A lot of privacy guides suggest avoiding Telegram. I understand that in its default mode there’s no E2EE (and no E2EE for groups at all).
If people I know don’t wanttko use Signal, isn’t Telegram the lesser evil given it’s nicer privacy policy (than other popular ones)?
What keeps me from using Telegram is the server side is closed source; they have been known to work with governments; and been willing to censor content. There are enough better options that I have zero use for them.
Thanks everyone on sharing your thoughts ln this! This has been really helpful!
I see some saying their policy says one thing about cooperation with law enforcement but they seem to have been doing just the opposite, reducing the trust overall in the rest of their promises (e.g. their data collection).
Some compared to the closer to ideal apps such as Signal or Matrix in terms of privacy.
I’m curious to also hear what do you do to compromise to keep your social connections?
The practical side of navigating the current state of the Internet and people’s social life.
It’s been an uphill battle with asking folks to use Signal, and Telegram seem to be better than giving out info to Meta.
??? Channels are literally public by definition and viewable even without an account. That’s the whole point of channels. They’re more like blogs than messages.
E2EE is the most important protection for your messages. Otherwise, it means that all of your messages can be accessed just like a word file in their server. It’s up to you
I read long ago of criticisms about encryption algorithm by experts. Instead of using existing standards they baked their own algorithms. They were not recognised cryptograph experts.
Afaik, they improved it over time. But there might still be issues.
In sum, trust is not your friend and up to you without E2EE.
Would you rather lose a contact if they insist on a communication channel that’s leaking metadata but the content is e2ee (WhatsApp for example)? (Or perhaps in your view keeping the content secure is more important than anything?)
Asking out of curiosity, I’m aware that every person has their own threat model
So, I have no way of actually verifying the validity of this, but, when I deployed (former US military) we were told that Russia and China had cracked telegram and WhatsApp and that signal was the only authorized encrypted messaging app.
Probably another point is that the encryption for Matrix/Element has undergone multiple audits, one in 2016 and another one of their newer rust library. Whereas telegram just has not. There was this also a not too long ago. MTProto is also used nowhere else, whereas a lot of encryption has been influenced by the Double Ratchet which is well understood.
The other thing worth noting is that Matrix is the foundation for other products which many governments use for secure communications.
For casual shit like sending files to yourself, bullshiting with memes, or stuff like that, the unknown factor of telegram doesn’t matter.
But it is an unknown. We don’t know what their server code looks like. So you can’t trust that it isn’t doing things other than what it is supposed to.
I don’t think that they published it as a response to the angry users. We wern’t that loud and signal had a reason to do so. That was when they worked on the cryptocurrency and the spam protection.
In signals case it dosn’t matter much if the server is compromised since the important part happens on the client side. The server can only forward encrypted salad or not deliver a message. Or log the meta data of the messages. E2e will always be there, despite the server being compromised.
The server’s trustworthiness does not matter for Signal. The app is designed to work securely regardless of the server. Moreover, even if the server software is open source, you cannot be sure that they run the same code that they publish.
My account was compromised once, though I have 2FA enabled. I assume that I was accessing my account from a browser on a windows pc, it had virus but not 100% sure. Someone was able to access it, change my name send multiple crypto related links to users in bulk.
It contained years of chat history with my wife. I was able to recover the account. But I deleted all the chat history.
I still use it to get alerts from various automated scripts I use, mostly for the bots with free API access. No personal data go in there.
The mistake might be from my side. But if someone takes over your account, you lose everything.
I find Telegram to be at least as trustworthy as Signal. Signal has a lot of red/orange flags that bother me. For example, Telegram is not based in the United States, whereas Signal is.
The server’s trustworthiness does not matter for Signal. The app is designed to work securely regardless of the server. Moreover, even if the server software is open source, you cannot be sure that they run the same code that they publish.
An app designed by US company doesn’t represent anything related to security.
