maqp
No they're all routed through the servers. It's only the calls that can be sent P2P and you have to opt in for that. The issue is that leaks your IP address to the contact who may not be trustworthy, so it's not used by default.
I'll just say that the main issue with SimpleX is that it lies in its marketing material that it has no identifiers. What they really mean is that they're not adding new identifiers in the app, it doesn't mean they're actively removing existing identifiers, that is, your IP address. The client currently routes messages through two hosting providers which reduces incidental metadata collection. But it does fuck all if the hosting providers collaborate unbeknownst to the users.
That being said, SimpleX has really good support for Tor, in that if you just install tor package to Linux over apt or whatever, and configure like two items in the app's proxy settings, the client will automatically switch to SimpleX Onion Service servers instead of routing to clearnet servers through exit nodes. I can respect that.
What I can't respect is the threat model being treated like a fine print that's buried beneath menus: When you claim to be the most private messenger out there you need to act the part.
Signal's strength is its security agility and thoughtful feature design, not federation and availability.
Where Signal's safety in numbers happens is in normalization of end-to-end encryption. Users who want to protect their message content are not standing out from the rest, unlike in e.g. Telegram where the vendor sees with whom you enable secret chats.
Let's see the law that allows compelling backdoor into Signal then. AFAIK https://en.wikipedia.org/wiki/Bernstein_v._United_States established code as speech, meaning compelling backdoor is compelled speech, which goes against the first.
https://en.wikipedia.org/wiki/Code_as_speech goes into this in more detail and mentions https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d... where the defense was used.
The episode is classic sitcom "wrong conclusion escalates out of hands" so I highly recommend watching it in full instead of the clips but if it's not on your streaming platform, Stewart's scenes are cut together in
No we just have different idea of what quality means.
>The only person in this thread "shilling" and "trying to control the narrative" for their own personal benefit is you.
Yes a person advocating for other people to have human right to privacy is benefitting from a better society! How selfish of me! It's really cute that you're gaslighting the hell out of your audience.
>You're also going into straight conspiracy theory territory here.
No, I'm stating that I have no proof of it, but that it's Durov's job to disprove that claim with the ubiquitous E2EE. What would you call someone who writes a non-private messenger and markets it as private?
>Telegram is allegedly a FSB op, or maybe NSA or whoever, even though the current Russian government doesn't seem to like Telegram or Durov, their CEO, much.
Yes because everyone would trust Telegram if it was the official recommendation of Russian government and FSB. You not understanding first level of misdirection is the absurd part here.
>Definitely don't worry at all about Signal's leadership and funding though!
For someone who doesn't care at all you sure have every single shill argument nailed. I've had these debates since roughly 2015 and you're no different from every other Telegram shill :)
Open source is not panacea, but it's a requirement for verifiable security.
So how about you show us that either the play store APK doesn't match, or, that the source has the backdoor you claim it has.
That's just it, it's not a false dichotomy. Proper privacy engineering can achieve tons of private actually good features. And it's also fine for Telegram to not provide it, but then you can't really market yourself as more private than WhatsApp, "heavily encrypted" etc. There's loads of people who do not know how poor Telegram's security is. Informed consent is what matters much more than dialing every security feature to 11.
>What I am calling out is that this is a fundamentally ideological point of view.
Privacy is a human right: https://en.wikipedia.org/wiki/Right_to_privacy Just because some people sell it for pennies and convenience doesn't erode that fact.
> but general readers should be aware of what they are losing in order to enact this ideology with benefits that seem to be a bit dubious in the real world.
Sounds like you're trying real hard to get people to give up their human right. Why? Do you gain something personally from people using Telegram? Why would you defend such a shit product marketed with lies?
>It is well known that Meta is happy to hand over to any legitimate law enforcement agency any content they have.
Oh so privacy does matter to you when it's Mark Zuckerberg having access to your data but not when its Mark Zuckerberg of Russia having access to your data. The fact is, Telegram looks like an FSB op, or the very least, it doesn't give hard time for nation states to access messages of billion users. Hack the server and you're done.
>To the best of my knowledge, Telegram never has, and neither has Signal.
It shows a bit poor taste to equate these two. Signal doesn't have your data because it end-to-end encrypts all messages. Telegram does the opposite.
>The fact that Telegram potentially could someday seems more theoretical to me.
Their product is now 13 years old. If they cared about user privacy they'd have already hired competent cryptographers to design a protocol that provides the security and the features.
>Again, to the best of my knowledge, all actual leaks of messaging group content have been by various authorities compromising individual devices and/or their owners, which works equally well against Telegram and Signal.
Yeah except Telegram that clearly lacks proper security team wouldn't tell if their servers were compromised. There's nothing they could do to retain user trust at that point. They don't have to care about NSA or FSB or whatever hacking their servers because those agencies aren't boasting. And yeah user endpoint exploitation is obviously out of scope for secure messaging apps as networked TCBs can't be made hardened by some app vendor. I might know something about this topic as I'm the only person who has created messaging system that gets around that issue.
>Meanwhile, Telegram gives you a lot more practical security regarding what information to share with other users, and how to manage what other users can do in large chat groups, which seems like a much more real-world concern regarding actual dangers to users than what the company that owns it might potentially do at some future date.
Telegram IS the threat, not my friends in my closed group where I never need group management. Open groups that require granular permission controls do not require end-to-end encryption. The difference is, Telegram doesn't give you choice for small private groups with friends.
>I think for real security, it's better to pay attention to the business model of the company that runs it
It's SO CUTE that you're trying to control the narrative :D No Telegram has nothing to do with real security.
