Hacker News Reader

Comment by skrowl | Hacker News Reader

Signal has MAJOR UX problems when you have several devices (which is fairly normal for mainstream users). Try using the same account multiple computers, smartphone, tablet / chromebook at the same time. It's painful.

Compared to Telegram (which is also privacy-focused and NOT owned by Facebook like WhatsApp is) that simply works, I'm not sure what Signal brings to the mainstream table.

The people behind the predecessor to Signal were somewhat successful in a disinformation / FUD campaign against Telegram's cryptography early on, but 0 POC exploits have ever been released. Telegram even upgraded their cryptography to alleviate some of the concerns - https://core.telegram.org/mtproto . They are now recognized as IND-CCA secure https://en.wikipedia.org/wiki/Ciphertext_indistinguishabilit....

To be mainstream, you have to have mainstream usability. Signal does not (at least not right now).

View on HN

Telegram's cryptography isn't comparable to Signal's. Telegram provides end-to-end encryption only for private messages between two people, and, last I checked, that encryption was disabled by default. There is no group end-to-end encryption; rather, Telegram claims that TLS hop-by-hop encryption --- in which Telegram's own servers get to see message plaintext --- is sufficient.

Signal provides true end-to-end encryption, for groups, by default, always-on, in a privacy-preserving design that ensures that Signal's servers don't have to collect a log of who's talking to who. Signal won the Levchin Prize at Real World Crypto --- in fact, they won the first Levchin prize ever awarded, meaning that when Dan Boneh and Tom Ristenpart and Kenny Paterson and the other referees sat down to figure out who should get the inaugural Levchin Prize, Signal was the first thing that came to mind.

That cryptographers recoil from Telegram's bizarre IGE-based cryptography is besides the point. Nobody needed to "FUD" Telegram to show that it's inferior.

I agree so much. There's a long list of reasons cryptographers like Schneier and Green recommend Signal, and why they advice against using Telegram. I've never seen any cryptographer or security expert recommend Telegram. It's always some random person online who seems to know a lot about encryption (like what is IND-CCA security) but who don't want to explain Telegram's lack of ubiquitous E2EE.

> Telegram provides end-to-end encryption only for private messages between two people, and, last I checked, that encryption was disabled by default

Moreover, there is no option to enable e2e encryption on GNU/Linux at all!

https://askubuntu.com/questions/739341/telegram-with-secret-...

I've tried explaining this to friends on Telegram - they don't care that the cryptography isn't as good, but that its fast, it works, and Facebook doesn't control it. They don't use Signal because it isn't as polished as Telegram.

Meanwhile I have Matrix-using friends explain to me that Signal is secure but its centralization is a threat by being a single point of failure, but I don't use Matrix because it isn't as polished/consistant as Signal.

"Facebook doesn't control it."

Unfortunately it's controlled by the Mark Zuckerberg of Russia who still has access to his data brokers. None of the companies with access to our private data seem problematic at first. Google was a gift from the heavens with it's insane 1000MB gmail accounts back in 2003, now it's a private intelligence agency. Facebook was about free fun and connectivity, now it's a private intelligence agency. But Telegram's going to be different and money comes from magic and ICOs even after it reaches critical mass.

Aral Balkan explains this better than I ever could https://www.youtube.com/watch?v=jh8supIUj6c#t=35m02

Also, the security model of Telegram is exactly the same as Facebook Messenger: A bunch of promises about respecting your privacy, coupled with opt-in end-to-end-encryption that doesn't work cross-device, and the use of which reveals the intention to hide messages from server (which is extremely valuable metadata: these messages I want to hide from service provider and governments!)

Telegram does invest heavily on their UI. It's been hard for me to convince people to move to it, regardless.

I imagine I'd have an even harder time moving people to Signal. While their encryption is better, I've seen complaints of messages not being sent and the sender not being aware until days/weeks later after personal follow up on the receiver. Even if this didn't deter me from using it, I have little to no contacts using it. And for the ones that do have it I have no way of knowing if they uninstalled and I'm sending a message to a black void.

