News for hackers. Stuff that matters.
Re:Signal Desktop is corrupting its database by domano on Sunday February 28, 2021 @05:54AM (#26292406)
My guess is that the priorization is different - signal implements everything with a privacy first approach in mind, whereas telegram is not even encrypted by default (even Whatsapp does that AFAIK).
Re:Signal Desktop is corrupting its database by Sebb767 on Sunday February 28, 2021 @07:57AM (#26293078)
> telegram is not even encrypted by default

That's technically not true - it's not end-to-end-encrypted by default.

But yes, it is a design choice - telegram puts usability first - see all their innovations with large groups, stickers etc -, even at the expense of some privacy (i.e. no e2e-chats). But that's why you can have Telegram open on every device you own and probably why they are the second largest chat app by now.

Signal, on the other hand, values privacy first, everything else second. This is why this bug is open for 6 months - they see your chat log as a convenience feature and mostly a burden. In addition, Signal is a smaller team with less funding, so that their UI is not as polished is partially also due to lacking manpower, but its simply not a priority for them.

Re:Signal Desktop is corrupting its database by xvector on Sunday February 28, 2021 @06:40AM (#26292655)
Signal requires a telephone number. This makes the privacy bit is a complete joke, even if your chats are E2EE. Your Signal account is bound to a KYC identity.
Re:Signal Desktop is corrupting its database by abdullahkhalids on Sunday February 28, 2021 @06:53AM (#26292727)
Privacy and anonymity are distinct concepts. Signals provides very high privacy and low anonymity - which is totally acceptable for many people's threat model.

Other apps may provide higher anonymity, but none provide privacy guarantees higher than (or even close to) Signal.

Re:Signal Desktop is corrupting its database by corty on Sunday February 28, 2021 @08:19AM (#26293226)
Privacy and anonymity are distinct, but strongly correlated. Without anonymity, there will always be enough metadata to hang you with. Using Signal as a surveillance-evasion-tool will get you into trouble in a lot of the more unsavoury corners of this planet.

So, being "best" at privacy is meaningless unless you are in the very lucky position that your local jurisdiction fits Signal's threat model. There aren't many in the west even...

Re:Signal Desktop is corrupting its database by blazzy on Sunday February 28, 2021 @01:21PM (#26295625)
Meaningless? I value private communication with my friends and family. I don't exactly need anonymity there. In fact I want the opposite. In the absence of phone numbers I would be adding very explicit metadata on my device to distinguish between my friends.

Signal has taken measures to limit its ability to know who I'm sending and receiving messages from. Though it's still possible by mapping my IP address to me. So yes there is still a centralized metadata problem, but I'm not letting perfect stand in the way of better.

Re:Signal Desktop is corrupting its database by upofadown on Sunday February 28, 2021 @01:35PM (#26295785)
>Without anonymity, there will always be enough metadata to hang you with.

Not in most cases, for most people, most of the time. Everyone knows you communicate with your family, friends and business associates. Very few people communicate out of those groups and even if they do they rarely have to worry about anyone finding out about it.

Re:Signal Desktop is corrupting its database by saurik on Sunday February 28, 2021 @03:47PM (#26296919)
Umm... in fact "most people" communicate outside of those groups, as that's how dating works, and it is a big reason why Snapchat dominates "private communication": people don't want to give their "real phone number" to someone until they trust them. Signal needs to realize its big competition is not WhatsApp, but is Snapchat (particularly given that WhatsApp is pretty damned secure, and so should be seen as an ally versus all of the actually-insecure messaging apps of the world).
Re:Signal Desktop is corrupting its database by jhatemyjob on Monday March 01, 2021 @11:00PM (#26311771)
Idk how giving someone your Snapchat/Instagram is less risky than giving them your number. You can block people from calling/texting you. In fact iOS recently came out with a feature that blocks all incoming calls/texts from unknown numbers. So even if you give somebody your number and they are evil enough to sign you up for a robocall list it would still be fine
Re:Signal Desktop is corrupting its database by symlinkk on Sunday February 28, 2021 @01:19PM (#26295600)
I feel like that’s a handwavey academic answer. In real life situations you always need both privacy and anonymity. Do you think a gay rights activist in the Middle East wants all of their contacts to know their phone number and therefore their personal identity?
Re:Signal Desktop is corrupting its database by appleflaxen on Sunday February 28, 2021 @08:18AM (#26293217)
can anyone commment on the design consideration that the telephone requirement addresses?
Re:Signal Desktop is corrupting its database by xvector on Sunday February 28, 2021 @01:51PM (#26295940)
This is designed to make Signal more popular while solving some fake account issues:

- Using phone numbers means that Signal can constantly check against your contacts to let you know if any of your contacts are now using Signal. As such, using phone numbers encourages use of Signal.

