Hacker News Reader

Comment by ixwt | Hacker News Reader

Another thing that wasn't pointed out: Du Rove said "Signal messages have been exploited against them in US courts or media."

This would be the same case for Telegram as well, if someone has your phone. I believe that Signal can have a lock on the client, and the database is encrypted.

The other part that Du Rove conveniently left out: Signal went against the US courts and won [0]. When subpoenaed to give all user information they gave them all that had: the unix timestamp of when the account was created, and the last date you connected to the signal service. That was in late 2021. I'm really curious as to what Telegram has told the FSB.

[0]: https://signal.org/bigbrother/cd-california-grand-jury/

View on HN

Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern.

The bigger problem with Telegram is that it by default has insecure encryption settings (as opposed to Signal, where encrypted is the default, you need to manually activate it with Telegram + I think it's not possible to enable for all chats and clients) and to my knowledge, Telegram will outright co-operate with law enforcement agencies to just hand over unencrypted communications. I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default

> security dark pattern - make privacy a big selling point, but then don't activate the security by default

pretty similar to whatsapp. they boast end to end encryption, but business account (all of them now) uses the facebook server's key, so that the business can give access to several other clients to answer customers. they still call it end to end encryption, and this was actually the last crap the original founder accepted before leaving with lots of money on the table.

“All of them” in what sense?

I use WhatsApp dozens of times a day, and interact with business accounts every couple months at most.

Good for you, you probably do not live in a country under digital colonialism where the gov allowed facebook et al to force internet providers to tax the pop with absurdly low and expensive data limits and then "not count" things like facebook and whatsapp and one music app.

In most of the global south, 100% of business have a whatsapp. In those places it pretty much replaced telephone and the green whatsapp icon is now what the current young generation recognize as the we did the black telephone outline on a business front next to a number.

and if you own a business, or is self employed, it is even worse: you live by that app.

Are you saying this is a worse alternative to other communication methods with businesses? What would you use with them that has better encryption?

The lack of encryption between myself and a business is less offensive than replacing an open standard (plain old telephone systems, eMail) with a proprietary and closed one, backed by a single, private corporation

I don't think they've been replaced, though?

De jure or de facto?

Neither.

i completely agree with your sentiment, but i will also say this.

As an expat, this feature has enabled me to transact with locals from the convenience of my phone, even though i don't have any local line and i will not bother to get a local SIM card, nor do i want to have a US SIM and a local one interchangeably.

It also enables me to be very effective when requesting services on demand, and cutting thru the on-hold time, disconnected calls, or the needless chitchat.

I have many bad things to say about WA, but making living more difficult in a foreign country is not one of them.

All of that can be achieved in the same way via email.

All of that can also be achieved by pigeon post.

The only difference is that email is more sane and actually does the job.

See, that's the problem.

Telephony is an artificial monopoly. There's not a single reason why you cannot call everyone around the globe for mostly free, as whatsapp proves. Yet here we are.

EDIT: Disregard below. I'm an idiot when it comes to maps. The statement regarding if the developers are still Russian I believe is still relevant.

Considering the state of Saudi Arabia, having it there is marginally better, but still problematic.

And if the developers are still Russian, there's nothing saying they aren't being squeezed unless their families came with them to Dubai.

Dubai is in the UAE, not Saudi Arabia

> I'd personally argue that's a security dark pattern - make privacy a big selling point, but then don't activate the security by default

I think it's a great approach instead: the secure, end to end encryption is there and it's ready to be used.

You can easily activated it but you aren't burdened by it for 99% of the time when e2e encryption is not needed.

> You can easily activated it but you aren't burdened by it for 99% of the time when e2e encryption is not needed.

So, in those 1% of the cases when you actually need it, you're instantly flagging yourself as doing something fishy? Because if it ever comes down to it, good luck proving otherwise in a court.

That's like the whole point of why it should be on by default. Not because me making dinner plans is something super-secret that needs to be e2e-encrypted, but because those two scenarios need to be indistinguishable from each other for e2e to be effective.

Yes. Additionally you are at bare minimum signalling that the metadata of the encrypted comms is worth further analysis.

For exactly the same reason if you have a paper shredder, you don't only shred confidential material, you shred a bunch of junk as well to make it harder to find which pieces to reconstruct.

> because the FSB was demanding info from them

But they gave the FSB info they asked for -- the vk.com website (facebook clone, at that time it had way more massive amounts of user data than telegram). They could have deleted the data, but no, they handed it over to FSB.

