The perceived advantage of Signal over Telegram is LITERALLY not having an option for a cloud-synced chat and ONLY having end to end encrypted chats. That's all.
You give up of usability to get that advantage. Explain to your mom why she has to give up Telegram to get basically the same functionality as Telegram secret chats.
Signals crypto is used by Facebook and was sponsored by the US Govt. Before you believe "OMG Telegram crypto is bad!" FUD, do 15 minutes of research.
Signal doesn't even have a web app. They have a desktop app that works great and that I use every day, all day long for all kinds of communication. On my desktop and laptop.
The problem is entirely that its cryptography was sketchy and just plain weird to begin with. It wasn't wrong, per se, but raised some eyebrows. And then some of the questionable choices were silently fixed removing the ability to MITM, etc, but with no real notice.
It's not FUD.
Because there isn't anything to meaningfully attack. Chats and chat backups are not encrypted by default.
Shouldn't we have the same standard for all claims?
> Shouldn't we have the same standard for all claims?
Huh? Telegram's protocol has been criticized by cryptographers for making specific "odd" cryptographic choices (see See https://crypto.stackexchange.com/questions/31418/signal-vs-t...). It's not FUD to bring that up.
However, it is FUD to imply something concrete based for vague, indirect reasons.
We either consider the funding of both and decide how the funding COULD ultimately impact the product, or we could look at the source code of the applications and the cryptographic theory supporting them and talk about that. If crypto experts aren't finding holes in Signal's protocols [1], I don't think random people on the internet yelling "bUt It WaS fUnDeD bY ..." will make it less secure.
>Signals crypto is used by Facebook and was sponsored by the US Govt
Funny that you're talking about FUD.
OWS was financed by Open Technology Fund, to the tune of almost $3M, during the years 2013-2016. See here: https://www.opentech.fund/results/supported-projects/open-wh...
What is Open Technology Fund? It is a program of Radio Free Asia, which run by US Agency for Global Media, funded by US Congress.
I recognize that you'd basically just be taking my word for it, but literally all they did was take an application from us, approve it after doing their diligence, and paying Cure53 for an assessment. There was no other involvement or, as you're implying, interference.
Just my experience, but I'm publishing this because the fud breaks my heart. OTF does good work.
But that doesn't really matter. Even by doing that. these two are associated. Imagine, if there was a non-profit, that took money from some Kremlin or Fobidden City development program, using exactly the same procedure. Would be that non-profit trustworthy going forward, given their association?
So this one is the same, just with red and white stripes. Definitely not FUD, they did take money from US Gov agency.
Kinda depends. If the money was authorized by a parliamentary body (with clear legal text around who's receiving funding, what the conditions are, etc), I wouldn't be so worried. If it was authorized by an executive as a disbursement from a random pot, I'd be more worried about strings.
Ergo my comfort with US congressional funding v. a DARPA grant or In-Q-Tel investment.
As long as the product is proprietary, no.
But the simple fact is that for most people the security profile of Telegram is good enough and its UI is miles ahead of Signal.
I've already complained about that in the past but the fact that the desktop client still won't let me set the spellchecking language is baffling to me. It's an application that's meant mainly for exchanging text, and it won't let me configure the spellchecking, and let's not even talk about formatting options.
It amused me when in the announcement they said that the reason for testing the payments in the UK was that they were English speaking. You can tell that this is an application developed my monolinguals...
I'd appreciate however if everyone who has been saying ugly things about the alternatives would take a step back now and consider if there is more to security than E2E-encryption.
E2E-encryption is a seriously nice and useful property of a messaging system, but in the long run it is only one of many important details, and while E2E-encryption is always a good thing for end users as far as I can see other useful properties are often directly at odds with each other:
- incentives and funding. Free to give everyone the ability to use it or paid to align incentives?
- anonymity or verified identies? Both have significant advantages.
- repudiation or non repudiation? Depends on if you agreed on a contract or discussed something that the new regime doesn't approve of.
- backups? or ephemeral? Again, depends on if you are sharing family photos in a group or or sharing something that should stay between you and the recipient
Edit to add: As for solutions I think healthy competition is one of the best ways to ensure every messaging system tries to be tje best they can be.
I just recently got a new phone, and used the new feature to do this (uses wi-fi direct) and I have to say it seemed like it would be easy enough for non-techy users to use.
It's 2021, I don't want to be platform locked and none of the other popular messaging apps have that issue.
I'm not sure why you are being downvoted. Whatsapp backups are still platform locked to this day. But that may change soon.
https://www.businessinsider.in/tech/apps/news/whatsapp-may-s...
Also video calls still don't synchronize orientation. It's very hard not to stoop down to use more vulgar language to express my feelings about this.
This is insanely annoying in real life.
Unfortunately day-to-day my issue is more with syncing the desktop to the phone client's history and as far as I know it still won't let me do that.
An other super convenient feature of Whatsapp and Telegram is that they offer a pure web interface with basic functionality which is super convenient if you're in a pinch and don't want to/can't install the standalone desktop application.
