News for hackers. Stuff that matters.
Re:Why Telegram is insecure (2015) by lucb1e on Sunday January 06, 2019 @07:32AM (#18838010)
Any reason you mention Signal and Threema but not Wire? Wire is objectively superior as far as I can tell.

For a quick (probably incomplete) comparison, Wire has proper multi-device support (not sure how Threema does that), open source and cross-platform clients and open source server (Threema does not appear to have a Linux client nor publishes sources as far as I can tell), it's free (allowing everyone to use it, even if you're in a country where it's hard to pay from), it has a proper profit model (unlike Telegram, and to a much lesser extent Signal), and it does not require a phone number.

The two major downsides of Wire is the battery usage due to all clients being Electron, and that few people know about it (hence my prompt to give them a mention). Not major stoppers I'd say...

Re:Why Telegram is insecure (2015) by mfwoods on Sunday January 06, 2019 @07:59AM (#18838101)
> not proxying through your phone which Signal used to do and maybe still does

This is what Whatsapp does. Signal never did and has real multi-device support.

> and the Signal server is closed source

It's not: https://github.com/signalapp/Signal-Server

Re:Why Telegram is insecure (2015) by fro0116 on Sunday January 06, 2019 @12:40PM (#18839442)
> This is what Whatsapp does. Signal never did and has real multi-device support.

This is news to me. Curious then, why is it not possible to use Signal desktop without a phone?

https://support.signal.org/hc/en-us/articles/360008216551-In...

> Can I install Signal Desktop without a mobile device?

> Signal Desktop must link with either Signal Android or Signal iOS to be available for messaging.

Re:Why Telegram is insecure (2015) by xashor on Sunday January 06, 2019 @12:48PM (#18839487)
You must link a client with a mobile device, but after that apparently you can use e.g. the Desktop client without your mobile phone turned on.
Re:Why Telegram is insecure (2015) by amiraliakbari on Sunday January 06, 2019 @08:37AM (#18838232)
Although Signal is not closed-source, they tend to discontinue useful features of their product. For example RedPhone server code has been removed from GitHub after it was discontinued.

Last time I checked, it is not really feasible to setup a standalone Signal instance. Is there any guide to deploying a standalone version of Signal on your own servers or a successful example of it? If not, their approach may be more of "see but not touch" than being a free software. Also decisions like dependency on GCM and discontinuing features to increase development speed make Signal less reliable as a open source project.

Re:Why Telegram is insecure (2015) by mfwoods on Sunday January 06, 2019 @09:06AM (#18838348)
I assume they removed it because they don't want anyone to use old insecure code. The RedPhone server hasn't been used for years now and was replaced with a better implementation.

You're right there's no official support on their server, but there are some unofficial guides on their community forums on how to set it up. Also, GCM is not a hard dependency. On Android it will fall back to using only websockets (and no GCM) when Google Play Services is not installed since some time. What other features have they removed without replacement?

Re:Why Telegram is insecure (2015) by blfr on Sunday January 06, 2019 @08:50AM (#18838282)
I wish Signal did route through the phone and allowed to send regular texts from other devices.
Re:Why Telegram is insecure (2015) by lucb1e on Sunday January 06, 2019 @09:27AM (#18838464)
But that's more of a feature request, or even a completely different product ("I would like to send SMS from my desktop"), than a design decision for a chat application's protocol.
Re:Why Telegram is insecure (2015) by blfr on Sunday January 06, 2019 @11:07AM (#18838962)
Sure it's a feature request but a feature that would be much simpler if the messages were routed through the phone any way.
Re:Why Telegram is insecure (2015) by lucb1e on Sunday January 06, 2019 @01:41PM (#18839785)
Your message history is always synchronised between devices, it doesn't sound like rocket science to make the client detect when a message is meant to be sent as SMS. No need to make the design choice of routing all traffic through the phone for that.
Re:Why Telegram is insecure (2015) by lucb1e on Sunday January 06, 2019 @08:13AM (#18838138)
Corrected, thanks!

Curious though, why does WhatsApp not do it if they use the same protocol anyway? Why bother with the phone as an annoying proxy?

Re:Why Telegram is insecure (2015) by mfwoods on Sunday January 06, 2019 @09:02AM (#18838332)
Only the encryption layer of the protocol is the same, they are not really compatible otherwise.

I assume it's a design trade-off when you have E2EE and don't store any messages on the server. With Signal (and I assume Wire) you have to register each device and each device needs to manage its keys. Every message is send multiple times, once for each device, and each device has an independent message queue on the server. That's why you only get the messages from after you registered the device.

Whatsapp doesn't have to do any of that and can just keep the keys on one device.

Re:Why Telegram is insecure (2015) by wtmt on Sunday January 06, 2019 @07:43AM (#18838056)
I like Wire and use it with some people. It allows signing up with email and supports up to three accounts on a device. But I do find it to be a bit slow, mainly in sending as well as downloading images where it’s painfully obvious.

