But that's literally the entire point of this article. That is, in this day and age, when people talk about "secure messaging apps" they are usually implying end-to-end encryption, which Telegram most certainly is not for the vast majority of usages.

Also, iMessage is very secure...but then all your stuff is backed up on iCloud servers unless you specifically disable it. That includes all your iCloud encryption keys and plaintext messages.

Worse, iPhones immediately start backing up to iCloud when set up for a new user - the only way to keep your network passwords and all manner of other stuff from hitting iCloud servers is to set the phone up with no network connection or even a SIM card installed.

Did I mention there's no longer a SIM slot, so you can't even control that?

And that iPhones by default if they detect a 'weak' wifi network will switch to cellular, so you can't connect the phone to a sandboxed wifi network?

You shouldn't have to put your phone in a faraday cage to keep it from uploading plaintext versions of your private communications and network passwords.

Well summed-up. Its crazy how efficient theese things are at working together to strip users of any agency or control, across many different domains.

That is the correct default. Every day users are far more likely to accidentally lose their data than to run into government snooping.

It might be the correct default, but it doesn't make it secure (makes it insecure actually).

If that is the correct default then why Telegram is blamed for having non-E2E chats by default? Maybe they also care about users who can accidentally lose their conversations. When Apple does it, it is good, but when Telegram or TikTok do the same, it is bad and not secure.

Because Apple is not in the business of hosting public discussion forums.

There is no crime in implementing or not of different encryption schemes.

because telegram and it’s users heavily insinuate it’s comparable to Signal rather than Tiktok.

right on their front page in giant font they declare “private” and “secure” when they’re neither. it’s telegram’s own fault they receive this criticism repeatedly—and they strangely constantly complain every time they’re publicly spanked and taken to task. theyre heavily insinuating (i call it it lying) to their users and then over and over crying because they get called out.

if they don’t want to be called out then they should quit insinuating those things, it’s dangerous af. they know they’re lying though, obviously they won’t stop. but omg i wish their users would run fast and run far—it’s like watching an abused person who keeps going back to their abusive partner “oh they mean well”… pffft, no, they really dont.

> That includes all your iCloud encryption keys and plaintext messages.

Are these stored encrypted or in the clear? If the latter, please cite your source.

They are stored encrypted but whether Apple has the key depends on whether you've turned on "Advanced Data Protection" (aka "I don't expect Apple to bail me out when I lose access to all my devices"). The table in this support article details the treatment of various data categories under the two options:

https://support.apple.com/en-us/102651

The default for many categories is that your keys are in iCloud so Apple can recover them for you. With Advanced turned on, the keys are only on your personal devices. A few categories, like the keychain, are always only on your devices.

Specifically, see Note 3: "If you use both iCloud Backup and Messages in iCloud, your backup includes a copy of the Messages in iCloud encryption key to help you recover your data." Under normal protection, Apple has the key to your backups, but with Advanced they don't.

And even "advanced" protection is not advanced enough to protect your calendar and contact list from the government (under silly excuse that Apple uses standard protocols for those data).

Luckily, microwave ovens make easy Faraday cages.

15 seconds on low, then 120 seconds on high.

Oh, you meant... oh.

iCLoud can be disabled by MDM profile installed by Apple Configurator at setup.

Can I enroll my personal iPhone in MDM myself? And if I can have MDM with just my personal phone, do I need to buy some kind of subscription for it from Apple? Or pay some third-party?

I thought MDM was only for enterprise businesses and schools and universities, but I may very well be mistaken about that.

MDM profiles are just XML files. They can be created with any text editor and distributed to the phone by email or web server. Apple provides the free "Apple Configurator" app in the MacOS app store. There are also websites and/or OSS tools to generate profiles, e.g. https://github.com/ProfileCreator/ProfileCreator.

Apple supplies a free application for managing MDM.

https://support.apple.com/guide/apple-configurator-mac/welco...

^^^ Highly recommend this. If you are technical enough, a family managed Apple Configuration is more than enough to protect for most situations and from most threat actors.

If you're threat actor has the resource to break that, get a CC or a good lawyer on retainer I guess.

This saved me one time when I was gifted an Apple TV without a remote.

No way to add a WiFi profile, thus no way to use an iPhone as a remote. No ethernet available either.

