Slashdot Mirror
Why You Should Stop Using Telegram Right Now (gizmodo.com)
Earlier this week, The Intercept evaluated the best instant messaging clients from the privacy standpoint. The list included Facebook's WhatsApp, Google's Allo, and Signal -- three apps that employ end-to-end encryption. One popular name that was missing from the list was Telegram. A report on Gizmodo sheds further light on the matter, adding that Telegram is riddled with a wide range of security issues, and "doesn't live up to its proclamations as a safe and secure messaging application." Citing many security experts, the report states:One major problem Telegram has is that it doesn't encrypt chats by default, something the FBI has advocated for. "There are many Telegram users who think they are communicating in an encrypted way, when they're not because they don't realize that they have to turn on an additional setting," Christopher Soghoian, Principal Technologist and Senior Policy Analyst at the American Civil Liberties Union, told Gizmodo. "Telegram has delivered everything that the government wants. Would I prefer that they used a method of encryption that followed industry best practices like WhatsApp and Signal? Certainly. But, if it's not turned on by default, it doesn't matter."The other issue that security experts have taken a note of is that Telegram employs its own encryption, which according to them, "is widely considered to be a fatal flaw when developing encrypted messaging apps." The report adds:"They use the MTproto protocol which is effectively homegrown and I've seen no proper proofs of its security," Alan Woodward, professor at the University of Surrey told Gizmodo. Woodward criticized Telegram for their lack of transparency regarding their home cooked encryption protocol. "At present we don't know enough to know if it's secure or insecure. That's the trouble with security by obscurity. It's usual for cryptographers to reveal the algorithms completely, but here we are in the dark. Unless you have considerable experience, you shouldn't write your own crypto. No one really understands why they did that."The list goes on and on.
The railroads are still here. Shouldn't be surprising that telegrams are still around almost two centuries later.
https://en.wikipedia.org/wiki/Telegraph
How else would I wire a Western Union money transfer? Pony express doesn't cut it for me.
And I'll even uninstall it. Now, WTF is Telegraph again?
Who needs this instant messaging thing? The Bly person I know is mom, and I can just tell upstairs for her.
What about Telex. My company's business cards still have a Telex number on them.
Publicly criticizing them and their users, is not.
Its the only messenger that:
1. can be used without gapps spyware
2. is halfway popular
3. has the source code released under a open source license
4. has authors who tolerate third party clients connecting to their server. This is not the case for Whatsapp, and also not the case for signal
Thanks to 1 and 3, telegram is available in the f-droid app store. This is why I use it, and I don't want to install software from third party stores like google play or sideload apps.
Yes, the encryption is not perfect, but I prefer that over having to install google spyware that would be required for signal for example.
We can all just re-post pretty much the exact same comments we made a few days ago! Woo hoo!
#DeleteChrome
DOn't we get enough one-weird-trick, and you-wont-believe-what-happened-next headlines elsewhere. Et tu, Slashdot?
Some drink at the fountain of knowledge. Others just gargle.
I'll just leave this here. https://telegram.org/faq#q-how...
Reads like a hit piece.
So you have to push a couple settings buttons. Big deal. In 'secret chat' the msgs arent stored anywhere while also being encrypted. Should be default, but whatever.
For gizmodo, of all places (gawker, adspy shithole) to come down on telegram is absurd.
https://github.com/tux3/qtox
Security + P2P style app. Windows, Android and Linux.
But I can't, there's no way I can stop using it.
BTW, WTF is telegram?
Why You Should STOP Using Telegram Right Now STOP
I have the feeling that this has been made up by someone to weaken the spread of Telegram. If their encryption is so insecure, why haven't they brought out software or tools that proof it? They didn't because by now they haven't been able to do it. Home made encryption can be as secure as any other.
I'm still curious why the option for "secure chat" in Telegram only exists for handsets, but not the desktop apps.
It messes with about everything on my Android phone: images, calls, messages, contacts. Never had that with Telegram.
Telegram is also nice to use on a PC and/or tablet and great to share images and files.
According to the FAQ's all chats are already encrypted, you can activate an extra layer to get end-to-end encryption (secret chats).
I would prefer Telegram use the Textsecure protocol, too, but "homegrown," "fatal flaw," and "no proof of security" all go too far.
- it is "homegrown" in that it was written by a couple smart guys and reviewed by a lot more, just like Textsecure. Basically Textsecure guys have more friends than Telegram guys, so a bigger name when they say "I reviewed it," and more cryptographers willing to "review" it which is basically vouching for it. Certainly you will get famous for finding a Telegram flaw, so I'm sure many grad students have reviewed it, just not "reviewed" it. I think vouches from fashionable cryptographers are a legit security advantage, but it's also a cool-kids-club. There is a mailing list exchange somewhere I can't find where Marlinspike "reviews" Telegram and can't find anything substantively wrong with it, but tries to make it sound like he can by repeatedly calling for more reviews, and pointing at things and saying "well you didn't do what I did here, so you're using less fashionable crypto which should be considered dubious"---less fashionable == not what we did, is basically a tautology because crypto is dominated by big names, and Trevor Perrin / axolotl is in fashion this half-decade. Telegram guys were arguing a lot more fairly on this thread, while Marlinspike played to the peanut gallery, and I say that as someone who doesn't use their app and does use Textsecure. Maybe someone can find this mailing list thread? I can't. :(
- yes, roll-your-own is a "fatal flaw," but the phrase makes it sound like there is already a known exploit when there isn't. iMessage has the same fatal flaw. And we have only Facebook's word that WhatsApp really uses textsecure's protocol, with some suggestions it doesn't ("same key for every user"): https://www.reddit.com/r/Android/comments/3sq4c3/whatsapp_reneges_on_their_promise_of_true_message/ so again, they are really picking on the Telegram guys, throwing every piece of shit against them to see what will stick.
- "no proof of security"---there is no such thing as "proof" of security. There are proofs of correctness for programs, which would mean assuming the crypto primitives behave in some abstractly ideal way, of which we have no proof.
It is really unfair to Telegram.
Unfortunately for them, who cares? I see no reason we should be fair to them, other than to practice arguing fair generally because it's a good skill to have. But Telegram is a silly proprietary app. "Chat concepts" have little value compared to network effects, which means that fully open should be the #1 requirement obliterating all others. Even Textsecure is too closed because the federation isn't automatic like it was for XMPP, and there's no good reason for this limitation other than their (also app-fashionable and broken) insistence on the phone number namespace. but Telegram is even more closed: they are trying to build a following and get famous by trapping people in their walled garden. Fuck all these people. Don't use Telegram, but the #1 reason to not use it should be "no client source, no federation," and #2 reason could be, "not using the era's most fashionable and thus best studied crypto solution to a very simple problem, when they should."
Remember, Telegram only promises high grade encryption for Secret Chats.
This is something you get for free with Telegram and no big corporation can spy on you.
Sorry, you should be very upset about the lack of spying in Secret chats. Stop using Telegram right now before you continue!
You should immediately use WhatsApp which uses your data in ways that will make you shit yourself.
Oh, and also; PLEASE PLEASE PLEASE stop using Telegram. A huge consortium of eaves dropping government bodies and gigantic greedy corporations know what's best for you.
Thank you for your cooperation netizen.
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
I'm sure both Facebook and Google collect information on your conversations before they are encrypted since both are known to gather information for third parties as well as the NSA. They also gather your contact list and metadata on who you have conversations with.