How many "benefit of the doubt" cards do they have left by now?
Technological: * First Oblivious RAM implementation, "fog", so that transacting parties cannot be revealed * Their Rust codebase is really nice * Instant transfers with little computing power (CO2 emissions)
Ethical: * Moxie and Josh Goldbard hold no MOB, along with the employees. The Mobilecoin foundation has some awesome partners, e.g. the Long Now Foundation. * Mining is not ethical, it pollutes the planet and is just bad. The only alternative is a "pre-mine" given to an independent org, ie Mobilecoin Foundation
Legal: * The US's laws are not clear on what is allowable with privacy coins, so Mobilecoin has played it conservatively by saying US residents can't own the coins.
In summary, the critiques of Mobilecoin (in any of its incarnations, foundation, moxie, etc.) are assuming the agents involved have a financial interest in MOB being expensive -- I contend that is not the case. Please show your evidence.
PS. I am assuming good faith and honesty in statements, eg "Marlinspike notes, however, that neither he nor Signal own any MobileCoins." https://www.wired.com/story/signal-mobilecoin-payments-messa...
PPS. Some direct responses:
>Let's assume that they integrated with Bitcoin or Litecoin or some "mainstream" CC, would it still be a good idea?
No, not private. Also slow. Also pollutes planet. Monero is close on the privacy front, but takes 3 minutes to send (very stressful). It's possible a coin with the proper attributes could be made on stellar, but that raises questions towards ownership of Lumens (and pumping them) and their stellar reimplementation in Rust is likely more secure.
>Niche coin
nit: MOB has a top 15 market cap with 250m coins in distribution. Though I would hesitate to compare to other cryptocurrencies which are almost entirely scammy, polluting garbage.
Right, the foundation sells the premined crypto-currency at a pumped up price. The foundation pays Goldbard and Moxie for their work. Employees are paid from the VC. No one connected has to hold any of it, nor will they want to after the dump.
Could you provide a concrete link please? There's a bewildering array of officials looking websites with zero information. And a widely shared white paper (among others linked from Wikipedia) that Josh claims isn't the whitepaper he originally wrote. It's hard to know what's what.
It works (FSVO "works") for small levels of transaction, but does not scale to "a substantial fraction of humanity uses it for payment" (low-end, imagine 2.5 billion people trying to make on average 3 economic transactions per day, you'd need to be able to sustain about 80k transactions per second; now note that I low-balled bot the number of economic transactions AND the global population).
Moxie, this is seriously disappointing.
I'm not sure why you find Monero's confirmation any more stressful than instant-like blockchains, most wallets will show pending transactions as soon as they enter the mempool.
I am sure that Signal could implement the same peer-to-peer sync scheme with full end-to-end encryption without any secrecy compromises.
There was a tiny period, somewhere in 2006, when many services were XMPP, maybe even federated, but due to the lack of good clients - compared to skype -, it never manifested as good as it should have.
There are now many nice XMPP clients, but the big players now all moved into proprietary territory.
Unfortunately you only eliminate it by being your own server owner _and_ your recipient being their own server owner. Take a look at email: I might not want to use e2ee because I self-host, but the second I send an email to a friend hosted on gmail, Google gets all the content.
I think federation does have its place (for different reasons) but it unfortunately isn't enough for privacy.
What if I don't have and don't want my own server?
The nice thing about client-side/end-to-end security is that the service provider matters less.
Also, $2/month is $2 more than many people would be willing to pay for private messaging, and I can't message people on a network they're not on, no matter how much I pay.
And if you're privacy is worth less than $2/month, just use Telegram. It works way better than these messenges obsessed with privacy, precisely because it does not have encryption for most messages
That looks a lot like a server hosted by somebody else in a data center.
It's also way more hassle than almost all of my contacts would be willing to go through, and if only I self-host but they don't, it'll be Gmail all over. (Almost all emails go through Gmail because that's what at least one of the parties in an exchange is likely using.)
Point-to-point encryption is not enough for messaging in today's network topology.
> just use Telegram
No thanks, I'll continue using one actually spending some effort on not being able to read the messages their users send.
Fortunately most people in my country do. Ironically it's only a couple of people in my circle of friends worried about the privacy of said messenger switching to Telegram "because it's encrypted"...
What's preventing the client from dumping all the messages to a single file, encrypt it with a public key of the other running instance of Signal logged in to the same account, and send it, so that your other device can decrypt the file and import all the messages?
It goes beyond the usual issue with cryptocurrencies. Let's assume that they integrated with Bitcoin or Litecoin or some "mainstream" CC, would it still be a good idea? You can already send wallet addresses over signal if you care to do it.
I'm willing to give the Signal devs the benefit of the doubt and assume that they meant well and aren't actively trying to benefit from the move (even though I'm not completely dismissing this possibility) but at the very least it's just showcases a very strange way to lead the project and prioritize issues. I can think of a dozen things out of the top that would do more to drive Signal adoption than integrating with some "literally what?" cryptocoin.
This is going to drive the adoption of this niche cryptocoin, it's not going to do anything at all for Signal.