That's what the other user said and it is still incorrect. [0] People either don't read the basic FAQ or conflate E2EE to being the only encryption in the world, which is ridiculous.
I suppose there are some people pit there that think "unencrypted" here means everyone can listen in, but certainly not the hackernews crowd.
Heh, we've come far. True unencrypted chat was once popular, and technically still exists (although most IRC networks now default people to TLS.)
I read the FAQ and even skimmed the MTProto 2.0 docs but from where I stand this Server-Client encryption sounds like encryption in transit but the server still has the ability to decrypt.
This, from a privacy against law enforcement perspective (which is what the article and comments are about), is more or less the same as no encryption.
Edit: s/transport/transit/, add "perspective" to the last paragraph.
The encryption part [1] is covered in the FAQ, along with more details.
Also see the question and answer on “Fo you process data requests?” [2]
Telegram has a feature called secret chats, which are only person-to-person. That uses end-to-end encryption.
[1]: https://telegram.org/faq#q-so-how-do-you-encrypt-data
[2]: https://telegram.org/faq#q-do-you-process-data-requests
Also they should now update that FAQ answer where they say:
> To this day, we have disclosed 0 bytes of user data to third parties, including governments.
In fact, if the OP is indeed true, they should probably update the entire answer since it's misguiding at best, and an outright lie at worst.
For E2EE, you need to open seperate 1 on 1 chat, which is optional, not default.
And what it comes to group chats or channels, none supports E2EE.
It's like going outside in the rain, getting wet and saying "Well, it's not actually raining, I didn't get a pint of water in my boots."
We have clearly talked about E2EE (end-to-end encryption) and server side encryption is not that. E2EE means that it is encrypted between you and the message target. Server is the middle man, which should not have the access.
Almost everything is already encrypted with TLS on the current world during transmissions and regulations require server side encryption. It is not even our main interest to talk about that anymore, we are past that.
The main issue on the original post is the lack of E2EE.
If you put the key next to a locked door it doesn't matter if you lock the door.
Real encryption means that even Telegram couldn't decrypt it.
If you want to discuss E2EE, do so but it does not make it more "real" than other encryption.
Unencrypted is false. Not E2EE is true. Most use the former to wage war against an app they don't like because they prefer an app like Signal that satisfies their desirable qualities. Moxie actually started this trend and it is despicable. I'd say the exact same thing if Durov started referring to E2EE as "pedo-encryption" or anything else that distorts meaning.
Don't distort meaning. Use precise language.
It's an abuse of language to call that encryption because if you say encryption you imply security. But this is not secure and if it's not secure encryption is useless because security is the reason for encryption. Encryption is not used for the sake of encryption but to protect the content of a message from unwanted access.
Yes, that is what Telegram is doing. It may not be protecting the contents from who you want it protected from (everyone but you and the message recipient) but it does protect the contents from other (notice I did not say all) adversaries Telegram and its users don't want accessing.
It is still encrypted so use correct language, please and do not weaponize words to your own designs.
It is more likely that you are trying to weaponize the words for your own designs.
> It is more likely that you are trying to weaponize the words for your own designs.
Please point to where I have weaponized a word because on its face that accusation doesn't make any sense. I have not decided encryption means unencrypted. I have doggedly insisted words be used appropriately and even went so far as to give an example of mischaracterization of E2EE where I would call someone out.
During the transportation of the information for the target recipient, the data in this case is on plaintext at some point on Telegram's server, and therefore it is not encrypted for the whole duration, going against the idea of transferring or holding information only for authorized parties in ciphertext format.
If we think that Telegram is the targeted party, then it would be encrypted as data is transferred or hold in ciphertext format for the whole process. However the Telegram is no the target, and the encryption is removed in the middle of process.
> Please point to where I have weaponized a word because on its face that accusation doesn't make any sense. I have not decided encryption means unencrypted. I have doggedly insisted words be used appropriately and even went so far as to give an example of mischaracterization of E2EE where I would call someone out.
You brought it up in the first place with a twisted definition.
> You brought it up in the first place with a twisted definition.
I did no such thing. You appear to be confusing idealism with the definition of encryption.
In any case we already have words for transport encryption, encryption at rest, and end to end encryption when referring to modes of encrypted data. Those are sufficient to cover the spectrum of encryption which exists. Calling encryption of one mode "unencrypted" which is not your ideal mode of encryption is disingenuous at best.
A better rain analogy would be someone saying 'I'd like to go for a smoke, is it raining', and you reply 'yes' because there is somewhere in the world where it is raining (just not there). You would be technically correct, but in the context of the question, the person was clearly interested in whether it was raining _there_.
It is the only relevant one. Nobody who cares about protected messages would be satisfied with untrustworthy encryption.
Sure, technically even a messenger using Caesar cipher is encrypted, but most people expect more than a ticked checkbox. No real user cares about what technically still counts as encryption, just like nobody outside of biology cares whether walnuts are actually nuts.
Telegram is outright lying of course. I can't remember if WhatsApp uses E2E encryption by default still or not. If not they are equivalent, but telegram isn't better in any meaningful way.
Rather, this is more of a debate of what the layman expects, and frustration with misleading marketing. A great example of this is the whole Zoom debacle; they claimed it was encrypted, people assumed it was E2EE, and got a lot of blowback for that to the point that they ended up implementing E2EE.
Another great example: a few of my friends were using Telegram for a while, and thought it was E2EE until I pointed out that only their "Secret Chat" feature is E2EE.
And if the wording wasn't precise enough, context still matters more in this case. I'm sure everyone here knew what was meant, despite the familiarity with cryptography. Telegram claims your messages are "heavily encrypted" which is just false, aside from their very limited secret chat feature.
HN prefers substantive discussion, not nitpicking over semantics.