this post was submitted on 24 Sep 2024
68 points (98.6% liked)

Technology

1328 readers
68 users here now

Which posts fit here?

Anything that is at least tangentially connected to the technology, social media platforms, informational technologies and tech policy.

Rules

1. English onlyTitle and associated content has to be in English.
2. Use original linkPost URL should be the original link to the article (even if paywalled) and archived copies left in the body. It allows avoiding duplicate posts when cross-posting.
3. Respectful communicationAll communication has to be respectful of differing opinions, viewpoints, and experiences.
4. InclusivityEveryone is welcome here regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
5. Ad hominem attacksAny kind of personal attacks are expressly forbidden. If you can't argue your position without attacking a person's character, you already lost the argument.
6. Off-topic tangentsStay on topic. Keep it relevant.
7. Instance rules may applyIf something is not covered by community rules, but are against lemmy.zip instance rules, they will be enforced.

Companion communities

!globalnews@lemmy.zip
!interestingshare@lemmy.zip

Icon attribution | Banner attribution

founded 11 months ago
MODERATORS
BrikoX@lemmy.zip
68
Telegram will now hand over your phone number and IP if you’re a criminal suspect (www.theverge.com)
submitted 1 month ago by BrikoX@lemmy.zip to c/technology@lemmy.zip
19 comments fedilink hide all child comments
 

Telegram continues trying to repair its reputation.

top 19 comments
sorted by: hot top controversial new old
[–] onlinepersona@programming.dev 7 points 1 month ago (1 children)

Does anybody really use Telegram for "privacy"? People can't seriously believe that thing is secure. Their FAQ indirectly states that group chats aren't encrypted and explicitly states that "secret chats" are.

We support two layers of secure encryption. Server-client encryption is used in Cloud Chats (private and group chats), Secret Chats use an additional layer of client-client encryption. All data, regardless of type, is encrypted in the same way — be it text, media or files.

I have never recommended Telegram to anybody. It's just like another facebook, AOL, ICQ, or whatever messenger. I actually don't personally know a single telegram user who uses secret chats. They are quite useless. They don't sync across devices.

Anti Commercial-AI license

[–] rdri@lemmy.world 0 points 1 month ago (3 children)

Oh believe me, group chats are encrypted. Problem is, most of them are public, so that's only to protect them from being exposed to dump/search server side. And yeah, their encryption is not e2e. That's encryption nonetheless.

[–] teolan@lemmy.world 4 points 1 month ago (1 children)

Telegram's "encryption" does not protect in any way against dump/search server side (outside of secrets chats).

Telegram's "encryption" only protects from your ISP spying, and it's the kind of encryption that everyone implements. Any website that does not implement such encryption would show a big red "Not secure" warning in your browser.

[–] rdri@lemmy.world -2 points 1 month ago* (last edited 1 month ago) (3 children)

In their explanation it was specifically stated that it should be either impossible or too difficult. Keeping keys and content separately, that's what it's about iirc. Either way the point of telegram is not in privacy for everyone. You trade protection for convenience (cloud data and great clients), and if you want you can use secret chats. That's it. Seeing their user base, it suits most people. We'll see if their server data gets leaked or something, though it didn't happen yet.

[–] possiblylinux127@lemmy.zip 3 points 1 month ago (1 children)

Just use something that isn't a child abuse Russian chat app. There are so many better options.

[–] rdri@lemmy.world 1 points 1 month ago (1 children)

Use for what? Are there alternatives that aggregate news, have bot support, non-electron clients and immediately sync between desktop and mobile?

[–] possiblylinux127@lemmy.zip 1 points 1 month ago* (last edited 1 month ago) (1 children)

Yes? You aren't going to find a one to one telegram clone. A replacement isn't a clone

Matrix is probably what you want but it isn't encrypted e2ee by default.

Signal and Simplex chat have full encryption but are closer to a WhatsApp alternative

[–] rdri@lemmy.world 1 points 1 month ago

A replacement isn't a clone

You know I wasn't asking for a replacement. You're suggesting e2ee-first software to people who might not really need it in the first place.

