Hacker News Reader

Comment by okamiueru | Hacker News Reader

What would you say are the cons of Telegram?

I've been highly impressed with the UX for quite some time, but have refrained from pushing it (and the likes) onto friends. My family and friends seems to have slowly drifted towards signal, and I haven't bothered affecting that, but if I would go from a pure UX, I'd suggest telegram. So, I'm genuinely curious to know others' thoughts on it. I have only limited knowledge, just vague recollections of Russian developers (?), which might or might not have distanced themselves from political pressure (?), as well as the app itself being somewhat open sourced (?), based on the same protocol as signal (?).

View on HN

Telegrams stupidity was marketing itself as secure. If it never had, then all arguments and sour intent towards it would be hugely misplaced.

As it stands, it’s not E2E by default and it’s E2E scheme is homegrown- which is usually not recommended (though IMO was not a dealbreaker), the big issue there was that there were flaws in the original design of the encryption scheme which makes it harder to look passed the fact it’s homegrown.

Telegram can intercept most messages on the platform, however, ultimately I trust them more than Facebook; so I’m less concerned.

Additionally, since Facebook controls _both_ ends of whatsapp _and_ does not support third party programs, then even though WhatsApp is E2E there’s little preventing Facebook from pushing an update to your phone which backs up all your chats to their cloud.

> As it stands, it’s not E2E by default

Yes, and enabling E2E "secret chats" on Telegram actually hurts user experience, so most non-tech-savvy users avoid it. Additionally, your address book is continuously synced to Telegram servers.

> there’s little preventing Facebook from pushing an update to your phone which backs up all your chats to their cloud

Just to add to your point- WhatsApp currently backs up your chat history to Google Drive or iCloud unencrypted. It requires opt-in but they nudge you frequently.

> Additionally, your address book is continuously synced to Telegram servers.

It doesn't even need access to contacts to run, and it happily runs on machines that don't even have address books (and, might I add, has the best UX there as well).

What you do need, at least for initial signup, is the ability to receive SMS, like you do with Signal. I wish all of them would just stop that nonsense.

> cons of Telegram?

Also, Telegram is not federated. It is just another vendor lock-in.

https://github.com/telegramdesktop/tdesktop/issues/6841

https://github.com/telegramdesktop/tdesktop/issues/16068

Contrast that to email. Even if gmail.com bans you or shuts down, you can still use a different email vendor or self-host. (You lose your old email address if you don't own a domain, but you can still communicate with others.) The only good IM that has this characteristic seems Matrix.

As we've seen from XMPP and Matrix federation comes with it's own set of tradeoffs. Matrix (specifically the element client) has come very far but it's still not at a state where I can reccomended it to non technical acquaintances.

My non-tehnical acquaintances are using it just fine. Any particular issues you've been having?

It's been a while since I checked it out but key management on encrypted group chats.

Perhaps you tried it before key cross-signing? In that case, you had to verify each of your devices with each of your participants devices. Now you only need to verify once per participant. It's much better now in general.

I am also a happy Telegram user and think it offers amazing UX but if you leave WhatsApp due to privacy concerns, Telegram might not be the right solution. All Groups and by default any other conversation you have are only encrypted in transport between your client and their servers. Also their encryption has been called into question a lot at the beginning.

As other the other answers state: It's them rolling their own cryptography. Also, not having E2EE in group chats. Their UX is really good and I agree with you, going from that alone I would always suggest Telegram too.

There are other considerations too, like that fact that I often got notifications that someone joined Telegram but that person was a friend of a friend and not in my personal contact list. One of my friends works for an actor's agency and then I got notifications when some of his clients joined the platform. I'm pretty sure they weren't aware of it and from a privacy standpoint this is very questionalbe and left a very sour taste. I always feared that I missed a privacy setting and am exposed the same way.

If that person is your contacts, you get a notification.

If you're in someone else's contacts, they'll get a notification when you sign up too.

Contact information gets uploaded (Name, Email, Phone Number) so that they can generate "rich" push notifications, as the server issuing the push has to produce the message (no code can run client side).

More info here, though could be outdated (2013): https://news.ycombinator.com/item?id=6915194

Group messages in Telegram arent e2ee just because of their design choice. You cant enable it like you can for the 1:1 chat.

I think the most common complaint is that group chats are not encrypted, and regular chats are also unencrypted by default.

Which has benefit so that you can see past messages. This why I think Telegram is a perfect place for hosting public groups chat (like an IRC but with better usability).

They are encrypted, just like everything else in the app, just not E2E. There's a big difference between no encryption and encryption that isn't E2E.

Yes, one of those means the server can see all your messages and the other means it can't.

Transport encryption has been the default for almost all internet traffic for some years so it's no longer something that you can reasonably not have.

I believe the most commonly cited criticism is that they rolled their own cryptographic solution.

Reply on news.ycombinator.com