The founder of telegram always complains that the FBI has access to signal, apple and other related chat apps.
He suggests to use private chat, if it is confidential. The message transactions happens between peer to peer and it doesn’t go to the server. He was claiming all the privacy feature that you get from signal is the almost same as private chat. Signal stil uses the server.
Given the fact that Signal is E2EE, “full access” would mean “full access to encrypted data without the keys to unencrypt it,” which is why E2EE is important in the first place. Were Signal compromised, US representatives would not resurrect the EARN IT Act year after year in an attempt to make E2EE illegal.
No one had provided a shred of evidence that Signal has been compromised. And given that they’re more willing to pull out of a country entirely v. compromising user data, I’d call them a pretty safe bet.
Yes, it does. You can try it. Respond to my comment (some people are getting annoyed) with the same bot name + a short time (like 5 minutes). You’ll get a notification in your inbox.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.
This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.
You can subscribe to this community from any Kbin or Lemmy instance:
Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!
Want to get involved? The website is open-source on GitHub, and your help would be appreciated!
This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.
Moderation Rules:
We prefer posting about open-source software whenever possible.
No soliciting engagement: Don’t ask for upvotes, follows, etc.
Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
Be civil, no violence, hate speech. Assume people here are posting in good faith.
Don’t repost topics which have already been covered here.
News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
No misinformation: Extraordinary claims must be matched with evidence.
Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.
What keeps me from using Telegram is the server side is closed source; they have been known to work with governments; and been willing to censor content. There are enough better options that I have zero use for them.
removed by mod
deleted by creator
People like you, who make fun of people who are simply ignorant but are actually trying to learn and asking questions, are cringe.
The privacy policy doesn’t matter if no data is saved unencrypted or with no metatdata.
The only thing Signal saves (which is proofed by a law case afaik) is the phone number and the account creation date.
Thanks everyone on sharing your thoughts ln this! This has been really helpful!
I see some saying their policy says one thing about cooperation with law enforcement but they seem to have been doing just the opposite, reducing the trust overall in the rest of their promises (e.g. their data collection).
Some compared to the closer to ideal apps such as Signal or Matrix in terms of privacy.
I’m curious to also hear what do you do to compromise to keep your social connections? The practical side of navigating the current state of the Internet and people’s social life.
It’s been an uphill battle with asking folks to use Signal, and Telegram seem to be better than giving out info to Meta.
Telegram straight up lies about sharing data with governments: https://restoreprivacy.com/telegram-sharing-user-data/
This. Our fucking government can instruct Telegram to ban any channel or user they don’t like.
Banning channels is not the same as sharing private data
If not the latter, how the former? Messages is and should be private data as well.
??? Channels are literally public by definition and viewable even without an account. That’s the whole point of channels. They’re more like blogs than messages.
E2EE is the most important protection for your messages. Otherwise, it means that all of your messages can be accessed just like a word file in their server. It’s up to you
I read long ago of criticisms about encryption algorithm by experts. Instead of using existing standards they baked their own algorithms. They were not recognised cryptograph experts. Afaik, they improved it over time. But there might still be issues.
In sum, trust is not your friend and up to you without E2EE.
Would you rather lose a contact if they insist on a communication channel that’s leaking metadata but the content is e2ee (WhatsApp for example)? (Or perhaps in your view keeping the content secure is more important than anything?)
Asking out of curiosity, I’m aware that every person has their own threat model
So, I have no way of actually verifying the validity of this, but, when I deployed (former US military) we were told that Russia and China had cracked telegram and WhatsApp and that signal was the only authorized encrypted messaging app.
I heard similar things. It just really sucks that WhatsApp collects everything they can besides the content.
Probably another point is that the encryption for Matrix/Element has undergone multiple audits, one in 2016 and another one of their newer rust library. Whereas telegram just has not. There was this also a not too long ago. MTProto is also used nowhere else, whereas a lot of encryption has been influenced by the Double Ratchet which is well understood.