If Signal had the reliability, UI polish, consistent updates, and feature-rich experience of Telegram I'd be putting more effort to convert users toward it rather than the latter. I'm a fan of both apps and companies running them nonetheless and am using Signal as my primary SMS app as it's a step to detach from Google.

To me it comes down to one simple question... do you want other parties reading the messages you send to your family and friends? If not, use Signal and encourage them to as well.

As much as I agree with your criticism of Signal (my main gripe is enforcing use and verification of phone numbers as identifiers), Telegram is not privacy-focused, despite their marketing and public perception.

* Messages are cleartext w.r.t. the server by default (I'd wager >99.9% of all Telegram chats are sent this way). E2E-encrypted conversations have to be enabled explicitly, are tied to a single device and only available on mobile.

* Encrypted group-chat not possible.

Hell, you might as well use Google or Facebook, the only difference is who's monitoring. Even WhatsApp has more privacy than Telegram.

Of what I tried so far, Keybase is really damn close. Their UX has been improving a lot, multi-device where all are first-class citizens, E2E by default, etc etc. The whole identity-graph thing, server-side being closed source and platform being run by a US-based business are the only things that keep me from trying to onboard everyone I keep in regular touch with. Too bad neither of those things are likely to change anytime soon.

Phone numbers are every message board person's gripe with Signal, and it's a totally understandable gripe. But Signal doesn't demand a phone number because they want your personal information, but rather because they're allergic to it: to run a messaging system, you have to provide users with contact lists, and the way all other services do that is to store contact lists in serverside databases. That means that other messaging applications store the complete contact graph of the service --- literally a log of precisely who talks to whom --- in plaintext, in a single centralized location. Signal avoids doing that by piggybacking on the contact list you already have, and so doesn't have to store a contact graph at all. It's a UX sacrifice Signal makes in favor of superior privacy and security; UX sacrifices for security are basically Signal's brand.

I don't buy it. They could have kept it the default but allowing e-mail as an alternative (which can also be stored in phone's contact lists).

Or just have usernames, for that matter. It's not like they're a 5 person bootstrapping team who don't have the resources to solve the small kinks to make that user-friendly.

It's not hard to build serverside contact lists with usernames; 1-person teams routinely build that feature. But all of those systems store plaintext complete contact graphs serverside. If it's so easy to get this feature with email addresses, why does Wire have a durable log of who's talked to whom on their service stored in a database? It's not because they want it.

For piggybacking on the local devices' contacts: What makes e-mails different than phone numbers?

For app-specific contacts: They can store and sync conversation logs. I don't see how contact lists would be harder.

The fact that most people don't have email addresses for all their contacts? The application has to work for most people, not you.

I still don't see how these have to be mutually exclusive. Fine, default to phone number since that's what most people are comfortable with, but it's not like there's anything inherent making supporting alternative identifiers a difficult problem.

Let it be my problem making my friends add my e-mail address to their contacts.

You didn't list out any actual UX issues with Signal. I use it on my phone, desktop PC, and laptops without coming across any issues.

And you'd want to use a cipher agreed upon by the general cybersecurity community to be secure. You don't roll your own crypto, deploy it, then hope the security field vets it later.

Another user already commented that Telegram isn't E2E encrypted by default, so you have to trust both their servers _and_ MTProto. And one thing not yet mentioned is that both users have to be online to initiate this E2E-encrypted chat, so it's pretty useless.

I took a look at Signal again a few days ago, and their desktop "app" is still a 323 MB Electron tire fire.

I don't have any love of Electron but this seems to be how the majority of messaging products are targeting the desktop. Slack works the same way...

I guess it seems a bit unfair to use this as a criticism for Signal in particular; they are already fighting an uphill battle UI-wise. To my mind, since the client is about as frustrating as Google Hangout was, I'm willing to accept it as good enough.

Thank goodness there's the highly optimized Telegram Desktop client that's not a tire fire since it has the secure end-to-end encryption for both group chats and one-on-....ahahahahahahahahahaha

I didn't say Telegram was perfect (nor did I even mention it), but at least the desktop client uses a sane gui framework (Qt).

No you didn't. But I impled UI design doesn't matter when the important stuff like security isn't there.

