Not just typically privacy sensitive people, but also lots of normal people.
Most people still have WhatsApp for that one or two friends and relatives that don't want to switch. But most activity has moved on.
I mean, I too trust Durov more than Zuckerberg but that's an extremely low bar to clear, and you're giving them a lot more data.
I got signal, telegram and element.io . I encourage non technically savvy people to go to signal and technically savvy people to go to element. But I see a lot of normal people switching to telegram.
Possibly just network effect due to the whatsapp exodus. If somebody you want to communicate with only has telegram, you also download it.
Then why is it ?
This is far nicer on smaller home servers, but matrix.org is the "default experience" of element and that's what people are judging it by.
Funny how you mention this - scrolling back manually is literally the only way to go to past conversations on mobile, as the search does not work with inflected languages. The only way to search for past content is to dump your whole message history on the desktop client and run grep on it.
Disassembly and analysis is also harder with binaries than original sources and an open, reproducible build process.
WhatsApp messages have E2E encryption by default, you can not opt out, and the keys (each message has a different one) are never sent to WhatsApp or anybody else.
Users may OPTIONALLY enable a cloud backup, which puts an encrypted backup on iCloud or Google Drive. WhatsApp (Facebook) holds the key for this, but not the data, and law enforcement would need the cooperation of Facebook and Google/Apple to access the messages.
But that is all completely opt-in. By default, messages are not backed up, contrary to what you said.
Full disclosure: I use WhatsApp but am eager to switch away from it a soon as Signal implements a local backup on iOS.
It is a plaintext backup to Google Drive, whatsapp does not encrypt it before uploading it to Drive or iCloud.
https://news.ycombinator.com/item?id=26458102
> But that is all completely opt-in
You cannot control your contacts backup settings. Every contact I have (100+) has enabled the backup option, meaning all my 'e2ee' chats are uploaded in plaintext to Google servers.
With Telegram, I can be sure e2ee/secret chats with my contacts are not going anywhere other than the device they were delivered to.
So you have no idea whether it's actually E2E encrypted, and by default it is not.
Sure, if your threat model means you are worried about the key backups and particularly your friends key backups, you shouldn’t use WhatsApp.
I’m not sure how you end up at Telegram with that threat model.. but whatever floats your boat.
I’d wager most people care more about FB not being able to read their messages. And they can’t. Maybe one day that changes but they will be required to communicate those changes.
Encryption is literally not E2EE if the private keys are uploaded to some random third party, maybe even without your knowledge (you have no idea what your contacts have done).
When you read how the cloud encryption works in Telegram, with the encryption keys stored in different data centres and even different countries to protect against any one person or group being able to read them, I personally feel pretty happy with that. (See https://telegram.org/privacy#3-3-1-cloud-chats)
Having the messages stored in the cloud and not having to rely on my phone (except for registration) is a huge win for me personally. Especially during the lockdown I almost exclusively use desktop versions of these and the Telegram one is great.
And you do this every time there is a new WhatsApp version? How confident are you that you can find any backdoor in the binary? And it doesn't have to be in the encryption/decryption part, all it would need to do is hide the encryption key in a message back to the server, so you'd have to inspect the entire binary every time. Even if you do have the time and skill to do this it's not exactly feasible for most people.
I'm not trying to argue that there is a backdoor, just that in both cases you have to rely on trust.
> You should only trust it if you believe that organizations who want your data can’t invent a good story.
It's not just inventing a story though, their backend is also open source so they've also implemented this story. Of course that doesn't mean there isn't a backdoor in the production version, but you see how the trust you need in both cases is the same.
Edit: Actually the backend isn't open source, I was thinking of signal
Secondly, Telegram secret messages have been repeatedly proven to be E2E encrypted, including by independent researchers, so "Pavel can read all your messages!" is just misinformation.
As for the alternatives, well Signal is very likely compromised given their server repo is abandoned and they refuse to address why (they maintain a closed source version). Why else would an "open source project" act that way, if not gagged?
You’re referring to the optional backup that requires users to opt-in. This sends an encrypted blob of all your messages to Apple/Google, and WhatsApp holds the key (but not the data) to that. Both companies would need to cooperate to read your messages, and this is OPT-IN by default.
This isn’t E2EE, but it’s opt-in by default. It also has nothing to do with the key exchange for E2EE messages.
You’re comparing WhatsApp, with all messages end-to-end encrypted and where the only way to compromise that is an opt-in cloud backup, to Telegram, where the vast majority of people (anyone using cloud chats) do not use Telegram’s encryption.
Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
It is a plain text backup to Google Drive. There is no key Whatsapp holds. Google can read it all, and has revealed the chats to help the Govt in multiple high profile cases here in India.
You can extract it yourself, with the credentials of your Google account- https://github.com/YuriCosta/WhatsApp-GD-Extractor-Multithre...
> You’re referring to the optional backup that requires users to opt-in.
With telegram, if you enable secret chats, it is never backed up to the cloud. It is a guarantee, unlike Whatsapp where you do not know whether your contact has enabled cloud backups
Full disclosure: I begrudgingly use WhatsApp. I really don’t like it. You’re spreading misinformation, though.
Signal has client-side E2E encryption.