The other thing worth noting is that Matrix is the foundation for other products which many governments use for secure communications.
I see a pattern of a lack of transparency here indeed, thanks.
I’m hoping for some major event to push people to Signal and/or Matrix. Struggling to see how else might a migration trend happen.
Depends on your goals.
For casual shit like sending files to yourself, bullshiting with memes, or stuff like that, the unknown factor of telegram doesn’t matter.
But it is an unknown. We don’t know what their server code looks like. So you can’t trust that it isn’t doing things other than what it is supposed to.
It’s a matter of preferences tbh.
We don’t know what anyones server code looks like. The code that is published may not be the one they are actually running.
In fact Signal stopped publishing server side code a few years back, and only resumed after the community got angry: https://www.androidpolice.com/2021/04/06/it-looks-like-signal-isnt-as-open-source-as-you-thought-it-was-anymore/
I don’t think that they published it as a response to the angry users. We wern’t that loud and signal had a reason to do so. That was when they worked on the cryptocurrency and the spam protection. In signals case it dosn’t matter much if the server is compromised since the important part happens on the client side. The server can only forward encrypted salad or not deliver a message. Or log the meta data of the messages. E2e will always be there, despite the server being compromised.
What bothered me was that Signal fanbase was trashing Telegram for not publishing the server source, while Signal was doing this.
The server’s trustworthiness does not matter for Signal. The app is designed to work securely regardless of the server. Moreover, even if the server software is open source, you cannot be sure that they run the same code that they publish.
Well, that’s true. But if there’s published server code, it’s at least better than none.
There’s a point where you either decide to use the service, or just withdraw from any of them at all, if you go down that road.
Despite you using the foss client of telegram there is no source for the server, signal has published it’s code.
True. There’s some trust involved there still, but way less trust needed than with a company that simply doesn’t publish its server code.
My account was compromised once, though I have 2FA enabled. I assume that I was accessing my account from a browser on a windows pc, it had virus but not 100% sure. Someone was able to access it, change my name send multiple crypto related links to users in bulk.
It contained years of chat history with my wife. I was able to recover the account. But I deleted all the chat history.
I still use it to get alerts from various automated scripts I use, mostly for the bots with free API access. No personal data go in there.
The mistake might be from my side. But if someone takes over your account, you lose everything.
I was afraid of that outcome and went for the auto-delete option, some groups have just a few days in terms of retention.
I’m sorry you had to go through this though.
I find Telegram to be at least as trustworthy as Signal. Signal has a lot of red/orange flags that bother me. For example, Telegram is not based in the United States, whereas Signal is.
The server’s trustworthiness does not matter for Signal. The app is designed to work securely regardless of the server. Moreover, even if the server software is open source, you cannot be sure that they run the same code that they publish.
An app designed by US company doesn’t represent anything related to security.
The founder of telegram always complains that the FBI has access to signal, apple and other related chat apps.
He suggests to use private chat, if it is confidential. The message transactions happens between peer to peer and it doesn’t go to the server. He was claiming all the privacy feature that you get from signal is the almost same as private chat. Signal stil uses the server.
a
Given the fact that Signal is E2EE, “full access” would mean “full access to encrypted data without the keys to unencrypt it,” which is why E2EE is important in the first place. Were Signal compromised, US representatives would not resurrect the EARN IT Act year after year in an attempt to make E2EE illegal.
No one had provided a shred of evidence that Signal has been compromised. And given that they’re more willing to pull out of a country entirely v. compromising user data, I’d call them a pretty safe bet.
@remindme@mstdn.social in 1 week
a
Does remindme work on Lemmy or are you just hoping it does?
Yes, it does. You can try it. Respond to my comment (some people are getting annoyed) with the same bot name + a short time (like 5 minutes). You’ll get a notification in your inbox.
Look at the comment history. Seems to work