Telegram is exposing their users privacy. : technology

[–] Max_P@lemmy.max-p.me 95 points 1 month ago (5 children)

Telegram was built to protect activists and ordinary people from corrupt governments and corporations – we do not allow criminals to abuse our platform to evade justice.

So who gets to pick what's a lawful request and criminal activity? It's criminal in some states to seek an abortion or help with an abortion, so would they hand out the IPs of those "criminals"? Because depending on who you ask some will tell you they're basically murderers. And that's just one example.

Good privacy apps have nothing to hand out to any government, like Signal.

[–] shortwavesurfer@lemmy.zip 33 points 1 month ago (1 children)

Exactly. The strive for zero knowledge is the proper way to be going.

[–] halcyoncmdr@lemmy.world 12 points 1 month ago (1 children)

But then you can't sell your customer's data for profit. Even if you don't now, you still have that option in the future.

[–] shortwavesurfer@lemmy.zip 6 points 1 month ago

Exactly. Which is the entire reason you should do it. Since you can't sell your customers for profit, that means you have to profit off of your customers. And another business could start up and compete with you. Also, your customers will trust you more.

[–] Ganbat@lemmy.dbzer0.com 10 points 1 month ago* (last edited 1 month ago) (1 children)

The second I went to sign up and learned a phone number was absolutely required, I knew that their privacy was pure bullshit. That little declaration at the end here is an absolute slap to the face.

[–] helenslunch@feddit.nl 18 points 1 month ago* (last edited 1 month ago) (1 children)

Signal requires that as well. Their privacy is definitely not bullshit. As far as I can tell, it's a spam mitigation method. But yeah, Telegram is pretty much the very bottom of privacy. Even Meta now encrypts all messages across all platforms.

[–] Ganbat@lemmy.dbzer0.com 1 points 1 month ago (3 children)

It's bad for privacy no matter how you sell it. Unless you have a good amount of disposable income to buy up burner numbers all the time, a phone number tends to be incredibly identifying. So if a government agency comes along saying "Hey, we know this account sent this message and you have to give us everything you have about this account," for the average person, it doesn't end up being that different than having given them your full id.

[–] calamityjanitor@lemmy.world 9 points 1 month ago (1 children)

Another aspect is the social graph. It's targeted for normies to easily switch to.

Very few people want to install a communication app, open the compose screen for the first time, and be met by an empty list of who they can communicate with.

https://signal.org/blog/private-contact-discovery/

By using phone numbers, you can message your friends without needing to have them all register usernames and tell them to you. It also means Signal doesn't need to keep a copy of your contact list on their servers, everyone has their local contact list.

This means private messages for loads of people, their goal.

Hey, we know this account sent this message and you have to give us everything you have about this account

It's a bit backwards, since your account is your phone number, the agency would be asking "give us everything you have from this number". They've already IDed you at that point.

[–] Ganbat@lemmy.dbzer0.com 0 points 1 month ago

Yep, at that point they're just fishing for more which, hey, why wouldn't they.

It's a give and take for sure, requiring a real phone number makes it harder for automated spam bots to use the service, but at the same time, it puts the weight of true privacy on the shoulders and wallets of the users, and in a lesser way, incentives the use of less than reputable services, should a user want to truly keep their activities private.

And yeah, there's an argument to be made for keeping crime at bay, but that also comes with risks itself. If there was some way to keep truly egregious use at bay while not risking a $10,000 fine on someone for downloading an episode of Ms. Marvel, I think that would be great.

[–] helenslunch@feddit.nl 7 points 1 month ago* (last edited 1 month ago) (1 children)

It's bad for privacy no matter how you sell it.

I mean it's not ideal but as long as it's not tied to literally any other information, the way Signal does it, it's "fine", and certainly not "bad" and especially not "pure bullshit".

So if a government agency comes along saying "Hey, we know this account sent this message and you have to give us everything you have about this account,"

They have done this several times, they give them nothing because they have nothing.

