Is Telegram really that bad and should i look more into it or is sticking to signal really the best option?

  • Melody Fwygon@lemmy.one
    link
    fedilink
    English
    arrow-up
    32
    ·
    1 year ago

    Telegram is legitimately bad, it’s only saving grace being that it is STILL BETTER THAN DISCORD! It’s main “Sin” is rolling it’s own Encryption Algorithm; which has been proven to be less than 100% airtight and secure.

    Sadly your average user does not care about privacy above all else. They only care about privacy in as much as it can factually and emotionally affect their daily lives. TL;DR: You have to incentivize them to care, and they will often refuse to move, or outright dislike a platform, if a specific feature they love or depend on doesn’t exist, even when it is 100% not critical to the application’s function.

    • dngray@lemmy.oneM
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      1 year ago

      which has been proven to be less than 100% airtight and secure.

      I don’t believe that has been proven. There has been criticism of it 1, 2 from prominent cryptographers though.

      Telegram’s MTProto protocol isn’t obviously broken in a practical way, concedes Matt Green, a cryptographer at Johns Hopkins University who has consulted for Facebook on encrypted messaging systems. But it’s uniquely “weird,” he says, in a way that suggests its inventors don’t understand tried-and-true cryptography practices and raises his suspicions that it may yet have undiscovered vulnerabilities.

      Their response was even more dodgy trying to somehow inject some sort of “nationalistic”, “america bad” into it:

      Telegram’s Ravdonikas argues that “Telegram encryption relies on classical algorithms, because we consider some approaches promoted by US-based cryptographers after 9-11/the Patriot Act (which your sources refer to as ‘state of the art cryptography’) questionable."

      At the end of the day math is math regardless where it comes from. Secret chats also only work with the mobile client, have to be manually turned on and do not work for group chats and as it’s a centralized server you can’t host your own.

      And with RFC 9420 aka Messaging Layer Security (MLS) being standardized, it’s likely all the good messengers will use that.

  • chi-chan~@lemmy.world
    link
    fedilink
    English
    arrow-up
    19
    ·
    1 year ago

    Signal considered the best between those 3 apps.

    • Signal have E2EE. Facebook decided to copy the idea to Whatsapp. AFAIK, attackers have always gained access only by other methods.
    • Telegram created their own protocol, MTProto. E2E is only enabled on private chats. By default private chat exist only on the device they were created on. So a lot of people don’t really use them.

    So, in terms of encryption alone, Signal/Whatapp are safer.

    I don’t know about you, but for me, the last company I’ll trust with my information is Facebook.

    So if you can, use Signal.

    If not, decide who you trust more. Telegram or Facebook.

    • CrypticCoffee@lemmy.ml
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Just to clarify. I thought WA had e2e encryption before Signal but got bought out by Facebook, so Signal developed including with e2e encryption and open source code (at least initially) as an alternative. Is that correct?

      • pranqster@infosec.pub
        link
        fedilink
        English
        arrow-up
        5
        ·
        edit-2
        1 year ago

        The Signal protocol (née TextSecure protocol) was created by Moxie Marlinspike and Trevor Perrin and Signal messenger (née TextSecure) was built from the ground up with e2ee. WhatsApp was acquired by Facebook without e2ee and Moxie later worked with them to integrate the Signal protocol for WhatsApp. Hope that clarifies.

  • constantokra@lemmy.one
    link
    fedilink
    English
    arrow-up
    5
    ·
    1 year ago

    If you can.actually get people to switch, you should look into simplex chat. It has a lot of really good features, you can run a CLI application on any servers you might have to send you notifications really easily, and it’s being rather actively developed. A quick look at their website will show you how dedicated to privacy they are.

    • ips@infosec.pub
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      I can recommend SimpleX, too. Easier to install, set up, understand and use, than Matrix for example. Very promising so far!

        • ips@infosec.pub
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          Well, I use and support both. Matrix is also coming along nicely. But SimpleX is already very usable for everyone as a mobile messenger, that does everything you’re used to from years of other apps. Very clean UX for me.

  • people_are_cute@lemmy.sdf.org
    link
    fedilink
    English
    arrow-up
    4
    ·
    edit-2
    1 year ago

    Well, movie pirates use it so it must be safe! /s

    Telegram has a lot of pros, but it can be safe only as long as you and every person in your circle sets it as such. Chats are not encrypted by default, you have to set it in group settings. Your phone number isn’t hidden by default, you have to manually set its visibility to “Nobody”. It even asks to let it pull your contacts, Facebook-style. There might be several such gimmicks, but generally they are easy to notice and control.

    The biggest advantage(?) Telegram has is that everything is saved server-side instead of your phone. So you don’t need to keep having to back up your chats and be scared of losing everything if you lost your phone.

    • 14th_cylon@lemm.ee
      link
      fedilink
      English
      arrow-up
      11
      ·
      1 year ago

      The biggest advantage(?) Telegram has is that everything is saved server-side

      yeah, having all your secret data on a server you know nothing about is massive advantage 😂

    • caglel@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      1 year ago

      There is an standard client-server encryption in Telegram. If you want e2e encrypted chat, then use Secret chats. Almost all messengers nowadays use client server encryption. So the biggest problem is not man-in-the-middle attack, but physical access to device by someone and malware installed via breaches.

      • __ol@mastodon.social
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        @caglel @people_are_cute The standard encryption is utter trash. First, they never needed to make it. Ever. Second, it was audited and laughed at by everyone. Third, even after they fixed the issues, it’s still laughed at by everyone.

    • fuckyou_m8@lemmy.fmhy.ml
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      What is the problem in asking for pulling your contact list? Isn’t it to check which of your contacts also have telegram?

      • constantokra@lemmy.one
        link
        fedilink
        English
        arrow-up
        7
        ·
        1 year ago

        Pulling your contacts lets it get a pretty good fingerprint of who you are, from who you talk to. It can already get that from who you actually message, but it’s getting a lot more information about you from pulling the whole list and not just who you talk to through telegram.

        • fuckyou_m8@lemmy.fmhy.ml
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          I understand, but if you are new to this conversation app, right after installing it would be good to know which of your contacts your are able to talk to there. I don’t see asking one by one and adding them manually a good solution, maybe there is another one I don’t see

          • Pablo@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            1 year ago

            Well, I’d say they can do that as long as it stays on my device like with Signal.

            • fuckyou_m8@lemmy.fmhy.ml
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 year ago

              Signal still have access to your contact list at first, they simply not store it anywhere. Which is good for me

            • Awry@lemmy.one
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              You were calling someone cringe for asking why Telegram isn’t secure. Now here you are thinking your Signal messages aren’t sitting in an NSA server somewhere in front of all these people. You’re delusional, mate. You’re like a step above a script kiddy in regards to technical understanding. You’re so close to understanding the reality that you have no data privacy, but you’re still so far…

            • constantokra@lemmy.one
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              How does it stay on your device? I’m notified if a contact of mine uses signal. That means if someone has my.number in their phone signal will let them know I use signal. I don’t really want someone to be able to confirm that I use a service.

              • Pablo@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 year ago

                It just does. Your phone can check by itself if someone is on signal or not - no upload of contacts needed.

  • mister_monster@monero.town
    link
    fedilink
    English
    arrow-up
    3
    ·
    1 year ago

    Signal publishes a unique identifier and the board is like 50% feds with close intelligence ties. I use it, but only for those that insist. It’s better than the other mainstream ones.

    Use simplex.