News for hackers. Stuff that matters.
Re:Why Telegram is insecure (2015) by tialaramex on Sunday January 06, 2019 @11:19AM (#18839017)
In Telegram if I can convince the phone network that I have your phone number, Telegram will deliver all your Telegram messages (including historical ones) to me and I can read them. This is completely transparent to the other participants.

In Signal the remote Signal server will not deliver the messages, since anyway I can't decrypt them (there are no unencrypted messages in Signal) and it never keeps any that it has successfully delivered.

Now, if I convince the network that I have your phone number, how should your friends determine that I'm not you?

In Signal (and WhatsApp) this is designed into the UI. If you aren't sure if this is who you think it is, you can meet in person and compare numbers or QR codes to check there are no shenanigans going on. Many casual users never do this, but if something seems "off" you can verify.

But in Telegram there's no option like that.

Re:Why Telegram is insecure (2015) by nithinm on Sunday January 06, 2019 @12:40PM (#18839440)
In telegram also you can see an image and text derived from the secret key for comparison. Get your facts right.
Re:Why Telegram is insecure (2015) by tialaramex on Sunday January 06, 2019 @11:02PM (#18842682)
Yeah this doesn't do the same thing at all.

In Signal you have an identity that's verifiable, and that's what their verify step does. The keys constantly ratchet, and you can even both reset them from scratch, identity verification isn't affected.

In Telegram you set up a separate encrypted chat and the secret keys for it can be visualised. But if you create a different chat any steps you took to verify the identity don't carry over.

Re:Why Telegram is insecure (2015) by dijit on Sunday January 06, 2019 @11:38AM (#18839092)
>This is completely transparent to the other participants

nitpick, but I think you mean 'opaque', as in, they can't see it.