If Telegram is an FSB op, there is no business model. And if not, nothing prevents selling Telegram and its users and decades worth of data once it becomes unusable. Telegram is surveillance capitalistic, but the sale hasn't happened yet. You don't slaughter the piglet until it's grown. How many times do people need to repeat the same mistake of getting f'd by companies that betray them when it's time. You'd probably actually want to look into Signal's direction as it's a 501c3 non-profit, meaning it can't be sold.
>But on Signal, you're screwed if it's your mobile, and fine if it's any other device.
No you can just install Signal on new phone if old is stolen https://support.signal.org/hc/en-us/articles/360007062452-Wh... Then you just re-link your other devices to the new phone. It's the phone access controls' job to protect from accessing the messages.
>Though since you mentioned backups, I think Telegram's way is arguably more secure. Individual user backups, even encrypted, means all your communication security is at the mercy of whoever in your group has the weakest encryption keys and backup storage location. With a centralized system like Telegram, it's never anywhere but their servers.
Signal's backup storage location is at Signal's servers. The app generates a 256-bit encryption key for you. If you choose to use manual backups and upload them to some random ass company, then that's poor judgement on behalf of that person. The only thing worse, would be if Telegram would make that decision for EVERY group member, every time, with no chance to opt out :)
Your mental gymnastics are so insane if you aren't getting paid to shill Telegram, you definitely need to apply https://telegram.org/jobs
If you want to vomit your entire digital social life to some random company in Dubai and to every party who hacks their servers, you do you.
When you can't continue the secret chat on your desktop device, you'll eventually get tired of having to dig your phone from your phone, unlock it, open telegram, navigate to chat, reply, lock phone, put it back to pocket continue work; the alternative of ditching security and just alt-tabbing to insecure chat on desktop client wins.
This is what a modern backdoor would look like. Vendor can't be blamed about introducing a backdoor, when using the backdoor feature is your own fault.
And this is just DMs where E2EE is possible in the first place.
Yes
With Telegram it is very easy: NOTHING is end-to-end encrypted by defaults, and group / desktop chats can't be end-to-end encrypted. So operating a honeypot server that gets access to billion users' data, is the most obvious honeypot out there.
So I'm just gonna assume you work for Internet Research Agency and tell you to maybe bugger off.
https://kyivindependent.com/kremlingram-investigation-durov/
despite endless claims he's in exile
Except when you enable E2EE, you lose a lot of the features like stickers.
Also, enabling E2EE manually leaks additional metadata about intent to hide content from the service provider. That's insanely valuable even if you can't see the content.
Telegram treats E2EE like a door wreath hung from a nail. Practically all private messengers like Signal treat it like the foundations of the building.
>much better behavior for large groups
Telegram leaks a group as large as the size of 3 members, to the server, always, with ZERO way to opt-out. That's not better behavior. Whatever seasoning you apply on top of a turd, won't change what you're eating.
>far more sophisticated and granular permissions system for admins in groups
Yeah when you remove the "server has no ability to control the group" security feature you can do all sorts of things really easily.
>It also has way more security features too, such as the ability for any session to de-auth any other session
Way more in this case is clearly one. And this is a trade-off. Any of your devices gets stolen and the attacker can lock you out.
>so you're screwed if you lose that.
No you can keep backups in the cloud these days to recover your account. Unlike Telegram, the backups are actually encrypted so that the service provider can't read them.
>Also tons of detailed permissions for who is allowed to see what information of yours and add you to groups.
You mean, it allows you to control to whom the service provider yields the data. But the main privacy issue with Facebook, Telegram and any other surveillance capitalistic platform is the service provider. And Telegram isn't fixing Telegram learning everything about you.
>The only thing Signal actually does better is E2EE for groups.
Signal does EVERY thing better because every feature is private by design. Even if there's UX stuff to fix. You wouldn't claim some Trojan horse malware is really good because the game crack works and you can play a 30 dollar game while it steals your entire digital life or demands random or whatever.
>I think it's simplistic and short-sighted that many tech people seem to think that "security" means E2EE and absolutely nothing else.
In private messaging apps security begins with E2EE. Then you add tons of other features, like forward secrecy (Signal does it better than Telegram), future secrecy (Signal does it better than Telegram), Post-quantum security (Signal has it and Telegram doesn't), cross-platform messages usage (Telegram has no cross-platform E2EE), default security (Telegram has none), and that's just content. There's much more private tools for metadata protection, and on top of that you have advanced issues like endpoint security to deal with. E2EE is the bare minimum for e.g. PrivacyGuides app recommendations, and Telegram can't even cross that bar.
That's fine. I write it off because it by default leaks all of your content and metadata to the server, and then I ask why, and who is learning all that information and I do not like the answer.
>Seems like many people do this when it comes to russian tech
Yeah as a Finn it's not very hard to distrust Russia.
> Even if it was a russian op (its not the Ukrainian military literally used telegram for years)
You didn't prove anything with this, if anything, the fact that Ukraine banned using Telegram on the state officials devices, speaks the exact opposite: https://www.bbc.com/news/articles/c78dwepw95do
>the russian government cant touch me
If it's a Russian op, they're collecting your entire life, your political opinions, your relationship issues, everything, in search of kompromat that they'd use to coerce you during recruiting.
Yeah same can be said for Facebook and WhatsApp that Durov vehemently claims should not be trusted with user's data. Maybe it's a ploy for the Mark Zuckerberg of Russia to get the data of people.
Also, Telegram doesn't have to sell it's users if it's an FSB honeypot.