this post was submitted on 08 May 2024
1 points (100.0% liked)

Privacy

31833 readers
247 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

Here's what he said in a post on his telegram channel:

🤫 A story shared by Jack Dorsey, the founder of Twitter, uncovered that the current leaders of Signal, an allegedly “secure” messaging app, are activists used by the US state department for regime change abroad 🥷

🥸 The US government spent $3M to build Signal’s encryption, and today the exact same encryption is implemented in WhatsApp, Facebook Messenger, Google Messages and even Skype. It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕‍🦺

🕵️‍♂️ An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media. But whenever somebody raises doubt about their encryption, Signal’s typical response is “we are open source so anyone can verify that everything is all right”. That, however, is a trick 🤡

🕵️‍♂️ Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones. Signal refused to add reproducible builds for iOS, closing a GitHub request from the community. And WhatsApp doesn’t even publish the code of its apps, so all their talk about “privacy” is an even more obvious circus trick 💤

🛡 Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github. For the past ten years, Telegram Secret Chats have remained the only popular method of communication that is verifiably private 💪

Original post: https://t.me/durov/274

top 50 comments
sorted by: hot top controversial new old
[–] sneakyninjapants@sh.itjust.works 3 points 6 months ago (1 children)

Telegram's server side software is closed source, owned and ran by them exclusively so they really have no room to talk. WhatsApp doesn't even have OSS clients so they're even worse in that regard

[–] eager_eagle@lemmy.world 3 points 6 months ago* (last edited 6 months ago)

exactly, they (Telegram) don't need to put sketchy code in the clients when most messages are not E2E encrypted and they control the servers lol

[–] shrugal@lemm.ee 3 points 6 months ago* (last edited 6 months ago) (1 children)

It's hard to overstate what a nothing-burger this article really is! Let me break it down:

  • Signal got $3 million from the Open Technology Fund at some point in its development
  • Some anonymous source alleges that the OTF's ultimate goal is to promote US foreign interests
  • The current chairman of the board Katherine Maher worked at the National Democratic Institute and Wikipedia before
  • The same anonymous source says she was recruited because of connections to the OTF
  • She has at some point voiced the opinion that a completely free internet without regulation just reproduces existing power structures, and that balancing regulation and 1st amendment rights is a tough problem
  • Signal doesn't have reproducible builds on iOS (it absolutely does on Android btw)
  • Some people feel like Signal chats come up more often than they should in court cases and media reports

That's it, that's the whole story. That's the reason why the Telegram guy of all people thinks you should be careful, and better use his chat service instead, and the Twitter guy agrees.

I mean, reproducible builds on iOS would be nice, but that platform has much bigger problems from a privacy/security/sovereignty/freedom standpoint anyway. And the rest is just nothing turned up to 11.

[–] eager_eagle@lemmy.world 2 points 6 months ago (1 children)

tl;dr "Signal might be untrustworthy because the tech came from a State-sponsored project and the current chairman acknowledges that Wikipedia has a white and Western bias."

just wait until they find out pretty much all tech we have can be traced back to government-funded research.

[–] 9488fcea02a9@sh.itjust.works 3 points 6 months ago (1 children)

Did you know the early early internet researchers were part of a clandestine government organization known as ARPANET???? The entire TCP/IP stack is just a state-sponsored backdoor into your life!!!

WAKE UP SHEEPLE!!!!

[–] refalo@programming.dev 1 points 6 months ago* (last edited 6 months ago)

yea just wait until they find out why the first digital computer was made:

ENIAC was designed by John Mauchly and J. Presper Eckert to calculate artillery firing tables for the United States Army's Ballistic Research Laboratory (which later became a part of the Army Research Laboratory). However, its first program was a study of the feasibility of the thermonuclear weapon.

[–] eating3645@lemmy.world 1 points 6 months ago (1 children)

Lol telegram calling signal insecure is too funny.

[–] rollerbang@lemmy.world 1 points 6 months ago (1 children)

Isn't it that Telegram doesn't claim to be super secure, apart from possibly their encryption on mobile?

This doesn't prevent them from uncovering other possible plots in supposedly secure platforms.

[–] possiblylinux127@lemmy.zip 1 points 6 months ago

True but in this case there credibility is low

[–] sexy_peach@beehaw.org 1 points 6 months ago

Imagine using telegram... It's worse than whatsapp

[–] yogthos@lemmy.ml 1 points 6 months ago

I find it weird how any discussion about Signal will inevitably have a bunch of people piling on dismissing any criticisms of it. Believing that Signal is perfect has become like a religion at this point. Whatever people might think of Telegram is completely irrelevant when it comes to the question of whether Signal is actually a secure tool or not.