I will point out, in their defence, they handed it over to an organisation that has a habit of assisting people in learning how to fly from windows. This isn't to say Telegram is secure but that it's unlikely they "could have deleted the data" and remained alive.

FSB mostly wanted to prevent people organizing, and that would serve it well. They already had another popular service (odnoklassniki.ru) where to direct people.

vk.com and telegram have nothing in common, except the founder. Durov was forced to sell his part in the vk.com and telegram development started after that as a response.

> vk.com and telegram have nothing in common, except the founder.

This is a deeply funny sentence.

"Other than that, Mrs. Lincoln, how was the play?"

You conveniently forgot about the second part of that comment. Durov was forced out of the country and had to cell vk.com for peanuts because of his refusal to cooperate with the government. He is still pissed off at the country at large (not just the government) and refused to add the Russian translation for years, for example, despite it having absolutely nothing to do with Putin.

Since he is Russian in origin, it's okay to throw baseless accusations at him and spout nonsense like "maybe they're FSB agents" or "maybe they hired an FSB agent without knowing it". You see it here everywhere, and HN is one of the better sites in that regard. Well, maybe Signal has hired an NSA agent and doesn't know about it either? How does that sound?

> Durov was forced out of the country and had to cell vk.com for peanuts because of his refusal to cooperate with the government.

It wouldn't be the first time a cover story was ever used.

> Well, maybe Signal has hired an NSA agent and doesn't know about it either? How does that sound?

You should presume they're trying. I, frankly, presume they've succeeded, either in placing an agent or by compromising something, in virtually every prominent messaging platform.

> Telegram iirc moved it's lead developers to Dubai specifically because the FSB was demanding info from them, so you could argue that's an unfounded concern.

I'd argue it's not giving us any certainty. They could've moved away to escape. They could've moved away to a nice FSB-sponsored location while making good publicity. Ideally the tech should be good enough for this issue to not matter.

To add to this: and they may have hired a FSB agent without knowing it.

"Winning" would mean not having to comply with the subpoena...

The winning in this case was they had to fight to be allowed to release what they provided.

As nice as it would be to not have to provide that information, Signal proved that the only information they have to give is largely useless to law enforcement.

So they lost and have to give up the information/metadata they have. It's just good news that it wasn't much. But that's not guaranteed to always be the case.

No, you're misunderstanding the situation. Companies can't legally refuse to provide information in the jurisdiction they're in some cases, especially when there's a court order. Every company is subject to someone's jurisdiction.

Signal prepared ahead for that eventuality and designed it so that their services received stored only the absolute bare minimum of information, and that most importantly didn't preserve the metadata of chats and calls. This is unlike Meta, for instance, which does keep that data for WhatsApp even though the chats themselves are encrypted.

That means that what they provided in that particular subpoena is all they can provide from their server records for any user of Signal, not that it's all that was available in that particular case.

It would've been even more anonymous if not for the phone number requirement, but I can understand why they made that trade off and given the lack of metadata it's not that useful to law enforcement/surveillance agencies in any case.

> they gave them all that had: the unix timestamp of when the account was created, and the last date you connected to the signal service.

I'm confused. Signal also has your phone number because they require it, that's the primary privacy criticism against Signal.

I believe they have your phone number hashed not in plaintext, also they rolled in usernames recently and option to not expose your phone number to anyone, which addressed privacy concerns

I don't know how they store phone numbers, but hopefully not hashed since the search space is trivially tiny.

The usernames thing does not address any interesting concern. I don't care to show my friends who I chat with my name and phone. They already know these after all.

What I care about is not having to give Signal (the company) my phone number. That's not something they should have.

Telegram has moved to Dubai long ago so no idea where you get the idea that FSB can strong-arm them from.

As I stated in a sister comment, Dubai is marginally better, but not significantly better. If it's the same original developers, they could be squeezed through their family.

Same goes for Signal devs, or any devs really. You're only stating the obvious: humans can be forced and coerced given enough motivation and resources.

Singling out Telegram, or Signal, or any other service's devs is not advancing any argument forward.

No, telegram is especially concerning given how insecure it is by default.

There is more reason to be concerned about Telegram than most other similar services.

Partly because it’s insecure by default, which makes a large percentage of conversations vulnerable.

And also because the team behind it is very susceptible to pressure from the Russian government, which is especially bad when it comes to these things. Even if some of them are based out of Dubai now, it doesn’t mean that they aren’t still at risk of coercion, either directly or through for example threats against family members who remain in the country.