[–] Ganbat@lemmy.dbzer0.com 0 points 1 month ago* (last edited 1 month ago) (1 children)

Says right there in the subpoena "You are required to provide all information tied to the following phone numbers." This means that the phone number requirement has already created a leak of private information in this instance, Signal simply couldn't add more to it.

Additionally, that was posted in 2021. Since then, Signal has introduced usernames to "keep your phone number private." Good for your average Joe Blow, but should another subpoena be submitted, now stating "You are required to provide all information tied to the following usernames," this time they will have something to give, being the user's phone number, which can then be used to tie any use of Signal they already have proof of back to the individual.

Yeah, it's great that they don't log what you send, but that doesn't help if they get proof in any other way. The fact is, because of the phone number requirement, anything you ever send on Signal can easily be tied back to you should it get out, and that subpoena alone is proof that it does.

[–] helenslunch@feddit.nl 9 points 1 month ago* (last edited 1 month ago) (1 children)

This means that the phone number requirement has already created a leak of private information

What information? The gov already had the phone number. They needed it to make the request.

Additionally, that was posted in 2021.

Here's a more recent one.. Matter of fact, here's a full list of all of them. Notice the lack of any usernames provided.

Also note that a bunch of the numbers they requested weren't even registered with Signal, so the gov didn't even know if they were using the app and were just throwing shit at the wall and seeing what sticks.

You are required to provide all information tied to the following usernames

They can't respond to requests for usernames because they don't know any of them. From Signal: "Once again, Signal doesn’t have access to your messages; your calls; your chat list; your files and attachments; your stories; your groups; your contacts; your stickers; your profile name or avatar; your reactions; or even the animated GIFs you search for – and it’s impossible to turn over any data that we never had access to in the first place."

What else ya got?

but that doesn't help if they get proof in any other way.

If they're getting evidence outside of Signal, that's outside the scope of this discussion.

because of the phone number requirement, anything you ever send on Signal can easily be tied back to you should it get out

...no. It can't.

that subpoena alone is proof that it does.

It's proof that it doesn't.

[–] PapstJL4U@lemmy.world 5 points 1 month ago

Guys like you see privacy as a monolith, that it never is. Unusable privacy is meanigless as email had shown. Privacy of communications does not mean privacy of communicators and usable authentication can be more important then anonymity.

And all this has to be realised on real-world servers, that are always in reach of real world goverment.

[–] TotalFat@lemmy.world 1 points 1 month ago* (last edited 1 month ago)

In the US, agents must petition a judge for a search warrant. If granted, the agent may then compel an IT company to produce. If they are able, they must comply. It isn't up to the CEO to decide what he feels is right.

Look for services that allow your data to be encrypted, but it must also clearly state the service provider does not have the encryption keys -- you do. Apple does this, I believe.

[–] woelkchen@lemmy.world 0 points 1 month ago

So who gets to pick what’s a lawful request and criminal activity?

Probably Telegram themselves. Durov was forced into exile by Putin.

[+] helenslunch@feddit.nl -10 points 1 month ago* (last edited 1 month ago) (1 children)

So who gets to pick what's a lawful request and criminal activity?

The...law?

It's criminal in some states to seek an abortion or help with an abortion, so would they hand out the IPs of those "criminals"?

Of course they will. If they don't, they'll be arrested. Which is exactly what happened.

[–] Arkouda@lemmy.ca 8 points 1 month ago (1 children)

The…law?

In which country?

[+] helenslunch@feddit.nl -11 points 1 month ago* (last edited 1 month ago) (1 children)

The country in which the perpetrator lives or the crime was committed. First time using the internet?

[–] Arkouda@lemmy.ca 8 points 1 month ago (1 children)

The country in which the perpetrator lives or the crime was committed. First time using the internet?

In your opinion, all companies must disclose the personal information of customers whenever a Government says "This person broke the law"?

[+] helenslunch@feddit.nl -9 points 1 month ago* (last edited 1 month ago) (1 children)

In your opinion

None of this is my opinion, it's just how the world works LOL

all companies must disclose the personal information of customers whenever a Government says "This person broke the law"?