The fact that people working on Signal have direct ties to US intelligence agencies cannot be ignored. No can the fact that Signal is a centralized system based in US. These two things alone should make everybody very concerned.

[–] DaseinPickle@leminal.space 1 points 6 months ago

Maybe he should focus on adding e2e encryption to the default chats and group chats instead of spreading FUD.

[–] rivvvver@lemmy.dbzer0.com 1 points 6 months ago* (last edited 6 months ago) (8 children)

arent telegram chats unencrypted by default?

An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media

source?? (i bet this ends up being a "they had full access to my unlocked phone" situation again)

also the whole thing abt US funded encryption is the same bullshit argument ppl use against Tor all the time. it doesnt mean shit.

this just reads like someone desperately trying to get more market share by spreading FUD

https://www.spiegel.de/netzwelt/apps/telegram-gibt-nutzerdaten-an-das-bundeskriminalamt-a-0e4d3fcb-8081-4b87-b062-db412bbc294b

Well, Telegram seems to be giving user data to the German Federal Criminal Police Office, and if they're cooperating with the German authorities, I don't see why I'd presume they aren't cooperating with others as well.

All this is actually documented, compared to those nebulous "important people".

load more comments (7 replies)
[–] electric_nan@lemmy.ml 0 points 6 months ago (2 children)

Looks like a push to discredit Signal right now. While I know Signal isn't perfect, I do like it and I haven't seen anything that is better (on the whole). The 3rd "emoji-point" is quite an accusation, and I would love to see any evidence of this kind of thing, that didn't result from the cops unlocking a defendants phone, or having infiltrated a chat.

[–] possiblylinux127@lemmy.zip 1 points 6 months ago

Tin hat time:

I wonder if Russia's trying to get everyone on Telegram because they have control over it.

[–] MajorHavoc@programming.dev 1 points 6 months ago* (last edited 6 months ago) (1 children)

While I know Signal isn't perfect, I do like it and I haven't seen anything that is better (on the whole).

Agreed. But it is worth mentioning that XMPP with OMEMO seems to be the current gold standard - runs almost everywhere, tons of available (free) servers, secure end to end messages, and fully auditable public source code.

[–] electric_nan@lemmy.ml 0 points 6 months ago (6 children)

I have used xmpp a lot, but I can't really recommend it to friends and family as a secure messenger. There are too many compatibility issues between clients and servers. If your friend is on a client or server that doesn't support the same encryption protocols, then you can't have a secure chat. Basically there is too much user knowledge and effort required at this time, for xmpp to be a good, secure, general use chat. I very much look forward to this changing. I also really like Matrix, but it is still a bit rough around the edges as of my last check.

load more comments (6 replies)
[–] smileyhead@discuss.tchncs.de 0 points 6 months ago (1 children)

Telegram: There are backdoors in Signal encryption!

Also Telegram: not encrypted

[–] dsemy@lemm.ee 0 points 6 months ago (1 children)

Telegram secret chats are e2e encrypted though

[–] ReversalHatchery@beehaw.org 1 points 6 months ago

Secret chats only. With their own, in-house encryption, that, if I remember correctly, the apps don't use according to the specifications.

Maybe I'm mixing up mtproto 1 and 2 with that second part, though.

[–] DaseinPickle@leminal.space 0 points 6 months ago (1 children)
[–] Dark_Arc@social.packetloss.gg 0 points 6 months ago (1 children)

I can't read it because of the paywall but IIRC (based on a similar article) that was such a nothing-burger issue.

People turned on an entirely optional (I think off by default setting) for some feature that allowed discovery of users by location ... and shocked pikachu they could be tracked or something like that.

[–] DaseinPickle@leminal.space 0 points 6 months ago (1 children)

It’s not nothing if Telegram makes people believe they only share their location in a limited manner, but instead broadcast it to the whole world. That’s a serious breach of trust. I don’t know why Telegram users keep making excuses for that platform.

[–] Dark_Arc@social.packetloss.gg 0 points 6 months ago* (last edited 6 months ago) (2 children)

I don’t know why Telegram users keep making excuses for that platform.

Honestly? Because the others are just so bad.

  • Element has an extremely clunky UX and uses Electron. The other Matrix app implementations are incomplete buggy messes.
  • Signal can't sync old messages to the desktop, uses a messy Electron interface, and lacks a bunch of features/polish I've come to expect.
  • Discord doesn't even pay lip service to privacy and uses a similarly doesn't invest in native apps.
  • Threema has been saying that cross-platform/multi-device connectivity is coming for like 2+ years and has had nothing but the most minor of unexciting features added.
  • WhatsApp is run by Meta, has a crappy desktop experience, and has had several serious security vulnerabilities.
  • Jami is ... extremely glitchy.
  • Session is basically Signal backed by a Crypto platform.

