Hacker News Reader

Comment by m_mueller | Hacker News Reader

Yes it does. Show me another non-profit Open Source (mostly) IM service that invests this heavily in seamless encryption and I'll change my opinion. The weakness that they found could have easily been brushed off as non-exploitable, yet they didn't, instead encouraging more security experts to become involved by paying out immediately.

View on HN

To name just one alternative, the OTR developers have done far more to make seamless, open source encryption of IMs possible than Telegram - regardless of how much cash Telegram are willing to throw around. Even if the secret chat feature worked perfectly as intended, it'd still be both less usable and less secure than OTR. It requires users to manually validate key hashes in order to stay secure, a requirement the OTR developers dealt with years ago because they found users simply didn't do it. It also lacks forward secrecy which is especially important for mobile devices that can be stolen or lost.

OTR sounds great, I just wish I'd find an easy-to-setup-and-use, good looking Windows client, such that I could convince non technical decision makers to adopt it. Adium does that for me on OSX, but I don't think Pidgin is a good match, except if something big has changed since 2-3 years ago when I last gave it a try.

Investing heavily is meaningless if you're investing badly.

Building an encrypted IM service with bad crypto is like investing in blacksmiths in the early 1900s.

The question whether their Crypto is bad is still out IMO - these recent findings still don't seem to be that big of a deal to me - as with all other IM services I have to trust the service provider for their integrity - yet here I have an alternative provided by a non-profit organization with some scientific credentials that offer an open API - as opposed to Skype, WhatsApp, Facebook et al. We currently use Skype for business purposes, but Microsoft's investment away from P2P makes me think that for privacy reasons alone, it's a bad idea. I'm always open for suggestions, but so far I haven't found anything really viable (well designed clients, well integrated encryption, open APIs). That's why I'm excited for Telegram.

What's wrong with encrypted Jabber?

On OSX I'm happy with Adium, but last time I've used Pidgin it was a lot of work to configure it the way I want. That would still work for me, but to roll it out for an organization it would meet quite some resistance. So the problem with XMPP for me is the client situation.

> So the problem with XMPP for me is the client situation

... which is fixed by a better client. That requires skills, but different ones from designing a new crypto protocol.

Given the PR efforts of the telegram people, they might actually be better XMPP+OTR+TextSecure+... client implementers than crypto designers (and maybe even better client implementers than most of the people who build clients right now since the situation _is_ bad).

I agree with that. Why they didn't go with this route is something I'd like to know as well - Telegram's FAQ is quite vague on this issue. But still, I prefer a reasonably secure service with great clients on all platforms, over a perfectly secure service with ugly clients that I can never 'sell' to decision makers.

> provided by a non-profit organization

huh?

Are you trolling or for real? 1) Telegram is NOT open soure. 2) OTR has been around for years.

> Show me another non-profit Open Source (mostly) IM service that invests this heavily in seamless encryption and I'll change my opinion.

You can't measure how secure something is by looking at how much money has been invested in it.

Reply on news.ycombinator.com