Hacker News Reader

Comment by orbital-decay | Hacker News Reader

So their supposed reasons it's not secure are...

1. No e2e encryption by default (valid, obvious)

2. Telegram has access to the metadata and contacts (valid, obvious)

3. They refuse to deplatform certain content (???)

4. An old and well understood bug/tradeoff/feature which has been fixed or mitigated long ago, after it was reported or abused

5. They didn't respond to Vice, so they "aren't forthcoming with journalists" (what does it have to do with security?)

I'm not using it and no fan of it, but I expected actual technical reasons instead of reading a hit piece with no content.

View on HN

For me one of the main drawbacks of Telegram is that group chats are not end-to-end encrypted at all. That's a huge disadvantage.

The regular/cloud chats are not e2e in the first place. e2e chats are opt-in at the moment, by the name "secret chats".

That option was not available for group chats last time i checked.

1. I wouldn't call that obvious. I could claim that any messenger that doesn't use OTP is unsecure, because in comparison they are. So this is a generic complaint that applies to literally all existing communication tooling available to normal folks. Hence, not helpful.

2. Only if you give it access, so also not obvious

> 2. Only if you give it access, so also not obvious

Or rather invalid, unless you make it valid, and then obvious.

There is an extreme amount of difference in security between e.g. the axotlotl prototocol and only transport encrypting to and from the server. The benefits of OTP might become real decades in the future if we develop large quantum computers (or if we become a Kardashev type 2 civilization and suddenly can afford spending the energy required to boil all oceans on earth multiple times over to crack encrypted content by brute force).

Oh, the benefits of OTP are huge right now. Just to mention two:

1. the implementation can be trivial and so there isn't really an algorithm that can be broken or a backdoor in a RNG on your device.

2. Protection against MITM attacks (or anything related to problems with certificates, even bugs in your software)

That's an extreme amount of difference in security compared e.g. the axotlotl protocol.

Now, the authors of Signal are smart guys and of course they used the axotlotl protocol for obvious reasons, namely to increase usability. But you can say exactly the same about telegram too. It only becomes a matter of where you draw the line.

Reply on news.ycombinator.com