Configured a WiFi profile, uploaded to the Apple TV and could finalize the setup.

It’s quite a powerful too for initial setup.

Looks like an easy task, even your granny can do it.

It does require a few clicks and passcode entry, https://support.apple.com/en-us/102400

Why do you need a Mac and an additional software for this? This is clearly made for corporate users and not for ordinary people.

Mac is not needed, https://news.ycombinator.com/item?id=41351559

After an MDM profile is created by someone technical, it can be emailed to the non-technical user and installed with a few clicks and passcode confirmation.

Apple devices are also always gossiping about which devices are where

Which is one of the best features. I wouldn’t mind having an option to disable it, but then you also don’t get the advantage of others’ phones finding your device.

laf every image you take on an iphone is sent to apple server regardless of it being in icloud or not.

iMessage only encrypted messages in RSA 1280, why do you think it is very secure?..

Many companies in the industry mislead users about encryption and just try to use it as a buzzword to attract customers. Take Apple, as example. Apple cloud backups are not E2E encrypted by default (like Telegram chats), and even if you opt into E2E encryption, contact list and calendar won't be E2E encrypted anyway [1].

Yet, Apple tries to create an image that iPhone is a "secure" device, but if you use iCloud, they can give your contact list to government any time they want.

Apple by default doesn't use E2E for cloud backups, and Telegram doesn't use E2E for chats by default. So Telegram has comparable level of security to that of the leaders of the industry.

[1] https://support.apple.com/en-us/102651

> It's the only messaging app where messages are stored on the cloud.

Besides Slack and Discord and Teams and whatever the heck Google has these days and iMessage and...

I think you mean it's the only messaging app that purports to have a focus on security where messages are stored in the cloud, which is true, but also sus. There's a reason why none of the others are doing it that way, and Telegram isn't really claiming to have solved a technical hurdle that the E2E apps didn't, it's just claiming that you can trust them more than you can trust the major messaging apps.

Maybe you can and maybe you can't, the point is that you can't know that they're actually a safer choice than any of the other cloud providers.

Matrix also keeps your message on the server. Except you can run your own server. And the messages are end to end encrypted. And you can keep a proper backup of the keys.

Granted it can be clunky at times, but the properties are there and decentralised end to end encrypted messaging is quite and incredible thing. (Yes, Matrix nerds, it's not messaging per se it's really state replication, I know :))

As you alluded to, Matrix has really horrible UX. Telegram is meant to be easy for the many to use: finding content in chats or even globally across public channels for example is intuitive and snappy because their server does the heavy lifting. That's a huge sell for many, myself included.

Well, ux aside, he disproves that you can't have synced messages with e2ee

Doesn’t Matrix replicate all chat metadata to any linked federated servers?

My Matrix messages are, I presume, not encrypted, because every device I have prompts me to sign this device's keys with the keys of another device (which doesn't exist) and the option to reset the encryption keys and lose access to old messages doesn't work either (it just crashes Element).

You can enable it on a per chat basis.

All PM rooms are E2EE by default.

Depends on the client.

Ah right. Yeah I keep forgetting that there are other clients beside the ones by Element because none which I initially tried were as fully featured as the Element ones.

>it's just claiming that you can trust them more than you can trust the major messaging apps.

All the cool kids in the block eliminated the need to trust the provider decades ago. PGP: 33 years ago, OTR 20 years ago, Signal 14 years ago.

You have to trust the provider with signal; they are fiercely anti-third party clients, control the network and have released version of the code that are not tracked by sources- in extreme cases we’re aware of years old code being in there (mobile coin for example).

Signal evangelicalism needs to halt, you mean the Whisper protocol.

No serious project wants to collaborate with a bunch of hobbyist projects who may or may not keep their code up-to-date. Years ago, the Matrix ecosystem was a prime example of even basic features like end-to-end encryption being in many cases missing.

Having a single client gives you insane boost to security agility over decentralized alternatives.

Feel free to strive towards functional decentralized ecosystem that feels as good to use, then switching will be a no-brainer.

I don't completely agree. I am perfectly fine with there being multiple options for various use cases. Signal has its place. So does Telegram for that matter. Even Whatsapp..