- The usage of phone numbers instead of email or usernames also helps combat temporary/fake account creation abuse, as phone numbers are KYC if you ban VoIP numbers

That said, in the end it is a compromise on privacy and anonymity to increase the popularity and stability of the app.

Re:Signal Desktop is corrupting its database by SignalNotSecure on Sunday February 28, 2021 @09:29AM (#26293610)
Whatsapp E2E is a red herring. It's not protecting you from your perceived threat like you think it is.

https://telegra.ph/Why-WhatsApp-Will-Never-Be-Secure-05-15

Re:Signal Desktop is corrupting its database by domano on Monday March 01, 2021 @07:25AM (#26302091)
Sure i agree, just saying that even WhatsApp ticks that box in some way.
Re:Signal Desktop is corrupting its database by saddlerustle on Sunday February 28, 2021 @06:21AM (#26292560)
WhatsApp is encrypted by default
Re:Signal Desktop is corrupting its database by croes on Sunday February 28, 2021 @07:24AM (#26292888)
That's what he/she wrote.
Re:Signal Desktop is corrupting its database by einpoklum on Sunday February 28, 2021 @06:15AM (#26292524)
That's not it. That is, choosing whether conversations are encrypted by default or not has very little to do with whether the client application has polished UI.
Re:Signal Desktop is corrupting its database by alerighi on Sunday February 28, 2021 @07:00AM (#26292775)
To me Telegram is better even from a privacy point. Sure, if someone breaks into the Telegram servers can read you messages, but to me that isn't the first privacy concern.

I'm more concerned about every day privacy, and Telegram is far better on them. Do you realized that you sent by mistake some data to the wrong people? In Telegram you can delete or edit every messages you want whenever you want.

Don't you want to share your phone number in a group? In Telegram your phone number is hidden by default, meaning that other group members doesn't see you number unless you share it with them.

Also Signal is open source but not really open. In Telegram you can use whatever client you want, in Signal you are forbidden to use anything else than the official client. And the official client is open source, but it depends on proprietary services, like the Google Play services on Android, so you really can't use it on a 100% open source system. You can't even find online the Signal apk by their choice, so the only official way is to install it from the Google Play Store (and how do you verify that the apk that Google provided to you doesn't contain a backdoor?)

Re:Signal Desktop is corrupting its database by growse on Sunday February 28, 2021 @08:10AM (#26293168)
> To me Telegram is better even from a privacy point. Sure, if someone breaks into the Telegram servers can read you messages, but to me that isn't the first privacy concern.

For a lot of people, that's exactly the concern.

> Also Signal is open source but not really open. In Telegram you can use whatever client you want, in Signal you are forbidden to use anything else than the official client.

There's nothing in open source that requires people running services to allow anyone to connect to it however they like. You still have the freedom to inspect, modify, run and distribute both the server and client, so it's to see what part of that in "not really open".

> And the official client is open source, but it depends on proprietary services, like the Google Play services on Android, so you really can't use it on a 100% open source system.

I agree, this is annoying. But it depends on your threat model and it seems that most people don't see Google as the threat to protect against.

> You can't even find online the Signal apk by their choice, so the only official way is to install it from the Google Play Store

https://signal.org/android/apk/

> (and how do you verify that the apk that Google provided to you doesn't contain a backdoor?)

https://signal.org/blog/reproducible-android/

Re:Signal Desktop is corrupting its database by pseudalopex on Sunday February 28, 2021 @01:19PM (#26295609)
The source is open. The system is closed.
Re:Signal Desktop is corrupting its database by Normille on Sunday February 28, 2021 @06:37PM (#26298187)

  >In Telegram you can delete or edit every messages you want whenever you want...
I'm always gobsmacked when people cite this as a positive. I'm a [mostly] happy user of Telegram. But this is the single stupidest 'feature' of the app. The only person who should be able to decide to delete data off my devices is me. No-one else. Full stop.

Remember the furore when Amazon were caught deleting books off people's Kindles? Everyone was rightly outraged by that. Yet so many people think it's a great idea that Telegram allows other people to arbitrarily delete content from your devices.