Not necessarily, but kinda. The gov typically need some sort of warrant, and they need approval from the country they're requesting it from. (I don't know all the legal terms here). The provider can contest it. Look at the disclosures of your favorite international tech company, most of them make this information public (except when the gov specifically tells them they can't until they change their mind later).

Here's one from Proton

[–] Arkouda@lemmy.ca 4 points 1 month ago (1 children)

None of this is my opinion, it’s just how the world works LOL

Can you elaborate?

Not necessarily, but kinda. The gov typically need some sort of warrant and they need approval from the country they’re requesting it from.

Which Government?

Pardon my ignorance as this is my first time using the internet, but I am pretty sure that every Government on the planet does not use a universal set of laws or procedures for enforcement.

[+] helenslunch@feddit.nl -7 points 1 month ago (2 children)

Can you elaborate?

I just did.

Which Government?

I already answered this one as well.

I am pretty sure that every Government on the planet does not use a universal set of laws or procedures for enforcement.

No but they all certainly have some sort of system for requesting access to information.

[–] cm0002@lemmy.world 2 points 1 month ago (1 children)

So in your world, journalists and activists trying to bring attention to human rights violations their country's fascist government is committing in an attempt to bring in good change should be just fucked over right?

Because those governments label those people as "criminals" when they're objectively not.

[–] helenslunch@feddit.nl -1 points 1 month ago* (last edited 1 month ago) (1 children)

I'll refer you to my previous comment:

None of this is my opinion, it’s just how the world works

Notice at no time did I use the words "should" or "should not". We're just discussing facts here.

[–] Eheran@lemmy.world 0 points 1 month ago

I love how you get downvoted by people who live in some sort of fictitious world. Kind of like the sovereign citizen nonsense.

[–] Arkouda@lemmy.ca 1 points 1 month ago (1 children)

Can you elaborate?

I just did.

None of this is my opinion, it’s just how the world works LOL

This may be of some use to you.

https://www.merriam-webster.com/dictionary/elaborate

Which Government?

I already answered this one as well.

The gov typically need some sort of warrant, and they need approval from the country they’re requesting it from.

United States of America? Canada? North Korea? China? Australia? Saudi Arabia? South Africa? Brazil?

The point is the app was designed for secure communication, specifically from corrupt governments, which is why it is problematic to allow access to user data as long as the individual is breaking a law in that country.

Or to use the example from the top:

So who gets to pick what’s a lawful request and criminal activity? It’s criminal in some states to seek an abortion or help with an abortion, so would they hand out the IPs of those “criminals”? Because depending on who you ask some will tell you they’re basically murderers. And that’s just one example.

[–] helenslunch@feddit.nl -1 points 1 month ago* (last edited 1 month ago)

This may be of some use to you.

Can you elaborate on what you're asking me to elaborate on, because I honestly don't know beyond what I've already told you.

United States of America? Canada? North Korea? China? Australia? Saudi Arabia? South Africa? Brazil?

Yes. Any of these could potentially be "the country they're requesting it from".

The point is the app was designed for secure communication, specifically from corrupt governments

If you think that's true, you are sorely mistaken. It may be how it is advertised, but it is not how it was designed. If it were designed that way, as many many different chat apps are, they would have no information to give up to a subpoena. AKA the "zero knowledge" encryption that was mentioned previously.

it is problematic to allow access to user data as long as the individual is breaking a law in that country.

I agree. For the third time, this is not my opinion, this is just how the world works.

Or to use my answer from the top:

The...law?

[–] mashbooq@lemmy.world 33 points 1 month ago

Telegram users have never had privacy. Group chats are completely in the open and private messages are only encrypted if both users turn it on for each conversation—and it's off by default. I've never understood why anyone thinks Telegram is any better than posting anywhere else on the internet.

[–] rimu@piefed.social 10 points 1 month ago (1 children)

All this talk of encryption and sopenas is mostly pointless - all the police need to do is join any of the Telegram channels and see the evidence for themselves, like in this case - https://www.stuff.co.nz/nz-news/350438242/man-who-wanted-build-gallows-hear-jacinda-arderns-neck-snap-guilty-threats-kill

No doubt there are private channels but there's absolutely no shortage of criminal stuff happening out in the open.

