Telegram Hits 2B Messages Sent Daily
telegram.org
telegram.org
T: "Our security system is so secure that we'll give you a prize if you manage to break in through the front door"
HN: "But real criminals won't necessarily use the front door. What about other potential points of entry?"
T: "We won't confirm or deny the existence of any other point of entry, and to be clear, the competition is strictly about the security that our front door provides"
Is this still the case?
So far I have been happy with it, even though only like 5 of my friends use it. Yeah, it may (or may not) have security flaws like many on HN complain, but I would take it anyday over FB owned give-us-all-your-data product.
??
Can you use telegram from another device? I think WhatsApp now has a windows client, maybe macos as well, recently announced.
No idea what the security is like though.
--edit-- Erm, I'm confused at the downvote, the parent raised a series of objections to WhatsApp and I asked for clarification of what they meant and suggested a non-phone client was available.
I've done the research now and it turns out to be utterly useless if your phone's out of batteries as it does some sort of sync'ing and relies on the phone being on, so it's not fit for the purpose.
But I'm still mystified at the downvote...
--edit 2-- More downvotes! Yay! Wtf?
Because yes, you can.
WhatsApp on the other hand only works in one device (your phone). They released a webchat, that just works as a proxy to connect to your phone. So in order to use the WhatsApp web, you need your phone on and with internet connection.
And if you want to build an app using the telegram system it's basically using their cloud servers.
Does anyone know what their tech stack is?
http://www.alexrad.me/discourse/a-264-attack-on-telegram-and...
WhatsApp used port 443 but sent plain text messages for years. Only fairly recently they switched around to actual encryption.
Telegram messages have never been readable across the network and they claim that they also can't read the messages themselves. This is due to storing the encryption key in a different data center, but that begs for the question of how they deliver my phone the message if they don't have the decryption key. (Answering "incorrectly" that they can read my messages was how I didn't make it on the support team.)
Then there is MTProto which everyone is buzzing about but which isn't even supported in all clients. This is the "secret chat" feature you see here and there, and it is actually encrypted end to end (and verifyably so). Clients are all open source so we can check that they are end to end encrypted -- WhatsApp or Facebook can ship you a backdoored version and you'd never be the wiser.
Saying Telegram is "not encrypted by default" is like saying "https is not encrypted by default" because the server software can read the private messages you send to other people.
End to end encryption isn't enabled by default though, the argument being that this way you lose some features (like a shared history on their servers..).
If an attacker were to record all of a target’s ciphertext traffic over some extended period of time, and then compromise that one key at any point in the future (perhaps by seizing the device it’s on), they would have the ability to decrypt all of the previously recorded ciphertext traffic belonging to the target.
Am I the only one that can't stand having people know when I've read their messages? It seems like every major chat platform (except for iMessage) has read receipts enabled without any option to disable them. Why has this become so popular?
It settles the age old question of "Hey, did you get my message?". Many people like this functionality.
I prefer to be able to read and reply later if I want to without feeling guilty that it'll look like I just couldn't be bothered. I mean, it's true, I couldn't be bothered, I just don't want to broadcast that fact :p
Having said that I really like it and am encouraging my group to switch to test it out.
I wonder how effective that will be: "The Inertia ... the inertia" (said in full-on Marlon Brando Apocalypse Now voice)
Telegram hit 1 billion messages in December 2014, and had 50 million active users at that time[1].
So, is it reasonable to assume that WhatsApp sends around 16 billion messages every day?
How is that sustainable?
My only guess is that they are planning to charge for their api when they hit scale.
EDIT: I want a polished official product, not something put together in a hackathon: https://telegram.org/blog/bb-results
I'm okay with a price for something that I might use every day, but if I'm accepting closed source solutions - what's the benefit of Threema here?
If you'd want to believe their promise [2] they do plan to open up everything, but at the moment they're a closed source IM provider.
But that's irrelevant. The GP hijacked a thread about Telegram with Threema, with a three letter acronym and nothing else. For me, Telegram and Threema have the same flaw (not open). If I'd have to pick one of the two, I'd go with Telegram I guess - it's free (as in beer) and offers clients for nearly every platform I could care about.
So 'Telegram isn't open either' is correct, but misses the point: Given 'Threema FTW' my reaction was 'Why'?
1: When I wrote Why is another closed source/paid product better than this one? I tried to say (not my native language) Why is Threema, a closed source/paid product, better than this (closed source) one?
2: https://telegram.org/faq#q-why-not-open-source-everything
I like to tell myself that this is because the really good open source options don't have enough money or clout to make themselves popular, while apps like Whatsapp or Skype or Telegram do. It's just unfortunate that the least secure apps and services get pushed to the mainstream simply because of money.
