Hacker News Reader

Comment by damidekronik | Hacker News Reader

Downgrade in terms of privacy from WhatsApp? Some explanation is needed for such a bold statement.

I'm referring to two things(although really just one) here - WhatsApp claims to store messages only as long as they are undelivered, after which they are purged from their servers. Even if they are retained, they are e2e encrypted. Telegram on the other hand, from what I can see, store all messages in plaintext or in an encrypted-at-rest form where they control and have access to the keys. It comes down to whether I trust them, and I have no reason to.

- Tying back into the encryption point, in the event of a breach or an MITM, whoever intercepts or accesses WhatsApp messages will get encrypted dumps, while my Telegram messages are pretty much going to be in plaintext.

Also adding to this, there is certainly more nuance to it and WhatsApp is certainly far from perfect in that you still trust them to implement E2EE correctly without incompetence or malice, and then there's the whole other issue of their cloud backups being entirely unencrypted by design. Thankfully the latter can be turned off for now.

> they are e2e encrypted

Only if you trust Facebook with their proprietary software.

And on Telegram you can easily export your history at any time and delete from the servers.

Covered your first point in my other comment here: https://news.ycombinator.com/item?id=25670543. Not copy-pasting because I don't want to come off as spammy.

Isn't MTProto proprietary as well?

Also, the option to delete on a periodic basis is not an alternative to not having things stored in the first place. That said, there is no way you can verify that copies are not retained on the servers in either case (WhatsApp or Telegram) so there's not much to argue there.

> Isn't MTProto proprietary as well?

Clients are open-source, so you can see the code for e2e encryption.

> That said, there is no way you can verify that copies are not retained on the servers in either case (WhatsApp or Telegram) so there's not much to argue there.

This is exactly true, so I actually prefer Matrix.

> Clients are open-source, so you can see the code for e2e encryption.

Cool. Unfortunately the cases where it's applicable are too limited for my liking.

> Matrix.

Matrix is great, I just wish I had more luck onboarding my network onto it. I really enjoy using Element.

I think they’re referring to the encryption. Group chats can’t be encrypted end-to-end, direct messages aren’t by default, and the direct messages that are encrypted (”secret chats”) aren’t available on the desktop client.

Much worse protocol, but much better company.

... but still a company that you have to "trust". I'd rather have a protocol that will allow me to not trust anyone and still be secure/private by default.

Then use neither. No protocol allows you to not trust the implementor, and WhatsApp has shown signs of accessing keys.

IMO Telegram is more similar to Facebook Messenger than WhatsApp from a security and privacy standpoint. Both do not use end-to-end encryption by default (but both have a separate end-to-end encrypted private chat mode).

Reply on news.ycombinator.com