Hacker News Reader

Comment by aquatica | Hacker News Reader

Says the guy who had a backdoor in their super-secure e2e secret chats

https://words.filippo.io/dispatches/telegram-ecdh/

> super-secure e2e secret chats

Which aren't enabled by default so almost nobody uses them. Telegram users are often surprised to find out their messages aren't end-to-end encrypted at all.

Telegram can be used on multiple devices simultaneously. Syncing the private key for each chat across multiple devices can be an issue. That's why secret chats are only available on the device they were created on, and having encryption on by default would not make sense.

Yet whatsapp and matrix seem to be able to do that just fine, impossible they said

AFAIK, whatsapp is still dependent on your mobile being the primary source. It has "link a device" feature, which has some of the features but cannot be used as an independent client. For example if you're using the web version and want to see some old chats, you can't unless you use it from your mobile. WhatsApp's encryption keys are tied to the device, not the account. In Matrix, encryption keys are tied to the user's account, not the device, and thus it wont be an issue.

> AFAIK, whatsapp is still dependent on your mobile being the primary source. It has "link a device" feature, which has some of the features but cannot be used as an independent client.

Not anymore https://blog.whatsapp.com/one-whatsapp-account-now-across-mu...

> Not anymore

From the blog:

"if your primary device is inactive for a long period, we automatically log you out of all companion devices."

There is one primary device, and multiple linked companion devices. This is different from telegram where there is no primary device.

Also see : https://faq.whatsapp.com/653480766448040

"Not all messages and chats are synced to linked devices from your phone. WhatsApp Desktop syncs more message history than WhatsApp Web. To see or search your full history, check your phone."

Just fine is a bit of an overstatement for matrix. I think it got much better now, but the user experience for multi device key syncing on element and other clients gives room for improvement. I ended up having to reinstall because I could not figure out the mess I created myself. There wer so many keys involved that even having a PhD in computer science I could not easily grasp their meaning and function. I understand at least why key syncing ist not easy and I understand why someone would not support it. I however do not understand telegrams choice of obscure crypto as well as it does not make it easier to support this. But I guess their business model (pushing contextual advertisement into chats) relies on not having crypto.

IIRC ads are only on public channels, where e2e does not make sense

I agree, but most of these issues stem from not having enough funding, as active as matrix seems to be, they are struggling to actually fund its development.

Whatsapp being e2e is almost (but not entirely) worthless, it tells me that they are likely not training LLMs on my messages, but I have zero trust of their safety from client-side backdoors.

The security of e2e cannot be higher than the security of the clients

That's a different conversation, I doubt you can really trust telegram either.

Also don't forget that most people back their stuff to Google Drive/iCloud anyways, so it's not like it's impossible to access.

Reply on news.ycombinator.com