Personally, I'm doing a last effort to use xmpp right now (just in the process to migrate to the unreleased prosody 0.10 for some features that I require) and otherwise Telegram looks like the 'sanest' option so far.
Doesn't require a phone number as identifier
Clients for ~all~ platforms that I care about
[0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...
- Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven
- End to end encryption isn't the default
While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems.
So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem.
Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either.
Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
"Hey look! We invented this novel cryptosystem and, despite it being unproven and not having it validated by anyone, we reckon it's the most secure thing ever!"
Which you could really say about all the services you mentioned.
The difference is in who's footing the bill for all the other costs.
The founder of Telegram is a privacy and civil liberties activist who has publicly committed to keeping Telegram as secure as possible, and that until a revenue model is determined that honors that standard, he'll continue funding it on his own (he's loaded from equity in VKontakte).
What else are you looking for?
https://telegram.org/faq#q-how-secure-is-telegram
That is clearly prioritizing user convenience over "as secure as possible".
Yes, it could be better, but it's still better than whatsapp, facebook messenger and sms
(I'm a telegram user, and wouldn't be if it didn't sync across devices)
So the share with server by default, brag about security approach is really bad, especially in the instances where the need for security is very clear.
It also seems to be the case that Telegram is not making users aware enough of the importance of verifying the keys used to establish the secret chats (see the link here https://news.ycombinator.com/item?id=9538879 , users are sharing channel keys over the channel they are trying to establish). So there is a second level of traps that a user has to avoid to even have a chance of using Telegram securely.
IIRC the folks at Open Whisper Systems (TextSecure, Redphone and Signal) did some work with them to integrate the TextSecure protocol into that.
So while I use TextSecure with friends who are happy to use that, I'm not upset about using WhatsApp with others as it's more mainstream and friendly, but has decent security under the hood.
- Your WhatsApp messages don't use that 'security' by default (or do they?)
- That thing isn't open source and they could rip or swap out any encryption support they offer
And I know they didn't implement it for group chats, only 1-1 so far.
And yes, you're correct, they could rip it out at any moment, in fact they could already have done so, and as a facebook subsidiary I'm not huge on the idea of trusting them.
OTOH getting the whisper systems folks in was positive and from reading what they wrote about it, it didn't seem they were just being used for a PR exercise.
I feel that Silent Text is omitted from these lists too frequently, unfortunately, as it's one of the most secure texting apps currently on the market (I would know, I work for SC).
http://blogs.wsj.com/digits/2015/04/17/whatsapp-hits-800000-...
I haven't heard the final word on that. For all we know Facebook could pull the plug on the "in-development E2E encryption" in the next few months and act like nothing changed. Whatsapp has never made a public statement about it so you can't trust that it uses "decent security under the hood" right now.
When they make a public statement about rolling out E2E encryption to all of its clients and change their Privacy Policy to reflect that change (since they aren't supposed to "get your data" with E2E encryption anymore - therefore if the Privacy Policy doesn't reflect it, that means they aren't using E2E encryption) then we can at least have a reasonable expectation of them committing to it (even if in theory they could still bypass it and we would never know, because it's a closed source app, but at least if we do find out about it, we can hold them to it - right now we can't hold them to anything because they've never said anything about the E2E encryption themselves).
I tried to get my friends on Tox, but ultimately had to get them on Telegram because it was the only app that was truly 100% cross-platform.
But let's be honest: xmpp is still not there. To have something comparable to what these clients offer you need a good number of extensions, notably (ymmv)
- Message carbons (i.e. a message reaches all online devices)
- Stream management (because without it, people are going to consider xmpp broken. "It loses my messages")
- MAM (for shared archives between clients/devices, the reason for me upgrading to an unstable server now)
Given that one of these isn't even (widely) available so far, I'd say xmpp is in a bad position. I love the idea. But it's hard to imagine that it can gain traction right now, given that the 'only' thing it has to offer against all the other systems is federation. I care about that. But .. most don't.
I was hopeful when I saw that duckduckgo[ddg], fastmail[fm] and mailbox.org[m] had public chat services. But of the three, none support standard archiving [XEP-0136] and only fastmail supports a custom form of archiving (via special emails to your fastmail-account). The latter at least gives you an option to archive chats (for eg: search) -- but it appears there's a market for a good, public and full-featured xmpp/chat service.
Most of the other public servers appear to a) be free-only -- not a business -- and b) focused on privacy. I find it a bit surprising that noone has tried launching a free+paid option -- say reserving some features for paying users (and charge maybe 1 USD/month?).