[–] helenslunch@feddit.nl 2 points 1 month ago (2 children)

all the police need to do is join any of the Telegram channels and see the evidence for themselves

I mean, that doesn't tell them who any of those people are?

[–] KillerTofu@lemmy.world 3 points 1 month ago* (last edited 1 month ago) (1 children)

That’s what subpoenas are for, to request the ip address and other identifying information are for. The documentation of activity in the channel is the evidence shown to a judge that then gets the official legal request.

[–] helenslunch@feddit.nl 0 points 1 month ago (1 children)

That’s what that’s what subpoenas are for

Did you just not read the part of their comment that I quoted?

[–] KillerTofu@lemmy.world 1 points 1 month ago* (last edited 1 month ago) (1 children)

I did. Then I replied and here we are.

[–] helenslunch@feddit.nl 1 points 1 month ago* (last edited 1 month ago) (2 children)

But your reply makes no sense since the person I was replying to specifically said they didn't need subpoenas.

[–] KillerTofu@lemmy.world 2 points 1 month ago (1 children)

No, they did not say that. Which is why I responded. You really do like to look for inane arguments.

[–] helenslunch@feddit.nl -2 points 1 month ago* (last edited 1 month ago)

If your strategy is just to blatantly lie about what was said, despite the fact that it's there for everyone to see, then I see no reason to continue this bad faith discussion. Bye.

[–] DarkThoughts@fedia.io 1 points 1 month ago (1 children)

Stop being eristic dude. Everywhere I go I see those dumbass comments of you. If no one here makes sense to you, then maybe the problem is in front of your monitor. But I'm pretty sure you're just looking for arguments.

[–] helenslunch@feddit.nl -4 points 1 month ago* (last edited 1 month ago) (1 children)

Have you considered not following me around and harassing me? Or maybe just not being wrong all the time?

[–] DarkThoughts@fedia.io 1 points 1 month ago

I didn't follow you around. I click on various threads and end up having to read you playing stupid to cause arguments with various other people. Maybe touch some grass and work on whatever issue it is that is causing you to feel the need to troll people online.

[–] rimu@piefed.social -1 points 1 month ago (1 children)

Half of them use their real name. Also a lot of them are sharing links to content they've posted using their personal FB account or whatever. They don't even try to have any opsec because they don't think they're doing anything wrong.

[–] helenslunch@feddit.nl 2 points 1 month ago

Half of them use their real name.

Which would never be admissible as evidence in court. I could make an account right now using your name, would that make you criminally liable for anything that I say?

Also a lot of them are sharing links to content they've posted using their personal FB account or whatever.

Do you think I couldn't create a FB account with your name? Do you know how many friend requests I get every day from redundant accounts trying to masquerade as people I'm already friends with?

[–] lefixxx@lemmy.world 10 points 1 month ago

All.non E2EE chat apps do this. Also Apple, Facebook, google etc. And don't forget the us gov has no problem giving a gag order and demand backdoors and encryption keys (lavamail).

[–] Vanth@reddthat.com 4 points 1 month ago

My younger sister (Gen Z) talks smack about my generation (millennial) overuse of emojis and this Telegram post is making me agree with her. The attempt at cutesie emojis is jarring.

[–] x00za@lemmy.dbzer0.com 0 points 1 month ago

France is going after activists and protesters. And it was France that held him. I think that says loads.

[–] shortwavesurfer@lemmy.zip -1 points 1 month ago* (last edited 1 month ago)

On a privacy note in general, I got an email from Proton today saying that they were changing their terms of service and I actually care enough about the service that I went and read the new terms and privacy policies for the products that I use. I will admit to not understanding a lot of the legal ease, but the part I was most interested in was the data retention policies and data encryption. And that all seems to be pretty bulletproof from a tech angle.

Technology

Our Rules

Approved Bots