Hacker News Reader

Comment by neilalexander | Hacker News Reader

It feels like Telegram's security posture might end up being quite dangerous for less technical users. Given that it is marketed so strongly as "secure", it's not necessarily obvious that chats aren't E2E-encrypted and it takes several taps through the UI to even find the option for secret chats. I wonder how many users just don't discover secret chats at all.

View on HN

Worse than that, me and the techies among my Telegram contacts don't even bother with Telegram secret chats because there's too much friction compared to Telegram default mode.

edit: Moreover only Telegram on mobile has access to those chats (and no search). Which likely is one of the reasons why secret message hasn't become the default for us.

I like Telegram, but it would be much nicer if secret chats could be synchronised between devices.

The distinction isn't just "mobile". Each mobile device a person uses has a separate secret chat, not synchronised with their other devices.

There's someone I talk with on Telegram where we have two secret chats open all the time, one for their iPhone and one for their iPad. Both channels are connected to my phone.

I have to guess which chat to write in for the other person to notice that I'm writing to them...

That's because when using their iPad they often don't have the iPhone nearby (no need for most purposes). It's lucky I don't have two mobile devices too, as then we would have four secret chats.

When I'm at my computer, we can only use the non-secret Telegram chat, which has a nice GUI but unlike my phone cannot connect to either of the secret chats. This isn't really a problem because we use the non-secret chat for most topics anyway, because of the search and synchronisation.

(Aside, the ability for the other party to delete old messages in Telegram is not very cool imho. I know someone who fell out with a friend and their friend deleted their entire multi-year conversation history, which was heartbreaking. Once you have a long history of messages with someone I think it should be part of your personal archive to look back on. It feels permanent until that point, so it's a surprise to find it can all disappear.)

You'd have to change the model. Signal and WhatsApp can sync the private E2E chats because the web frontend is talking (securely) directly to the app instance and communicating through that. With Telegram you do not need an app or anything, you can just use the desktop client.

This is partially incorrect.

Signal's desktop does not require the mobile app to be active. Differently put, the desktop app does not depend on the mobile app's state. Mobile can be switched off/in airplane/far away from your physical location, but Signal desktop can continue to work.

For WhatsApp, the chats on desktop are e2ee too, but require the mobile phone to be active/online.

For Telegram, secret chats initiated on the desktop remain on that desktop app. They are not synchronized to the mobile apps.

Ah, I was wrong about Signal, I think perhaps one of the early desktop clients was a projected version? It does indeed seem to be working with my phone on airplane mode.

Signal Desktop doesn't require the phone, so no, it doesn't work that way.

Yes, the phone has to be connected to the internet for it to work. It says so in the documentation, and on the very first page "To use the Signal desktop app, Signal must first be installed on your phone."

You have confused me. The statement you quote seems to say that Signal must be install on the phone in order to get Signal working on the desktop. That does not, to me, imply that Signal must be up and running on your phone while you use Signal on the desktop.

Suppose I install and configure Signal/Phone, then install and configure Signal/Desktop, then turn off the phone.

Will Signal/Desktop still work while the phone is turned off?

* If yes, then what you say appears to be wrong.

* If no, then that's genuinely astonishing to me, and I've learning something.

The previous thread is incorrect. Signal desktop can work despite having the mobile phone active. That's the key advantage over Telegram and WhatsApp. Telegram's secret chats are not synchronized. Neither is WhatsApp's, and even worse, WhatsApp's desktop-based chat is just a projected copy of mobile. In other words, WhatsApp's desktop version works as long as mobile is active/is connected to the internet.

What? WhatsApp groups do work on desktop because it is a projected copy of the mobile.

It'd stop. That's why Signal for desktop constantly asks to relink the connection.

No. I just switched off my mobile and I still can send messages on desktop with Signal.

Is there a grace period ?

Desktop app is designed to work even without having your mobile Signal app active. It's a standalone app in itself.

This is incorrect. Signal desktop can continue to work without having Signal mobile active. My mobile phone is on airplane mode and is being charged at the moment, but I am on a call with my colleague using Signal desktop. They are on Signal mobile.

It reminds me of Teslas "autopilot". Different people may have a different understanding what a word means. The outcome can be catastrophic. Clear definitions must be provided. As in: What do we exactly mean when we say "secure"? In the case of messengers: First the user must have an understanding of the problem. This is not realistic for 99.8% of users.

Reply on news.ycombinator.com