But hey, if feeling slick with your polished app and having nothing to hide is your thing, good for you.

Another huge issue with Signal (and telegram) is that it is tied to your phone number which effectively ties it to you as a person. Which is by default something that raises eyebrow.

Same problem with Telegram. You can't register account without phone number. Also, Signal is already working on user names, it's just a lot more complex problem than you might think.

Elaborate why it is hard? I would have thought a keypair as an identity and sharing public keys via QR code to add a contact would suffice.

Now that's a horrible UX See how many of your friends use Briar. You need an existing social graph to start. Also, secure cloud backups for the account data isn't an easy thing, see e.g. their blog post on that. But now that it's coming, you'll most likely get to create a username too, and backup contact list to cloud protected with latest and greatest password hashing algorithms so that Signal doesn't have access to it (unlike Telegram).

whatsapp is also impossible to use on >1 mobile devices.

"Compared to Telegram (which is also privacy-focused and NOT owned by Facebook like WhatsApp is) that simply works, I'm not sure what Signal brings to the mainstream table."

Firstly, with Telegram asynchronous chats are trivial to make, because all you're doing is managing data the server has using multiple clients. The moment you add E2EE for multiple clients, that's when things get hard, like really, really hard. Try enabling secret chats for desktop client with Telegram and you'll see how convenient Telegram is. See the thing is, Telegram doesn't even have cross-client E2EE. None of the official desktop clients support E2EE, and the 3rd party client that do, are not interoperable with other clients. You don't see the messages on multiple devices.

Telegram is snappier because the team is cheating with the star topology architecture. There's no way to have forward secret, future secret group chats with shared encryption key. There's three choices.

1. No E2EE for groups at all (The Telegram way \o/)

2. E2EE with static group chat key (no forward/future secrecy)

3. Individual encryption of messages to each peer (has both forward and future secrecy) -- the way Signal does it.

So to answer your question "I'm not sure what Signal brings to the mainstream table." Signal brings actual Privacy by Design that Telegram developers have been unable to implement at any point.

"0 POC exploits have ever been released."

That's not what security is about. It's not the researchers with capability to break the encryption, it's the intelligence agencies, and they're not very eager to share.

"They are now recognized as IND-CCA secure"

They sure are. I'm going to be honest with you. I think MTProto end-to-end encryption is fine. It might be even great. You have the fingerprints, you can check there's no MITM. Great. But there's a tiny problem:

1. This great E2EE protocol isn't enabled by default (unlike with Signal)

2. This great E2EE protocol isn't available for group chats on any client (unlike with Signal where all clients support it)

3. This great E2EE protocol isn't available for desktop clients (unlike with Signal)

"To be mainstream, you have to have mainstream usability. Signal does not (at least not right now)."

You might be right in that Telegram is more usable, now. But Signal is catching up and fast, and once the gap closes, every feature will also be an actual feature (one that works privately as opposed to one that has privacy tradeoff of private content having to be shared with the server). At that point Telegram has to implement everything from the ground up.

Also, as for what the Mark Zuckerberg of Russia does with the tens of billions of plaintext messages stored on their server, I have no idea. All I know is that's a really, really, really tempting target for nation state hackers. And I have serious concerns about whether Telegram team would admit their messages were compromised, given that they can't mitigate and promise it'll never happen again by deploying app-wide E2EE: if they had the know-how they'd already done it.

Given that majority of Fortune 500 companies have been hacked, what are the chances Pavel Durov and his team (who lack the capability to implement basic E2EE) have magically hardened their servers against NSA, GCHQ, the Israeli Unit 8200, the Chinese intelligence, the Russian intelligence. Don't make me laugh.

One more thing, AFAIK there's no audit of Telegram's code base, and it's some of the smelliest code I've ever seen: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... Look at that file size, the lack of comments, the amount of nesting, the shitty variable naming policy. It's an absolute shitshow. I have _nothing_ good to say about it.

And someone's always posting the Durov's "Why Telegram isn't E2EE by default" propaganda flyer, so here's a refutal before anyone decides it's time to post it again https://telegra.ph/Why-you-should-stop-reading-Durovs-blog-p...

Reply on news.ycombinator.com