant part is, is Telegram blocking the impact those vulnerabilities would have with E2EE, and the answer is effectively no.
i’m more upset about the reasons for the hate rather. I mean, if you don’t like it because of its encryption standards, that’s okay.
But it feels like most people just try to justify it by throwing out random conspiracy theories like how its affiliated with russia etc, despite never having used the app themselves in order to form an opinion.
you right but at the end of the day their argument is that a “trust me bro” approach to privacy isnt sufficient enough, tho i still 100% trust telegram because of their proven record over the years.