Telegram is better on many counts and is a very nice app to use. Usability will usually beat other factors when it comes to mass adoption.

Signal is the last on my list (it’s slow and unreliable, setting up an account is a coin toss because the verification process wouldn’t work, can’t move chats to a new device, etc.).

Re:Why Telegram is insecure (2015) by otachack on Sunday January 06, 2019 @08:22AM (#18838173)
I believe you can move chats between devices, they just have to be sourced from Signal and not SMS. SMS/MMS chats are what you may be talking about as immovable from Signal. Those are not shared between your Signal devices for security purposes, I imagine. You can back these up or move them yourself separately. Also, Signal device linking only works between one mobile device and multiple desktop clients. To move between mobile devices it requires a Signal chat backup and restore.
Re:Why Telegram is insecure (2015) by ytjohn on Sunday January 06, 2019 @09:37AM (#18838504)
I have used and promoted Signal before, and I also made the mistake of making it my default sms/mms client. I'm on android. Signal does allow you to make a backup file. Then you have to get that file over to a specific directory on the new phone BEFORE you install signal. But the import rarely works. There are tons of issues on the signal repo, and a lot of them closed with won't fix type answers. I myself am stuck with a history of some signal, but mostly sms messages trapped on one phone because the backup the signal app creates fails halfway through importing on other signal apps. Even if it was reliable, it's way too complicated for most people. People change phones every few years and they expect their data to follow them to the new phone.

There's also https://github.com/xeals/signal-back which actually uses the same code as signal to essentially export a backup. If you check their issues page, you can see that most of the issues are problems reading the backup file. Since this tool is using the same code with just a command line wrapper, it gives us more insight into how unreliable the backup and restore functionality of signal is.

Re:Why Telegram is insecure (2015) by wtmt on Sunday January 06, 2019 @08:28AM (#18838201)
It’s just not possible to move Signal chats from one iOS device to another (on iOS, Signal and SMS are not connected). Signal prohibits backing up of the data to iTunes and to iCloud. So there’s no way to make this work. That’s how it has been, and Signal does this for “security reasons”.
Re:Why Telegram is insecure (2015) by Erlich_Bachman on Sunday January 06, 2019 @07:50AM (#18838073)
Don't forget Wire having a proper browser app which has basically the same functionality as the other apps. You can just use browser for anything, and keep all account settings, make audio/video calls, etc.
Re:Why Telegram is insecure (2015) by kakarot on Sunday January 06, 2019 @08:20AM (#18838165)
Before moving to Electron, Signal was a Chrome app. I'm not sure if it's still available as such, however. A way to generalize between the two from the development side would be nice.
Re:Why Telegram is insecure (2015) by fro0116 on Sunday January 06, 2019 @12:27PM (#18839371)
I keep checking out Wire every once in a while because I _want_ to use it, but as far as I'm concerned, it's not truly multi-device in a useful way because new devices will not be see conversation history: https://support.wire.com/hc/en-us/articles/206998259-Why-can...

I was excited to hear they introduced history backup & restore a while ago, but to my dismay it doesn't work across platforms: https://support.wire.com/hc/en-us/articles/360000775549-How-...

> History can only be restored from a backup of the same platform. You will need a fresh login to restore your history from a backup.

So you can't for instance make a backup of your history on web and restore it on Android, or vice versa. Nor does it support automatically making encrypted backups to cloud storage, which makes the history backup & restore feature rather useless for my purposes.

In addition, just now, when I logged back into my wire account, I see the message "You haven’t used this device for a while. Some messages may not appear here." in place of where my actual messages should have been displayed, which is absolutely maddening, and there doesn't seem to be any interest in addressing the issue: https://github.com/wireapp/wire-desktop/issues/655

TL;DR: Wire is simply unable to handle message history in a sane manner. And that's a shame because I love pretty much every other aspect of Wire, but broken message history is a complete deal breaker as far as I'm concerned.

Re:Why Telegram is insecure (2015) by lucb1e on Sunday January 06, 2019 @03:19PM (#18840390)
Be sure to hit them with at least one support ticket per missing feature. I would really love Wire to succeed (they're doing very well so far, security- and usability-wise) and they do respond to support tickets. So far, for me, nothing ever came of my bug reports (for example, `markdown preformatted text` still sometimes clashes with the url parser), but I expect that if multiple people report the same thing, they'll give it some priority.
Re:Why Telegram is insecure (2015) by walterbell on Sunday January 06, 2019 @11:58AM (#18839219)
Wire on iOS is a native app.
Re:Why Telegram is insecure (2015) by lucb1e on Sunday January 06, 2019 @03:22PM (#18840409)
Still eats battery on my work phone, but this is my first iPhone and it's pretty much the only installed app so I can't say if iPhones just have terrible battery management or if that's Wire. The iOS' battery overview is about as good as Apple Maps on first launch, so that doesn't help me much.