Hacker News Reader

Comment by hn159753 | Hacker News Reader

I was just about to post something similar. I'm actually surprised to see a positive post of Telegram on HN. For the love of crypto, please stick to Signal protocol-based messaging applications.

https://en.wikipedia.org/wiki/Signal_Protocol

Edit: add link http://www.cryptofails.com/post/70546720222/telegrams-crypta...

View on HN

For the love of crypto, I would like to see Signal and WhatsApp make proper desktop applications for all major platforms including Linux. Until they do so, Telegram will serve as an excellent competitor to remind them that good cryptography is not enough.

Are there any Signal-based messaging applications that work on the desktop without having to tether an Android or IOS smartphone to it, and without having to use a phone number as identifier?

Wire.

* open source, code on github

* e2e encryption (apparently derivative of Signal's Axolotl double ratchet)

* chat/voice/video, and group chats (all encrypted always)

* based in Switzerland, coding out of Berlin

* clients for iOS, Android, Mac, Windows, Linux, Web

* can sign up with phone number or email (or username? Not sure - I think you can find contacts via username, not sure you can sign up without email)

* reasonably responsive on twitter

* yada yada yada

I like it, but what about all the tracking?

Things like this: https://github.com/wireapp/wire-desktop/issues/80

Then there is the fact that the client acts as a browser that fetches information from the web automatically without blocking trackers itself. This is leaking metadata and actual data.

Riot.im uses the OLM encryption library (that is also used by XMPP OMEMO, see the OMEMO XEP). The OLM protocol is (I gather) very similar to the Signal protocol.

Riot is based on Matrix which is a decentralized protocol (you're not tied to one company), and it doesn't need your phone number.

OMEMO [1] is based on Axolotl (aka Signal's protocol) and you can use it with Gajim on the desktop. Still very experimental though :(

[1] https://conversations.im/omemo/

This. People say Telegram is bad even though it's no worse than any other popular product, or has a different set of advantages/disadvantages both security- and privacy-wise.

From a security and privacy perspective, Telegram is substantially worse than its competitors, so this is a little rhetorical sleight of hand you've just pulled here.

If you want to argue that Telegram and Signal are comparable because Telegram has better UX and Signal better security and some people prefer UX to security, that's fine (I could not disagree more strongly, but at least it's a coherent argument). But don't pretend the thread isn't about security to make people believe that there's controversy about whether Signal is more secure. There is no controversy: Signal won the Levchin prize this year for the Signal Protocol and sets the standard for secure chat, and Telegram... well, let's just suffice it to say that it does not meet that standard.

Wire? (Haven't tried it personally, and I don't think there is an independent review of their implementation of the crypto)

Facebook Messenger.

Is Facebook Messenger Signal-based (i.e. end-to-end encrypted with a Signal/Axolotl double ratchet) as GP requested?

I somehow doubt it.

EDIT: Oh, I was mistaken, apparently there is an option now. From Wikipedia:

On October 4, 2016, Facebook deployed end-to-end encryption as an optional feature for Facebook Messenger users. It is available in an optional mode called "Secret Conversations" and uses the Signal Protocol.

Wait, are you saying messenger is secure and private? As if Facebook would want to give up a source of data for marketing?

It's opt-in end-to-end encrypted with Signal Protocol now, so Facebook does in fact give up that data. Having said that, you should prefer protocols that aren't opt-in for security, which is what Signal buys you.

It's rather a web app than a desktop application, isn't it?

It's not a desktop app, but the original requirement never stated that.

There's a desktop app for Windows. There's also a web app at https://messenger.com. You can disable your Facebook account and still use Messenger

The Signal desktop-app stores all messages unencrypted on the filesystem: https://github.com/WhisperSystems/Signal-Desktop/issues/1017

Sure, but telegram doesn't even have a secret chat feature on desktop client.

I can't believe there still isn't a single usable e2e mobile + desktop chat client that won't drain your cell phone battery super quickly.

> For the love of crypto,

The problem is that most people value convenience and speed over security and privacy. Telegram provides a very good trade off, much better than some other apps. If Signal were to be developed at the pace Telegram is, I would use it all the time, but it's not. For my use and likes, both Telegram and Wire are very good fits.

Reply on news.ycombinator.com