Actually, I think duckduckgo.com would be happy to "host" a services free tier -- have a trial account mode, and point user that just want a free chat service to ddg. Ddg gets more registered users, more users of their services, and those that are willing to pay for some features (eg: server side archiving, server side notes... others?) can pay a small amount for the service.
Only draw back would be no seamless transition from one to the other (change of username/domain). On the plus side, all my trial accounts can talk to each other without problem (via server side federation) -- it just works.
[ddg] https://duck.co/blog/using-pidgin-with-xmpp-jabber
[fm] https://www.fastmail.com/help/clients/chat.html
[m] https://mailbox.org/en/mailbox-org-launched-secure-instant-m...
[edit: And while mailbox.org has an interesting offering, like some kind of deal with yubikey -- they seem to have neglected their xmpp setup somewhat -- there are some issues with ssl certs. Pidigin can't seem to figure out that xmpp at fastmail is chat.messagingengine.com, nor that mailbox uses xmpp.mailbox.org. Both give additional certificate errors if not adjusted. I suppose fastmail hasn't set up srv-records/dns aliases for their vanity domains (I registered mm.st -- as it was the shortest). It'd be better if one could just type in <user>@mm.st and have everything work. The bug might be in Pidgin, but fm really needs to test things. Of the three, ddg was by far the easiest to get started with -- register right in the im client (which also generates an account that works for ddg); and go.]
Bad: Lots of things you take for granted if you look into WhatsApp/Hangouts/Telegram et al are extensions, lots of these extensions are optional, lots of optional extensions are not supported in a coherent way.
Somewhat bad: Archives had a decent XEP, but it's not 136. It's 313 (which I mentioned above, MAM). You probably won't find any improvements in 136, it's - as far as I can tell - considered superseded, although 313 is still not really available (which is the reason for me listing this as 'bad').
Good: Running your own server is trivial. Really. People always say that running a mail server is hard and - maybe it is. It certainly has a number of issues you can run into. Running an XMPP server? Install, configure, done. Easy. Give it a try this weekend?
Thanks for the reality-check on server-side archiving :-/
As for running the server being trivial: I can believe that (I do run my own mail). I'm not really in a hurry to set it up for myself -- I have most people I chat with on xmpp (still!) on fb -- and they won't be moving any time soon.
I'll set it up as I move into my new dedicated server. My current "main" vps is running Debian oldstable lts, and I really don't want to set up anything new on that box, as I'm transitioning away from it.
After playing with Pidgin on windows (for testing the above), I've been playing with the idea of forking it and ripping out all the non-xmpp stuff, and maybe trimming the (G)UI/UX a bit too.
I should perhaps mention that when I occasionally do chat with people it's usually over IRC w/IRSSI.
Plus, it integrates rather cleanly with a good number of systems, in my case it's using dovecot as authentication agent for example (and therefor relies on virtual users specified ~elsewhere~).
It can work. And it's really not hard. It's just not seamless, unfortunately.
the clients are categorically awful :)
re forking:pidgin and libpurple are huge. focussing on webclients first and pidgin gajim etc afterwards is a better bet.
so while it may be that you have a client that you use for android, if you want to talk to other people, you are going to need a client that supports the features they want.
what i am telling you is, is that the clients are a crapshoot that all support their own subsections of features. finding clients that people will use, for every platform is a massive timesink.
my advice therefore, is to pick a nice webclient.
I'm not sure what you mean. Sure facebook and to a lesser extent google are wilfully screwing their users for no good reason (well no good reason for the users). But mailbox.org, fastmail and duckduckgo all federate just fine with each other.
It's not like I'm expecting whatsapp to suddenly enable xmpp and server federation over ssl (does anyone know why google doesn't just turn on ssl for server federation? I could understand killing xmpp, but why keep federation, but refuse to use ssl, on this one service?).
Suprisingly, I can't seem to find anyone that both provides on-line registration, federation and a web client...
In my case, I assume the more pragmatic route would be to set up a gateway to gtalk and fb, leaving me to use whatever client(s) I enjoy. I suppose I might host a public web client as well... but I don't see who would use that, rather than just send me an email, sms or call.
bluescat(probable google employee) says webRTC is the way things are going, so no further development on xmpp. so i think that's the explanation for no s2s tls.
https://productforums.google.com/forum/#!topic/hangouts/T2t1...
xep-0136 is regarded as an overreaching fuckup that nobody will ever get right and 313 is the heir apparent, and it's yet to be delivered.
having been through a lot of this, the issue is not the servers or the features thereof, but cross platform clients which support all the features.
main piece of advice is to settle on a webclient.
Not sure what you mean by "not a good platform". Compared to what?
[1] https://play.google.com/store/apps/details?id=info.guardianp...