If you don’t trust Russia, which you shouldn’t, then don’t trust Telegram with anything sensitive.

Whom should we trust then? Have we already forgotten about Snowden?

Can we trust some more than others without trusting anyone completely?

I for one trust that there are more Americans who would say no to the NSA when they have a legal basis for doing so than there are Russians saying no to the FSB.

The state of the rule of law is certainly not great anywhere in the world right now. But it's far worse in some places than in others. The difference still matters to some degree.

> Can we trust some more than others

No, we cannot, so yours and other comments come across as picking favorites. As an Eastern European I'll state that I distrust USA as much as I distrust Russia, China and North Korea. All nations with ambitions use every dirty trick known to man.

> Even if some of them are based out of Dubai now

Not to mention there's not much reason to trust UAE any more than there is to trust Russia.

Yes, and?

I just found the mention of the state confusing because surely this app is equally untrustworthy regardless of its origin. American companies can't be trusted either—they've long since indicated a willingness to work with law enforcement and intelligence. E2e encryption is the only meaningful answer.

Yeah I agree with that, I am always baffled why people single out Russia as if it's the Cold War; none of the major powers can be trusted at all, some are just more covert than others but I guess "out of sight, out of mind" applies in full force even for a seemingly less-biased audience like HN.

As for E2E encryption, eh, this topic has been beaten to death many times. Its UX is difficult so many apps like WhatsApp and Telegram do UX tradeoffs, quite successfully so I'd say.

Ah yes, Dubai the bastion of integrity, equality and human rights.

True, they aren't. Whether they're friends with Russia is another thing though.

They don't have to be friends to turn a blind eye.

If Dubai had to pick between letting some nobody foreign national living on their soil get squeezed by a foreign secret police, or pissing off the Russians, what do you think they would do?

(This isn't a knock on Dubai specifically, substitute them for almost any non-NATO country in the world).

And you think the USA doesn't do such things? If so, that's quite naive.

Did I say that? Did I mention the USA at any point in this discussion? What a strange thing to add. I am not American btw.

I mentioned it because people very easily single out Russia and I think that's quite the outdated sentiment. I'd start with USA, North Korea, China, Russia and Iran -- again, just as a start, and I am sure there are many others that can't be trusted.

Where Telegram's devs and business resides hardly matters IMO. If somebody truly wants to put them under their boot they'll find a way, and that goes for probably half the countries on this planet.

You didn't "mention" it, you implied that I believed this, when it wasn't even part of the discussion. You can believe whatever you want, but you really shouldn't accuse others of such things.

Also: this whole topic is about a Russian company/app and Russian citizens living in Dubai. What other country would we be talking about here, exactly?

Well then, your goal was just to point out that Dubai is a bad place for democracy -- and nothing else?

If so, OK.

Did you hear about a russian pilot who defected to Ukraine and then was killed in Spain?

https://www.nytimes.com/2024/02/20/world/europe/russian-pilo...

If russia wants to find and kill you they will.

Okay, and your concussion in relation to the topic is...?

> If russia wants to find and kill you they will.

If whatever State/Government wants to find and kill you they will.

Hardy har har har. How quaint.

Guess you never heard of polonium either.

https://www.theguardian.com/world/2016/mar/06/alexander-litv...

I heard. Your point?

They have a long reach and like to be brutal for effect.

Death is death, whether it's brutal or not, your dead corpse will not care.

Still no idea what your argument is. Or that of the grand-parent comment. "Oh look, Russia is poisoning people!" Yeah, we knew that ever since the Cold War. Show me a nation that doesn't persecute people it doesn't like.

Much more recently using Novichok: https://en.wikipedia.org/wiki/Poisoning_of_Sergei_and_Yulia_...

Durov travels freely to and from Russia and several of their employees are still based in Russia. So yeah, the FSB have leverage if they need to use it.

You say it like it's a fact, so I assume you have proof? Durov is very vocal about being in exile so this looks doubtful.

That's the tune of every Russian oligarch that doesn't want to get caught up in a sanctions regime that makes their Paris/Milan shopping trips a pain.

And this comment provided zero proof, exactly as expected.

> Durov travels freely to and from Russia

This is incorrect. Check your facts. They're made up.

The database is encrypted, and the password is right next to the database in a json file.

On desktop, on Android and iOS it uses the OS keystore. It really should do on desktop as well, Windows, Mac and Linux (through freedesktop standard) all have APIs for that, there really isn't much excuse. Desktop Signal has always had terrible security, unfortunately.

Reply on news.ycombinator.com