Hacker News Reader

Comment by KingMachiavelli | Hacker News Reader

Telegram has so many anti features and dark patterns that I really wish it was less popular. I honestly use WhatsApp over Telegram because at least I know WhatsApp is insecure while people sometimes act like Telegram is a secure platform.

View on HN

Which dark patterns exactly?

I didn’t know that the described functionality even exists, and it is off on my phone. TG is one of the apps that implements 0 dark patterns, imo.

By comparison, whatsapp regularily tries to cloud-ize me by making a backup and re-enter my personal data. I just tap “never”, “done” once a month, but it is annoying af when it happens at the incoming call. It also forced users to enter a status (but there was a bug that allowed to enter empty one). And if you have a sim-less device, it is such pita to install it there. No updates will be available, ofc.

The rich irony here is that Telegram, in fact, way less secure than WhatsApp, yet, it's users (wrongly) perceive it to be magically more secure.

The reason why WhatsApp is more secure is simple: it uses e2ee for all chats, and consequently has issues with multudevice usage and chats syncing, while Telegram just stores all chats in its servers, sans so-called "Secure chats". (I'm yet to see one person who is using them to contact me)

I believe why Telegram is considered more secure is the source code for it's clients are open source. Which means it's possible to ascertain what the app is and isn't sending. You're not able to confidently verify that WhatsApp isn't doing more that it claims including verifying it's E2EE implementation.

Not really. It's just marketing push that 'Telegram is the most secure messenger' that somehow does the job, and the unwitting public is happy to accept it as a fact.

As of source code... do you really need a source code if you can login with just your username/password and instantly see all your chats? For anyone who has some remote understanding of the matter it clearly tells that chat history is stored on servers without meaningful encryption and that server owner can access all chat history at will.

My entire company and tg-part of a friend circle uses them when needed. E.g. to discuss issues that contain private/financial details or something personal that is undesirable to leak to "third parties who ruin parties". Otoh, I wouldn't mind if my mile-long chat with IT buddy went entirely public, because we mostly discuss Web-tech, BTC and other sick jokes there.

Personally I'd never bother to start a secret chat with a person that I don't trust enough anyway. Neither do I trust an e2e messenger that my country didn't even bother to "pucker" legally.

>users (wrongly) perceive it to be magically more secure

This is claimed often, but I'm yet to see these users. Do they really believe that, is it just tg opponent's agenda that became popular, or both?

> This is claimed often, but I'm yet to see these users

I often see these users. Most tend to just blindly trust a vendor. Also, I recall a talk at a Secure Messaging Summit 2020 given by Nikolas Unger [1], where he referred to a study about this (mis)perception.

[1]: https://claucece.github.io/Secure-Messaging-Summit/

I’ve heard other folks say WhatsApp is insecure. Do you (or anyone else) have specific examples or concerns?

Like... Facebook can read all your messages? The encryption only protects you from entities that are not Facebook. With that out of the door, it's not really worth it to even consider other angles of attack, since you now depend on the goodwill of a billion dollar company whose sole purpose and reason for existence is to extract and monetize your data. WhatsApp is a nice chat tool, but it's nothing you should ever use for secure communication. Sending a letter via mail is more safe.

If they can, then either Facebook boldly lied about implementing end-to-end encryption[0], or found significant attack against the Signal protocol, which is considered quite safe.

They do have access to the metadata, i.e. whom you messaged and when.

[0] https://techcrunch.com/2016/04/05/whatsapp-completes-end-to-...

that's incorrect. WhatsApp is end to end encrypted using the signal technology as confirmed by moxie. are you suggesting Facebook tricked the signal team into believing that WhatsApp is using end to end encryption when it isn't? a source: https://signal.org/blog/there-is-no-whatsapp-backdoor/

Honest question, then: outside of things like ethical concerns about supporting Facebook, and some missing features like enabling a passphrase to open the app, why should anyone use Signal over WhatsApp? Given that WhatsApp has a better UI/UX and that the people you want to talk to are much more likely to have it, and it supports some things that Signal is known for like disappearing messages (though limited to 7 day expiry).

I love Signal and all the work Moxie and his team have put into it and the protocol, so this isn't a diss to them, but just wondering what the disadvantages would be for someone just looking for an E2EE communication app.

One difference I suppose would be that Facebook would have all the message metadata; just not the contents.

> Facebook can read all your messages?

Whatsapp still does E2E encryption. (Same as Signal) Facebook can't read your messages. (There's still the scenario of you getting a special version of the app with that functionality disabled of course) You can also enable notification for changed signatures, which I do see changing as people replace their phones.

WhatsApp lets you upload your chat history to either icloud or google's cloud offerings. Those backups are accessible to Apple/Google. Many people have enabled it, so if you are in any decently sized group chat you can basically assume it's available to Apple/Google, the people who hack them, and whomever they have data sharing contracts with.

Personally I use Telegram because they don't mind non-official clients like the FOSS builds. Whatsapp on the other hand is known to ban non-official clients. API access isn't available either unless you are a big corporate user, at which point you need a facebook ads account and cooperate with some API reseller... no joke lol.

Out of curiosity, how can end-to-end encryption be verified when both the clients and the servers are closed-source?

How can you know it’s not E2EE? The absence of evidence is not the evidence of absence, or something like that.

I agree that closed source is harder to verify, but that’s not the same as insecure.

If you can't verify your messages are E2EE, you have to trust the vendor. But if you trust the vendor, you don't need E2EE to begin with.

There are other threat actors than the vendor looking to compromise the confidentiality of your message.

Those actors don't have the vendor's encryption keys.

This is a common wrong understanding.

WhatsApp is end-to-end encrypted by default (using same protocol as Signal) and there’s no way to disable encryption.

On the other hand Telegram chats are by default unencrypted ... you have to specifically start a “Secret Chat” to benefit from end-to-end encryption.

Correction here, Telegram is using transport encryption, while Signal and WhatsApp use end-to-end encryption.

Addendum: Signal uses end-to-end encryption AND transport encryption.

Hmm, that's pretty interesting. Especially since even Matrix public channels (not sure if only by default or required but it seems like all public groups are plain text) are unencrypted.

Do you mind providing examples of "anti features and dark patterns"? Just curious

I would really prefer any location sharing feature to be something that ran on top of the communication platform rather than be a feature baked into the app. Create a generic information syncing mechanism for groups and let clients build features like location sharing on top of that. Location sharing seems so niche that bundling it into the client encourages poor opsec/privacy behavior.

As I have heard, Telegram is unencrypted by default. Both WhatsApp and Telegram are poor at making this 100% clear 100% of the time despite privacy being a major purpose of the apps. I'll admit I really haven't used telegram much but WhatsApp encourages backing up chats to cloud storage. WhatsApp also only provides a single alert that a contact's security code has changed. It also doesn't encourage verifying the security code on the initial contact. i.e if someone out of the blue contacts you on WhatsApp the only security is the phone number.

Reply on news.ycombinator.com