Comment by permanentdecaf | Hacker News Reader

Comment by permanentdecaf | Hacker News Reader

Parent Full thread

Pavel Durov wants everyone to think security is about trust in people. Most companies in that business do the same, because it's easier than building something that doesn't require trust in people. The way Pavel Durov and others like him present "trust" is (ironically) shady corporate structures[1], shell companies, or use of the word "Switzerland."

They want people to think like that because they've built businesses that require it. Telegram stores the messages you send/receive unencrypted on their servers. That's not good, unless you've been trained to think that "privacy" is just about choosing the company, government, or legal jurisdiction that gets total access to your data.

Security professionals know that's not how we should think about security (never trust people!), because Durov is leaving a lot out: there aren't safe jurisdictions, servers get hacked, and centralized databases will get compromised. Logic, though, is probably no match for conspiracy theories.

1: https://www.washingtonpost.com/news/the-intersect/wp/2015/11...

I read the WP article you cited, titled, "The secret American origins of Telegram, the encrypted messaging app favored by the Islamic State".

If Telegram isn't that secure, then why are extremists like IS using it over Signal or WhatsApp? I know Telegram has better features for big groups and much better multi-platform support, so is that the reason? I'm legitimately asking without any snark.

Because they have fallen for the marketing hype and are not secure messaging systems experts? We know some extremists still use SMS which is definitely not secure.

Also, is there evidence that extremists aren't using Signal and WhatsApp?

Them falling for the marketing makes sense.

You highly overestimate the people who are in position of power.

I am talking about politicians, head of terrorist groups, etc.

While saying that top politicians are complete idiots is probably wrong - then again maybe not, I am not sure anymore - the fact that H. Clinton, run the most expensive campaign in history, with backing from all major tech corps AND her staff didn't bother to use encryption at any scale, let alone running a mail server (God knows what kind of software the server was running if it was OpenBSD or Windows Server 08), to me says a lot about how flawed the understanding of these people and their consultant's is about today's world.

Watching "House of Cards" everybody seems incredibly smart, driven, etc. but the politicians I see in real life on average and on the not-very-smart side and the few I've met in person are clueless beyond salvation.

Ps. Sorry for possible mistakes, I'm reading from mobile.

Over 99% of people have no clue how computers work in the most basic sense of the word understanding and most are proud of their ignorance.

I've always heard that while House of Cards might be more "serious" that Veep is actually much closer to real life. Veep has politicians making stupid mistakes on Twitter. Life and death decisions decided on a whims and just absurd amounts of pettiness.

I think "Borgen" is far more realistic when it comes to politics, the "shadow play" and intricacies

Haha good points. Thankfully savvier viewers and/or just people in general know House of Cards is all show and not realistic even though it acts like it is with its seriousness.

Marketing.

Sadly, one of the conclusions you can draw from Telegram is that a security business is almost better off with no security.

Pavel Durov says that Telegram is "heavily" encrypted over and over again, journalists who don't know better take that at face value and encode it into every headline ("Telegram, the encrypted messaging app, ..."), and meanwhile since there is no encryption there is no risk of anyone finding or publishing vulnerabilities in it.

Since cryptography already seems unreal to most people (and is always just a matter of getting the smart IT guy to 'crack' it on television), everyone's already predisposed to thinking that security = Switzerland. Unless there's a major change, the charlatans will win every time.

Telegram offers at least some degree of anonymity, you can join group chat without exposing your phone number. And even if telegram administration closes the group, they are unlikely to report all members to police.

WhatsApp and Signal offer non-anonymous groups only. They are probably used by people who already know each other.

> Telegram stores the messages you send/receive unencrypted on their servers.

Anyone who has used Telegram for more than 5 minutes knows there are secret chats. The effort being made to rig the information against Telegram also tells a lot about its relevance.

I think part of the issue in examples like this one is that journalists read (legitimate) criticism about e.g. Telegram and simply don't report all the nuance (whether due to an actual agenda or honest misunderstanding).

Secret chats are not enabled by default, and most users don't enable them; so yes, messages are generally stored without encryption on the Telegram servers. That's a more neutral way of presenting the information.

My understanding was that non-encrypted messages were split across multiple countries/jurisdictions,, making it impractical (not impossible) to snoop.

You mean you only have to be able to hack their servers in one of their multiple sites to look at any user? Cool, so all the snoops can look at every citizen's data.

The secret chats are almost useless. Even setting aside the impossibility of syncing between devices the support is severely lacking: Telegram web? No[1], telegram desktop? Nope[2], telegram-cli? Yes, but the client is completely broken and abandoned[3].

The telegram desktop main developer said[4]: "Well, I'm afraid there isn't. They are just not in high priority, many other important things first."

It seems stickers, funny bots and GIFs have more priority over security. I think this tells a lot.

[1]: https://github.com/telegramdesktop/tdesktop/issues/871

[2]: https://github.com/zhukov/webogram/issues/126

[3]: https://github.com/vysheng/tg/issues/1189

[4]: https://www.reddit.com/r/Telegram/comments/2z24ly/how_to_sta...

Oddly enough, they did implement encrypted calls in telegram desktop, and relatively quickly after the release of the feature in mobile.

Secret chats that aren't even supported by the official desktop client? Telegram has some things going for it, but privacy and security are not among them.

> Pavel Durov wants everyone to think security is about trust in people

I think his point is the reverse, while people trust Signal because of Moxie & Trevp.

puts Tinfoil hat it's possible that Trevp is not "that" involved with Signal because he doesn't want to be involved with the government and backdoors.

To say that Signal is secure because of the people, or to say that WhatsApp isn't secure because of Facebook only feeds the logic of Pavel Durov and all the charlatans of the world.

The point of all of this should be that it's not about people, places, or jurisdictions. If you make it about that, the charlatans who want you to think that Switzerland = secure will win every time.

> Telegram stores the messages you send/receive unencrypted on their servers.

They don't. From the Telegram FAQ:

"Cloud chats are stored encrypted in the Telegram Cloud, and the keys needed to decipher this data are kept in other data centers in different jurisdictions. This way, local intruders or engineers can't access this data, and several court orders from different jurisdictions are required to force us to give up anything. Thanks to this structure, we can ensure that no single government or block of like-minded countries can intrude on people's privacy and freedom of expression."[1]

1: http://telegra.ph/Telegram-Security-FAQ

They have keys, they have data - the end of story (and security).

Please don't spread disinformation.

Reply on news.ycombinator.com