That said, what I would love to see ( and likely won't at this point ) is the world where pidgin could exist again, because everyone is using some form of sensible standards that could be used.. right now it is mostly proprietary secret mess of things.

And don't get me started on convincing anyone in group to moving from one ecosystem to another. Fuck, I just want email for chat that is not owned by one org.. Is it really so much to ask ( it is rhetorical, I know the hurdles are there and only some deal with human nature )?

Like someone once said, "Pidgin is a flock of zero-days flying in formation". It had serious issues with leaking messages to other applications via dbus, I know this because I used that feature to stab in the earliest version of my work TFC.

You always forgot to enable OTR even if it was right there in front of you. You couldn't use it cross-device, and its 1536-bit DH got outdated without fixes. There's stuff like lurch that offer OMEMO but still, I really prefer that I don't have to think about key management anymore. With Signal things just work, and it's magical.

You have to trust the platform with the metadata, but the actual E2E encryption of the messages is something you can personally verify if you cared to.

You can’t know what’s running on your client. Reproducible builds aren’t reproducible, open source was not followed (there was code in the client that was not present in the repos).

So, yes, trust is needed.

I think a high definition photo taken on a recent phone takes up an awful lot more device memory than a "big number of chats"

Yeah, but Whatsapp chats tend to be full of those... and videos.

Whatsapp automatically resizes them (in standard settings)

But it still gets big.

(On Android), if you don't care about the (old) WhatsApp media, just delete it from your phone. It's all just loose files in `/storage/android/data/com.whatsapp` (or thereabouts). The text content of the chats will remain available.

This is such a misrepresentation. Telegram could at-will feed the cloud-2FA password to password hashing function like Argon2 to derive a client-side encryption key. Everything could be backed up to the cloud in encrypted state only you can access. Do they do that? No.

So it's not as much as trade-off, as it is half-assed security design.

Telegram currently has very intuitive and snappy search, even in very active groups with years of content. That's because the heavy lifting is done by the server. Think that'd still be possible if there was no way for the server to process the data?

PCs and phones been fast enough to have snappy search on text data for years now.

Is "grep" not snappy enough for you?

Not at all. Try searching 500/1000 sources (maximum number of conversations any free/premium user can be part of), each with potentially millions of messages, and providing the results in under a second.

AFAIK telegram dont have any super-advanced search features neither it instantly return you results for all these years. Also if you search less common terms it's usually take longer than less than second.

And if you just run client on device without a lot of this history cached search wouldn't be anywhere as fast as you expect. So I pretty sure there no server-side magic there, but instead very good UX.

Also I can tell for certain that with right index grepping tons of JSONs can be very effective on any modern devices.

> Also I can tell for certain that with right index grepping tons of JSONs can be very effective on any modern devices.

But to run local search you need to download the conversations to device first which might require lot of (expensive) traffic.

Can't say there aren't others who've used my search terms, but some things I search for are pretty unique. And I do a lot of searching. And search speed is consistently sub-second. There's no trickery seeing years-old results from VERY heavily used chats appear instantly. There's heavy optimization happening for search, and I'm very certain default e2ee would destroy that experience. Unless you can point to 1 e2ee service working at that scale with comparable UX. I won't even touch on the local aspect as the amount of storage needed to just store the data is waaaay beyond anything I'm even interested in owning, much less the compute to make it so accessible.

Grep is inefficient search engine, because it needs to scan through whole content (and Telegram uses search indexes). Also, grep cannot deal with words forms and inflections (you type "foot" and you also want to find "feet"). Inflections are not very important in English, but you need to deal with them in other languages where the word can have many forms.

I'm not trying to claim Telegram uses grep or whatever. My point is even very active chats on telegram generate somewhat small amount of text data and I dont believe that searching through it require massive complex search engine with super-fast backend.

I basically participate in hundreds of chats and message history doesn't take 10 of GBs. And I also know that search in history of such chats isn't so snappy on older Android phone.

Yeah, try searching anything older than a year, the amazing snappy search grinds to halt. Meanwhile I'm storing years worth of stuff on Signal with no issues, and it searches ridiculously fast offline with no seconds long pause for buffering.

