Hacker News Reader

Comment by GekkePrutser | Hacker News Reader

I think for open group chats it doesn't really matter. Because anyone can join anyway. Nobody complains that IRC isn't E2E encrypted and still many people use it every day :) That usecase doesn't benefit from it at all.

For closed (invite only) group chats and 1:1 chats I think it should be encrypted by default though. Like WA and Signal. There's the secret chats of course but they only work on one device and not on group chats. Of course key management is hard in those cases but the others have worked around this very well.

I agree that encryption issue doesn't really have any bearing on this bot ban though. This thing wasn't really about surveillance. But the best way to make this appear in the comments is Telegram fixing it :)

Edit: FWIW I really like Telegram because they're open to integration with other networks (eg Matrix) and that they actually allow and embrace bots. But it would be so much better if they did have E2E.

View on HN

I would like to point out that key management is hard when, like telegram, you can seamlessly access your account on multiple devices. See Signal or WhatsApp asking you to be on the same network with your phone etc. This is the only reason I didn't move to Signal yet and I don't think there's (yet) a clear solution.

The Signal desktop application doesn't have such a requirement. Unlike WhatsApp, it doesn't connect to your phone. You just scan a QR code for the initial setup and after that it's completely independent.

WhatsApp is dropping that requirement too by the way. The new system is already in beta.

I trust Telegram E2E implementation more, than Whatsapp. I'm sure that there are no cloud backups (for me and for other person), I'm sure that there's no sync happening (any sync is potential threat to security). All data stays on device and that's about it. It's true end-to-end. Whatsapp and Signal implementations are not End to End. They're something like User to User or Account to Account, with some encrypted copies floating around. They have many ends. That blurs responsibilities.

I hope that their implementation will stay as it is. I'm all for implementing better security for ordinary chats, but they should keep secret chats feature as a restricted high-security channel.

The 'many ends' are really needed to make E2E viable IMO. It's the #1 reason I rarely use the secret chats in Telegram.

And if a security feature has so many drawbacks that nobody uses it, you end up with less security. I'd rather have a flawed E2E implementation than one that is not used at all. For example I recently sent passwords to our Makerspace users in secret chats but half of them didn't see them because they were either on another device or they weren't online (also seems to be a requirement for secret chats). So many of them asked to 'stop being difficult' and send them in a normal chat. This is what I mean. And those people are mostly geeks. If they give up on it, what will normal people do?

If it's not seamless enough, only us crypto geeks will use it and the rest will roll their eyes. It has to work for grandma just as easy as it does for us. And Signal and WhatsApp do really pull that off.

I agree that backups were WhatsApp's weak spot but they are making some good modifications that allow users to store the key themselves.

It would help if the key management could be checked though.. I totally agree with you there. Right now it's not transparent enough, even for those of us who know what they're doing it's not really possible to check with WhatsApp. Signal is another story as it's open source.

Reply on news.ycombinator.com