Hacker News Reader

Comment by sz4kerto | Hacker News Reader

> Whisper Systems has a track record of prioritizing 'good enough' ease-of-use ahead of 'perfect' security

Why is Telegram always under for their flawed security challenge despite the good-enough track record then? They also have perfect usability, native apps, 3rd party clients, etc. If the security is not the first priority then Signal isn't very attractive compared to the competition I think.

View on HN

Signal's objective is to make mass surveillance impossible. Telegram stores the entire plaintext transcript of every user's entire conversation history server side by default, so if that's the objective, Telegram is definitely not "good enough." Just the opposite, there's nothing worse.

Signal doesn't have a history of cryptographic flaws and metadata leakage, and Telegram does. The equivalence you're drawing here is false.

Here's an example, from adc and Juliano Rizzo, who co-discovered the TLS BEAST and CRIME vulnerabilities:

http://www.alexrad.me/discourse/a-264-attack-on-telegram-and...

I'm not drawing an equivalence at all (not saying that Telegram and Signal are equivalently insecure or flawed, etc.) -- I was only asking why would Signal make any compromise on security if that is their main selling point (and probably the only one). I don't think that releasing a Chrome app is a good strategy considering the audience (but I don't know for sure, they probably have a better overview of their user base).

I could have compared it to Threema as well, actually.

I don't concede that Signal has made any security compromises. That was someone else.

If you care about security, use Signal. If you care about UX, and Threema has a better UX, use Threema. Threema is a closed-source system that apparently relies on Nacl. That is a much better answer than the one Telegram can give, but it still leaves a whole lot of questions unanswered. There's a lot that can go wrong in the layers above Nacl.

Telegram has a tendency to mislead [intentionally or not] about the quality of its security.

Signal is pretty up front about being "good enough" security.

despite [Telegram's] good-enough track record

You may have missed parts of their track record; part of the problem is that Telegram tends to hide these types of things in its past:

"Telegram protocol defeated. Authors are going to modify crypto-algorithm" https://news.ycombinator.com/item?id=6948742

Telegram is closed source so we can't verify that they implemented encryption properly, and only Secret Chats have the messages encrypted.

https://telegram.org/faq#q-so-how-do-you-encrypt-data

The end to end encryption is open source.

The server is published?

No, that's not relevant for the end to end encryption though.

I thought the Telegram client is open-source, it's even on F-droid. The server side being open or closed source is meaningless:

1. In Telegram's threat model the servers are not trusted.

2. You can't verify server side code anyway.

The Telegram client can just barely be considered Open Source, see the discussion at https://github.com/DrKLO/Telegram/pull/76

F-droid builds those parts separately from source.

> The official source code of the app contains binary blobs, so this tracks a fork which builds those from source. Hence, versions might become available with a certain lag.

https://f-droid.org/repository/browse/?fdid=org.telegram.mes...

Reply on news.ycombinator.com