If someone took Telegram's UX and feature set and paired that with Signal's approach of "everything is encrypted", that would be a winner. I kinda hope someday Telegram just does that and moves everything to E2EE. When Telegram was launched E2EE for group chats/at scale wasn't really a thing ... now it's not nearly as novel but nobody has deployed E2EE with a feature set like Telegram's.

It’s not nothing if Telegram makes people believe they only share their location in a limited manner, but instead broadcast it to the whole world.

That's not even what happens by the way. It's just that you can spoof a device into random locations and eventually figure out where someone is.

[–] nix@midwest.social 1 points 6 months ago (1 children)

What polish and features is signal missing?

[–] Dark_Arc@social.packetloss.gg 0 points 6 months ago (1 children)
  • Signal can’t sync old messages to the desktop
  • Persistent voice rooms
  • Custom emoji
  • Animated emoji
  • Location sharing
  • Chat folders
  • Topics/rooms for larger group chats
  • Support for larger group chats
  • Quoted replies (i.e., quote part of a reply or create an arbitrary quote block)
  • Code snippets
  • Message forwarding
  • Polls
  • Animations in the UI
  • Detailed custom theming
  • Chat room theming
  • A content index (e.g., view only the files, links, videos, etc that were sent in this chat)
  • Group invite links to people you don't have in your contacts
  • Channels (i.e., micro-ish blogging)
  • A nice bot API
  • Subjective UI/UX changes to put things in more reasonable places (e.g, why can't I right click on a chat to pin it in the desktop client, why is the Electron menu bar shown by default)

And probably several other things I've forgotten because ... basically nobody I know is still using Signal.

[–] nix@midwest.social 1 points 5 months ago (1 children)

Thanks for the detailed reply. Signal does have location sharing and invite links, FWIW.

[–] Dark_Arc@social.packetloss.gg 0 points 5 months ago (1 children)

Signal's location share AFAIK can't be a live location share (which is useful during events like amusement park trips and stuff)

They have invite links to group chats? I don't know how that would work

[–] nix@midwest.social 1 points 5 months ago (1 children)

It works about the same as any other app's group invite link. It can be set to automatically add the person or be treated as a request to join that needs approval.

[–] Dark_Arc@social.packetloss.gg 3 points 5 months ago (1 children)

Huh... That I did not know, thanks for the info. I'm not sure how that works with their encryption model

[–] nix@midwest.social 3 points 5 months ago

Yea, I couldn't tell you the specifics. I know new members of group chats don't see any previous messages. I think it might re-negotiate the keys every time someone is added. It's probably not meant to scale up to very large groups (tho I've never tried), but I've noticed no issues in 25ish people chats.

[–] DaseinPickle@leminal.space 0 points 6 months ago (1 children)
[–] Dark_Arc@social.packetloss.gg 0 points 6 months ago (1 children)

A "toot" isn't a very persuasive piece of journalism.

I can verify that it absolutely impacts groups run by queer communities in the Gulf, because I was in one such group that was monitored and shut down by Etidal.

That claim needs a lot more investigation and context. At the very least, it needs investigated by a credible third party.

Also, do you even know what the feature you're criticizing is? A "channel"? Because it's not even really a part of the messaging portion of Telegram. It's basically an in-app blogging platform.

[–] DaseinPickle@leminal.space 1 points 6 months ago

She links to a news article: https://www.saudigazette.com.sa/article/641746/SAUDI-ARABIA/Etidal-Telegram-remove-over-16-million-extremist-contents-in-early-2024

I don’t think Telegram denies doing mass surveillance. They might deny targeting queer groups and claim to only target extremist, whatever that means.

[–] firefly@neon.nightbulb.net 0 points 6 months ago (1 children)

Telegram: We keep you private. Now enter your phone number to sign up.

[–] SLfgb@feddit.nl -1 points 6 months ago (1 children)
[–] electro1@infosec.pub 0 points 6 months ago* (last edited 6 months ago) (1 children)

Yeah, he needs to fix his broken secret chat feature first... I think it's broken on purpose..

After seeing his interview with Tucker Carlson, I'm 100% sure the guy has some really dark agenda..

[–] rdri@lemmy.world -1 points 6 months ago

What's broken there?

load more comments
view more: next ›