Comment by mr_mitm | Hacker News Reader

Comment by mr_mitm | Hacker News Reader

Parent Full thread

> Did anyone expect otherwise?

In a sense, yes. In case you don't speak German, the article [0] touches on this:

> Dass Telegram überhaupt Auskunft über Nutzer an Behörden erteilt, markiert zumindest eine vorsichtige Kehrtwende im Kurs des 2013 gegründeten Unternehmens. Lange bekamen deutsche Ermittler keinerlei Antworten, wenn sie wissen wollten, wer hinter Telegram-Konten steckt, die strafbare Inhalte im Netz verbreiten. Die Betreiber erklären auf ihrer Seite weiterhin: »Bis zum heutigen Tag haben wir 0 Byte Nutzerdaten an Dritte weitergegeben, einschließlich aller Regierungen.«

In a nutshell, this is considered a turning point because Telegram's official stance is (even today) that they don't share data, not even with any government. And now they did, apparently. So yes, this definitely news, if not a bit surprising.

The German government has even made hints that they will seek to ban Telegram from app stores if they continue to refuse to comply with law enforcement [1]

[0] https://www.spiegel.de/netzwelt/apps/telegram-gibt-nutzerdat...

[1] https://www.spiegel.de/netzwelt/netzpolitik/faeser-will-tele...

> Telegram's official stance[...]

... doesn't really matter.

This is something I find surprisingly difficult to get through to people at both a personal and professional level (as I often work in security-related projects).

People speak of whether they trust this or that entity. Reality is that it's an irrelevant discussion. Trusting an organization is always misplaced, no matter who they are. If you hand over data to an organization, you must immediately assume that data is compromised. Yes, that's all SaaS and all cloud providers, for example. Any party who could see the data in unencryted form, you need to assume they have it and can potentially at some point abuse it.

This has nothing to do with the ethics of whoever is running the given organization at the moment. There are many points in time in various organizations where they truly protect the data. I thank you. But it's not a stable situation. Things can change. Less ethical management can come in during a reorg and suddenly everything is fair game and the consumer won't know until it is too late. And always there is the threat of governments demanding the data, at which point no matter how ethical the organization may be, nothing matters since there is nothing they can do.

For any data that could at any level be potentially sensitive, you must make sure it is either not sent through third parties at all, or be encrypted with keys that only you control. Otherwise, assume it is compromised and sold to every bidder.

This is why Apple is also not the solution for security or privacy.

>> In a nutshell, this is considered a turning point because Telegram's official stance is (even today) that they don't share data, not even with any government.

If you care about your privacy the "official stance" alone is close to worthless. That includes governments and corporations as well. I think we already learned that. Just like on security you need in defense in depth on privacy(i.e. hardware, software, and "official policy" as well).

Their stance has always been that they don't protect terrorism suspects, they even had a channel where they reported how many ISIS groups/channels got shut down.

Reply on news.ycombinator.com