Personally, when I think about all the quirks and requirements that must be met for some chat to happily accept a new member in a e2ee scheme, I get mad. My daily chats, gifs and cat photos aren't worth everyone's effort and discomfort.

Also, I use WhatsApp not because I like it but because it's easier than forcing dozens of people to use something else. I hate it because of how it works, and it doesn't have anything to do with e2ee part (it's worthless for stuff I use WhatsApp for). I like that it dropped electron though - I value my ram.

[–] teolan@lemmy.world 1 points 1 month ago (1 children)

In their explanation it was specifically stated that it should be either impossible or too difficult. Keeping keys and content separately, that's what it's about

They're lying? Encryption at rest does not protect at all against the server snooping around. When you send or receive a message, the server has to see it in plaintext unless you have E2EE. So there is a way for them to access the plaintext of any message you receive, and it happens automatically billions of times per day. It's pretty easy.

[–] rdri@lemmy.world 1 points 1 month ago (1 children)

That's wrong. There is no plaintext transfer. While a lot of stuff can potentially happen on server every second as you said, it doesn't happen according to them. I don't trust that fully either but that's their argument. You can look up encryption schemes in their faq.

[–] teolan@lemmy.world 1 points 1 month ago

I didn't say that there was any network plaintext transfer. I said the server needs to have access to the plaintext at some point.

it doesn't happen according to them

That's not actually what they say, because it would be the cryptographic equivalent of claiming they invented a new color.

They talk about encryption at rest without mentioning the rest of their infrastructure to confuse the hell out of people that don't understand encryption. Given your comments it seems to work.

[–] teolan@lemmy.world 1 points 1 month ago

Either way the point of telegram is not in privacy for everyone. You trade protection for convenience (cloud data and great clients)

That's not what their marketing says.

Seeing their user base, it suits most people.

Most people have zero idea what kind of security telegram provides.

[–] onlinepersona@programming.dev 1 points 1 month ago* (last edited 1 month ago) (1 children)

Are you talking about encryption at rest? Regardless, encryption by the server is worthless. It's exactly why admins can delete content in chat rooms.

Edit: that was over the top. My bad. It's not worthless. It's just doesn't really enhance privacy like E2E and I find it disingenuous to say "my chat app is encrypted" when you mean server encryption not E2E.

Anti Commercial-AI license

[–] rdri@lemmy.world 2 points 1 month ago (1 children)

You're still missing the fact that public chats can't be adequately protected.

It's just doesn't really enhance privacy like E2E and I find it disingenuous to say "my chat app is encrypted" when you mean server encryption not E2E.

FWIW when they said that the "e2e" boom has yet to happen.

[–] onlinepersona@programming.dev 1 points 1 month ago (1 children)

You’re still missing the fact that public chats can’t be adequately protected.

Depends what you mean by "adequately" 🤔 With perfect forward secrecy (which matrix and signal have), seeing past messages isn't possible. Seizing the servers is also not very useful unless people are connecting directly to the server. Anonymous public chats running on overlay networks like I2P and TOR might not even need encryption (although I wouldn't trust a server that didn't).

Anti Commercial-AI license

[–] rdri@lemmy.world 1 points 1 month ago

Where something publicly exists anyone can set up a local archive to capture anything, regardless of what's available at the moment of joining the chat. Also telegram has such a setting too. It's useless when someone really wants to get you. They won't need an access to telegram servers to get you.

[–] possiblylinux127@lemmy.zip 0 points 1 month ago

Maybe client to server but that's not saying much

[–] Anticorp@lemmy.world 5 points 1 month ago

If Telegram receives a valid order from the relevant judicial authorities that confirms you’re a suspect in a case involving criminal activities that violate the Telegram Terms of Service, we will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities.

Does this mean a warrant? If so, then I don't see an issue, since it complies with our constitutional right to privacy according to the 4th amendment. It's better than I can say for a lot of transactions between private data firms and law enforcement departments.

[–] possiblylinux127@lemmy.zip 3 points 1 month ago* (last edited 1 month ago)

I don't see that as a problem. Telegram is facilitating a lot of public crime. If they know something bad is talking place they should make some effort to stop it as there was crime happening in public rooms.

TL;DR don't use Telegram