Hacker News Reader

Comment by skrowl | Hacker News Reader

Telegram is just so much more usable than Signal.

The perceived advantage of Signal over Telegram is LITERALLY not having an option for a cloud-synced chat and ONLY having end to end encrypted chats. That's all.

You give up of usability to get that advantage. Explain to your mom why she has to give up Telegram to get basically the same functionality as Telegram secret chats.

Signals crypto is used by Facebook and was sponsored by the US Govt. Before you believe "OMG Telegram crypto is bad!" FUD, do 15 minutes of research.

View on HN

Signal's by default e2e encrypted chats can be used across platforms, e.g. synced across desktop and mobile. Telegram's secret chats are only available on the device where you initiated them. That's a major disadvantage.

Signal is single-device. The crappy web app that reads stuff from your phone is not a real client.

I just have to reply here because it's so wrong.

Signal doesn't even have a web app. They have a desktop app that works great and that I use every day, all day long for all kinds of communication. On my desktop and laptop.

The same is true of Whatsapp; this is not a major impediment to adoption for most people.

There are no known attacks against Telegram.

The problem is entirely that its cryptography was sketchy and just plain weird to begin with. It wasn't wrong, per se, but raised some eyebrows. And then some of the questionable choices were silently fixed removing the ability to MITM, etc, but with no real notice.

It's not FUD.

Interestingly, if you say that Signal's funding is sketchy and it raised some eyebrows, that would be FUD (see sibling comment). But saying the same about Telegram encryption is for some reason perfectly fine and definitely not FUD.

Shouldn't we have the same standard for all claims?

So you're saying we should have the same standard while literally giving two different types of allegations that are thrown at Signal and Telegram respectively?

We either consider the funding of both and decide how the funding COULD ultimately impact the product, or we could look at the source code of the applications and the cryptographic theory supporting them and talk about that. If crypto experts aren't finding holes in Signal's protocols [1], I don't think random people on the internet yelling "bUt It WaS fUnDeD bY ..." will make it less secure.

[1] https://eprint.iacr.org/2016/1013

> Interestingly, if you say that Signal's funding is sketchy and it raised some eyebrows, that would be FUD (see sibling comment). But saying the same about Telegram encryption is for some reason perfectly fine and definitely not FUD.

> Shouldn't we have the same standard for all claims?

Huh? Telegram's protocol has been criticized by cryptographers for making specific "odd" cryptographic choices (see See https://crypto.stackexchange.com/questions/31418/signal-vs-t...). It's not FUD to bring that up.

However, it is FUD to imply something concrete based for vague, indirect reasons.

More than one red flag there, there was the claim of it being secure just because the spec was out there and nobody had broken it yet.

and telegram does not used encrypted e2e messages by default. Only on the special secret messages that no ones uses.

> There are no known attacks against Telegram.

Because there isn't anything to meaningfully attack. Chats and chat backups are not encrypted by default.

That's a big advantage, and a very important one. But definitely, that and the superior crypto is what keeps me on the app. Telegram is in a whole different level when it comes to usability and refinement.

>Signals crypto is used by Facebook and was sponsored by the US Govt

Funny that you're talking about FUD.

It is not FUD.

OWS was financed by Open Technology Fund, to the tune of almost $3M, during the years 2013-2016. See here: https://www.opentech.fund/results/supported-projects/open-wh...

What is Open Technology Fund? It is a program of Radio Free Asia, which run by US Agency for Global Media, funded by US Congress.

Hey, advisor for a non-signal E2EE chat service here that also benefited from the Open Technology Fund.

I recognize that you'd basically just be taking my word for it, but literally all they did was take an application from us, approve it after doing their diligence, and paying Cure53 for an assessment. There was no other involvement or, as you're implying, interference.

Just my experience, but I'm publishing this because the fud breaks my heart. OTF does good work.

It could be, I believe what you say is very much the truth.

But that doesn't really matter. Even by doing that. these two are associated. Imagine, if there was a non-profit, that took money from some Kremlin or Fobidden City development program, using exactly the same procedure. Would be that non-profit trustworthy going forward, given their association?

So this one is the same, just with red and white stripes. Definitely not FUD, they did take money from US Gov agency.

> Would be that non-profit trustworthy going forward, given their association?

Kinda depends. If the money was authorized by a parliamentary body (with clear legal text around who's receiving funding, what the conditions are, etc), I wouldn't be so worried. If it was authorized by an executive as a disbursement from a random pot, I'd be more worried about strings.

Ergo my comfort with US congressional funding v. a DARPA grant or In-Q-Tel investment.

>Would be that non-profit trustworthy going forward, given their association?

As long as the product is proprietary, no.

In my experience, most people who project nefarious intentions on the government have no experience working with or within the government. The government, after all, is a big thing with no unified goals or intentions. But for some reason, for some people, 'government' always means 'bad'.

To be fair it usually is bad when it comes to matters of privacy and being open and honest about said privacy.

Governments gave us things like GDPR and HIPAA.

That is not the point. The point is what does the funding get them? A backdoor? The algorithm as well as the client source are open for audit and have been audited multiple times.

Last I checked, end-to-end was only available on the phone app (not the desktop client) and only for one-on-one conversations. That's a pretty huge difference, but one that most people won't even understand or care about.

But the simple fact is that for most people the security profile of Telegram is good enough and its UI is miles ahead of Signal.

I've already complained about that in the past but the fact that the desktop client still won't let me set the spellchecking language is baffling to me. It's an application that's meant mainly for exchanging text, and it won't let me configure the spellchecking, and let's not even talk about formatting options.

It amused me when in the announcement they said that the reason for testing the payments in the UK was that they were English speaking. You can tell that this is an application developed my monolinguals...

FWIW, if you’re on macOS at least, private chats are supported under the Cocoa client.

Most non profit work in the US is somewhat funded by the US government via grants and crap ... 80% to be exact.

Can you share what you have discovered about Telegram's crypto implementation in these 15 minutes of research when you did them? That would be far more useful than just leaving a teaser without anything concrete.

Matrix has E2EE cloud chats

Reply on news.ycombinator.com