News for hackers. Stuff that matters.
Re:Why Telegram is insecure (2015) by rzwitserloot on Sunday January 06, 2019 @08:00AM (#18838106)
There were many messengers that ran on mobile phones in the old days (the days where text was pricey in many places on the world so you'd think people'd be extremely motivated to find an alternative to texting!) and none really caught on...

until whatsapp appeared on the scene. The key innovation whatsapp brought, because the app was laughably insecure and probably overly simple (but that simplicity can't have been the reason it won; there were other really simple apps out there)... was making your account ID equal to your phone number.

This gave whatsapp the ability to skip the phase of setting up your 'network'; there'd be no need to ask your friends what their ICQ id is or whatever. Whatsapp would even simply tell you which of your friends had whatsapp installed, immediately, without any consent or setting up your network required.

THAT sold. That simplicity. Yeah, you can (rightfully!) put quite a few question marks on the consent and authentication mechanism I laid out above, but it does lead to an app that is useful and understandable for a great many people (even if it is also not particularly secure or careful about your consent).

I'm sure all these messenger apps (signal, imessage, whatsapp, and telegram) know it and wouldn't dare walk away from phone numbers at this point.

Re:Why Telegram is insecure (2015) by baybal2 on Sunday January 06, 2019 @08:13AM (#18838139)
Believe me or not, there was a J2ME app called Talkonaut that was wildly popular in the middle east, and used phone number direct mapping back in days. There is no chance that Whatsapp never heard of it. I made few localisations for it back in my high school years.

Syria was a very big market for it.

Re:Why Telegram is insecure (2015) by pxeboot on Sunday January 06, 2019 @10:15AM (#18838702)
Telegram supports usernames in addition to phone numbers [1]. iMessage can be used with just an email address.

[1] https://telegram.org/blog/usernames-and-secret-chats-v2

Re:Why Telegram is insecure (2015) by Erlich_Bachman on Sunday January 06, 2019 @04:44PM (#18840922)
It just lets you pick a username in addition to the phone number. The phone number is still required. (Granted it is a plus that you can give your username to someone and they supposedly will not find out your phone number, but still.)
Re:Why Telegram is insecure (2015) by thefounder on Sunday January 06, 2019 @09:00AM (#18838326)
Someone should simply fork signal and deploy an app without phone number, focused on privacy(i.e options to exchange keys in person without any user account or phone number)
Re:Why Telegram is insecure (2015) by pgeorgi on Sunday January 06, 2019 @10:45AM (#18838839)
So you'd have the account setup flow but still on a single server only few can control.

I'd prefer to see people go for a federated system (eg XMPP with OMEMO for E2E crypto) or work on truly decentralized ones (that one is hard, and blockchain is not a trivial solution ;-) ) rather than propose yet another system where somebody else can control who you can talk to (even if they can't see what you're talking about) as a replacement for the previous system with the very same properties, just ran by a different party.

Re:Why Telegram is insecure (2015) by thefounder on Monday January 07, 2019 @08:19AM (#18844859)
At least you would have end to end encryption using a protocol regarded as secure. Descentalization would be the next step.
Re:Why Telegram is insecure (2015) by pgeorgi on Tuesday January 08, 2019 @09:42AM (#18855756)
OMEMO is based on the Signal Protocol, and there's some discussion[0] about the effect of the changes.

So in a way this is Signal Protocol (the one "regarded as secure") with that "next step" of adding decentralization already taken.

[0] https://conversations.im/omemo/audit.pdf

Re:Why Telegram is insecure (2015) by swebs on Sunday January 06, 2019 @01:55PM (#18839873)
Maybe you want Tox

https://tox.chat