Hacker News Reader

Comment by dartharva | Hacker News Reader

You'd think such a thing should have been directly implemented in Chat apps and related communication channels long ago considering how much demand there is in the industry, but nope. Signal is the only one among popular texting apps that implements disappearing messages correctly.

View on HN

Wasn't this what got people into so much bother with Snapchat though?

There's no way to undelete sent data in practice (as you've no way of knowing if the counterparty backed it up / screenshotted it etc).

Sure you can enable deleting messages, but you can't guarantee they've been deleted - which is what I'm assuming puts developers off implementing the feature.

But the receiver having access to the message for eternity isn't the only issue to address. If a phone is subpoenaed and the messages of interest are no longer on the phone nor on a server, that's a powerful feature.

Even with proper end to end encryption and the deleted messages problem solved, an app like Signal is still relying on the rest of the OS for its security model. Keyboard input comes to mind as a potential weakness. Things like third party keyboard apps for example.

> Even with proper end to end encryption and the deleted messages problem solved, an app like Signal is still relying on the rest of the OS for its security model

Is there a circumstance where an app isn’t subject to the underlying OS security model?

Fair point... The real core issue might be a simple one. All current power structures have great fear over any kind of real end to end encryption and would never allow it to happen. So if there ever is a weakness, like the keyboard example, it will likely be exploited to the fullest extent.

I'm not saying there aren't many more points of weakness. I'm just saying there is value in data being proactively removed from places that the company has control of.

The point isn't to protect against malicious receivers -- as you say, there's really no way to do that -- but for cases where you trust the receiver but want to make it as difficult for a third-party to access the message as possible.

What makes you say that Telegram doesn't?

Telegram deleting messages appear to work for me. Likely this guy is just buying into Signal FUD that Telegram is somehow worse encryption, despite Signal's encryption being used by Facebook and funded by the US Govt.

What does using the same encryption algorithms of a government or business have to do with the conversation? Are you implying that the algorithm is unknowingly back-doored, with the evidence being that Facebook uses the same algorithm? Or am I misunderstanding your point?

The claim isn't that Telegram's encryption is worse, it's that Telegram's closed-source backend is unauditable.

Your other points are a great example of FUD.

edit: changed clients to backend

I think Telegram clients are open source, aren't they?

You're right, edited. Thanks!

For all practical purposes, Signal's backend is also closed source. The public repository for the server code hasn't been updated since April 2020 (nearing a year now) though Signal has, in the meantime, come up with features like new groups that necessitate storing more metadata on its servers.

I honestly didn't know Telegram had that feature, even though I've been using it for nearly a year.

Stand corrected now, thanks.

Reply on news.ycombinator.com