People are killed over metadata.
Show me how you can prove what they publish on github is running on Signal servers and I'll agree here. Otherwise this point is moot.
They could publish cute cat pics on the repo instead for all I care, it's the same level of trust involved.
His public image carries more weight than Zuckerberg ever could (I don't think Zuckerberg could become a public figure in the next decades like Gates is).
From https://en.wikipedia.org/wiki/Pavel_Durov:
> On 16 April 2014 Durov publicly refused to hand over data of Ukrainian protesters to Russia's security agencies and block Alexei Navalny's page on VK.[4] Instead he posted the relevant orders on his own VK page [23][24] claiming that the requests were unlawful.
> On 21 April 2014 Durov was dismissed as CEO of VK. The company claimed it was acting on his letter of resignation a month earlier that he failed to recall.[4][25] Durov then claimed the company had been effectively taken over by Vladimir Putin's allies,[25][26] suggesting his ouster was the result of both his refusal to hand over personal details of users to federal law enforcement and his refusal to hand over the personal details of people who were members of a VK group dedicated to the Euromaidan protest movement.[25][26] Durov then left Russia and stated that he had "no plans to go back"[26] and that "the country is incompatible with Internet business at the moment".[4]
Is he a russian agent? Probably not. But, he's not dead or in prison, I'd say that counts against him. He's complied with fighting "extremeism" in Russia. If Russia did want a view into international communications they would have to publicly distance themself from him. I'm not saying it is the case, but I think the chance is pretty far from 0. Certainly everyone benefits from the appearance that he and Russia do not get along. The chance his co workers are russian is higher, and therefore the chance that Russia has leverage (money/property/family/blackmail etc) directly over at least one employee seems pretty non trivial.
I don't see any good reason to believe Russia or himself are distant on purely the grounds that both of them say so.
Is freedom/what's morally right a guiding light? Well, it's run out of Dubai, the middle east isn't exactly a shining star of liberal ideals. Not everything is encrypted automatically.
Are they consistent? Company is supposed to be a non profit entity but isn't structured that way.
Are they aligned with privacy? Their revenue model is ads, a revenue model with deep precedence for violations of privacy. I see no reason that he wouldn't take a zuckerbergian approach.
I don't find telegram to be any more trustable than Facebook. If I were using a platform for political speech, something I could be blackmailed for, or anything else that would get a state actor interested in me both seem like equally bad choices.
If you don’t have it, people understand why. If you’re in a small to medium sized chat group, people are willing to move it to Signal or an alternative, they are not afraid anymore to try the non-default option.
Now to see if this momentum will last...
She was on Android and was able to recover her account and we set up 2FA. Her friends were not so lucky, many of those with iPhones apparently had to change phone numbers to make it stop. I don't understand why but I also couldn't see their phones.
Anyhow, I encouraged people to give Signal a try. It at least doesn't send links that can hand over your account by text.
I've so far not accepted the new whatsapp terms of use just because I'm curious to see if they will actually pull the trigger on this and disable access. I know many people that are sufficiently annoyed to refuse to click "agree" on that one for the same reason.
My prediction is that Whatsapp will weasel their way out of that one when their self imposed deadline comes up by simply forgetting about it. I agreed to terms of use when I first used the app. So, they could just drop the whole thing and accept defeat. If there's something in these new terms that they need me to agree to, they just need to come out and tell us what that it is exactly. Either it matters or it never did. They are basically saying it doesn't matter but we still need to agree. The corporate weaseling is what is generating the suspicion. And of course Facebook doesn't have a great track record in general.
The alternative may be having to disable millions of accounts which would predictably lead to lots of the remaining users discovering Signal or other solutions when their exiled friends start using those exclusively. I don't see why Facebook would want to let that just happen. So postpone, silently drop the the new terms of use (because as they assure us over and over again there's nothing new in there anyway), and move on.
Except the way they manage contacts. It is a complete mess - I have contacts that changed their phone and there is NO WAY to remove them from the Signal contacts.
They are not present in any of my phone contacts but somehow cannot leave Signal.
1. Settings -> Users & Accounts -> Signal.
2. Click on the trash icon to remove Signal. Don't worry Signal itself will not "forget" your messages or your contacts.
3. Launch Signal. Touch the pencil icon to create a new message. Click on the "..." three dots at the top right of the screen and refresh.
Et voilà, your contacts are in sync and the ghost contact should have disappeared.
No idea how it works on an iOS device though. Sorry.
Would you have an idea how to do the same exercise on a (Windows) desktop? I will just uninstall and reinstall but if there is a less invasive solution that would be wonderful.
Thanks a lot!
Sorry, I use a Mac so can't advise about Windows, though I have the same problem on the Mac app and I'm stuck with a few old contacts that I just can't remove without reinstalling the application itself.
It is not. Consuming it is absolutely legal. It is even in our constitution that the state does not censor.
What is illegal is "making" (for lack or a better word) hate speech and inciting violence.
Example: You can buy Hitler's "Mein Kampf" since 2015. Before that it wasn't possible just because Bavaria held the rights after Hitler's death and refused to publish uncommented full versions. Since books enter the free domain 70 years after the author's death, Mein Kampf entered it in 2015.