So interesting. I just did a search for mentions of someone I know in multiple Telegram groups and channels, and got all the results, going back 5 years, instantly. And these groups and channels have millions of messages. All media is also perpetually available (unless deliberately deleted), and take a couple seconds to load. I don't see any other platform having that kind of convenience.

Yeah Telegram search is not in a state where anyone should be proud of it.

I'll have you know they had maths PhDs design their security, sir. Eight of them!

Yeah, it's a bit of a joke.

Yeah, put a geometrician* to do the job of a cryptographer. This is what you get.

* I'm being serious, Nikolai Durov's PhD dissertation title was "New Approach to Arakelov Geometry"

https://bonndoc.ulb.uni-bonn.de/xmlui/handle/20.500.11811/31...

https://arxiv.org/pdf/0704.2030

Advanced math is actually more difficult (in my opinion) than programming languages.

Cryptography is nightmare magic math that cares about the color of the pencil you write it with.

It's not enough you know how to design a cipher that is actually secure, you need to know how to implement it so that the calculator you run it on consumes exactly the right amount of time, and in some cases power, per operation.

Then you need to know how to use the primitives together, their modes of operation, and then you get to business, designing protocols. And 10% of your code is calling the libraries that handle all that stuff above, 90% is key management.

There's a good amount of misuse resistant libraries available, but Nikolai was too proud to not look into how the experts do this, and he failed even with trivial stuff: He went with SHA-1 instead of SHA-256. He didn't implement proper fingerprints. His protocol wasn't IND-CCA secure. He went with weird AES-IGE instead of AES-GCM which is best practice. He used the weird nonces with the FF-DH, instead of going with more robust stuff like x25519.

One thing you learn early in academia, is that expertise is very narrow. I bet he knows a lot about geometry. Maybe even quite a bit about math in general. But it's clear he doesn't know enough to design cryptographic protocols. The cobbler should have stuck to his last.

EDIT, to add, the real work with cryptographic protocols starts with designing everyday things that seem easy on the paper, with cryptographic assurance. Take group management that the server isn't controlling.

For Telegram it's a few boolean flags for admin status and then it's down to writing the code that removes the user from the group and prevents them from fetching group's messages.

For Signal it's a 58 page whitepaper on the design of how that is done properly https://eprint.iacr.org/2019/1416.pdf

This is ultimately what separates the good from the bad, figuring out how to accomplish things with cryptography that first seem almost impossible to do.

Sure, but cryptography is its own subfield of advanced math (and also a bunch of more CS and UX based implementation challenges like avoiding side channels).

Apple could also use E2E for their cloud backups by default, but they don't (and if you enable E2E, it doesn't apply to contact list and calendar backup anyway). Why do you demand more from Telegram than from Apple or Google?

You never know what may suddenly become illegal.

> It's the only messaging app where messages are stored on the cloud.

Instagram. FB Messenger. Skype. LINE. KakaoTalk. Discord. Slack. Teams. iMessage.

Google talk/Hangouts/Google Chat/Duo/Allo/Meet/another Meet/etc. Counts as one

>It's the only messaging app where messages are stored on the cloud.

So do all the others with the exception of something like IRC.

Not really. WhatsApp only keep them temporarily (and E2EE!) until they're delivered to each device. Signal too. Telegram keeps everything for all time. Which is kinda handy too I have to say.

Of course you can send your backup to Google for WhatsApp and signal but that's optional. You can keep it locally too. And it's encrypted too. With WhatsApp you can even choose to keep the key locally only.

WhatsApp? The closed source app that AFAIK has never been externally audited, owned by one of the most privacy-disrespecting corporations in the world? You say I can trust it wholeheartedly as long as I don't upload backups to the cloud?

The founder departing Meta on very bad terms is quite a signal to me:

https://www.forbes.com/sites/parmyolson/2018/09/26/exclusive...

I 100% trust they implement the signal protocol as they claim. I am also similarly sure that they ALSO have a sidechannel for everything.

> It's the only messaging app where messages are stored on the cloud

Unreal. Please share how you came to this world view.

> Well of course, but this is a feature of Telegram. It's the only messaging app where messages are stored on the cloud.

Wrong, Matrix does it too, but fully e2ee.

> and allows you to access your chats from any device.

No it doesn't, because it is possible withh e2ee as well