Technology

60062 readers

3355 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

267

All of Telegram's Lies About Privacy (donald.cat)

submitted 3 days ago by [email protected] to c/[email protected]

58 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 33 points 3 days ago (2 children)

A platform that values my privacy? Or stickers? Tough choice, I guess, except Signal has both.

[–] [email protected] 7 points 3 days ago

Doesn't have unlimited storage though. It's really nice being able to jump to any of the 15,000+ images shared with a single person dating back to like 2015 within a couple seconds. I know that's a privacy concern but nothing comes close to telegram's searchability and the unlimited storage.

[–] [email protected] 4 points 3 days ago* (last edited 2 days ago) (1 children)

It's a messaging app, it's useless if there is nobody to message. I dont have any friends using signal yet.

Also it doesnt work on my phone (Ubuntu touch). There used to be a community app but it's not currently working.

I sincerely wish them success, but it's hard to have faith that a US-based company will actually protect your privacy. Not that Telegram does either. I dont know what information they do even collect.

[–] [email protected] 7 points 3 days ago* (last edited 3 days ago) (2 children)

It's hard to have faith that a US-based company will actually protect your privacy.

You don't have to, though? 1) The E2EE Signal protocol is well-audited to be robust. 2) The app itself is FOSS, and there are a lot of eyes on it. 3) The server code is FOSS. Even if they're lying about what code they use, it doesn't matter because it's E2EE. 4) If you think Signal might be bait-and-switching by building from different source code, you'd be provably wrong. They have reproducible builds, so were they to actually try this, it would be like sending up a flare to the entire security community. 5) Literally every single time OWS has been subpoenaed, the only information they've been able to provide is extremely basic metadata like server connection times.

You have no idea what you're talking about, I'm sorry. There's functionally less "trust" here than any messaging application on the planet. The network effect remark is at least valid and can be debated (although I personally have zero friends who use Telegram and at least several who use Signal). This one is just so, so wrong that it's not even up for debate.

[–] [email protected] 1 points 16 hours ago

Not just that, but also it's small in description. If you read their papers, they are very easy to understand. I suppose that's intentional, clarity and simplicity are among the main criteria of anything intended for security.
"A lot of eyes" is overvalued. There are a lot of eyes on every nation-state in history too, you tell me how that works.
It doesn't matter because of protocol design. They've solved very complex problems and have not stopped doing that. E2EE is the wrong buzzword, zero-knowledge is the right one. No, I'm not remotely qualified enough to explain what that is.
Still supply chain attack on clients is the most probable, but not much they can do with it. It's similar to fearing trojans on user devices. Yes, 3-letter agencies and such most likely will do that, not bother with pressuring Signal developers. And no, there's not much you can do to defend against a targeted attack, if it's targeted, then you've already bothered people you shouldn't have.
Well, it's not as if one could avoid that. It all lies in the area of smart contracts and distributed computing then, and see point 1, right now Signal's protocol can be in general strokes understood by someone like me. If they make something like that, it won't be. Everything is a compromise.

There’s functionally less “trust” here than any messaging application on the planet.

I think Wire and maybe Session use slightly modified Signal protocol. But Signal itself is the thing, made by people with clear vision of the whole architecture, model, which is not limited to protocols, but also to sociology, human psychology, politics. And they've explained literally every architectural decision of theirs in articles.

[–] [email protected] 1 points 3 days ago* (last edited 3 days ago) (1 children)

Thanks for the elaboration. I'm not familiar with how Signal works.

[–] [email protected] 2 points 2 days ago

Educating yourself on topic is a good idea BEFORE you plan on arguing about it online.