well, kind of useless in practice, if the servers know the keys (except for unsynced 1:1...)
They use the same 7 year old russian article [1] to show the said broken crpyto, despite that being written like the month telegram launched on HN. They have fixed all these long ago and even rolled out MTProto 2.0.
Nobody wants to break this crypto despite criticizing it. There's a 300K$ cash prize [2].
[0] - https://news.ycombinator.com/item?id=6913632
[1] - https://m.habr.com/en/post/206900/
[2] - https://telegram.org/faq#q-what-if-my-hacker-friend-says-the...
Relevant article from Moxie Marlinespike: https://archive.vn/SIl9M
A theorized valid attack that was deemed invalid by the fine print in their bounty program: https://web.archive.org/web/20181118154823/https://www.alexr...
These are criticisms of MTproto 1, there is barely any literature about the new version.
But Moxie (or any other cryptographer) could use the money for Signal's development. It's a large amount.
Also that there's no crypto for every group chat and every default 1:1 chat.
https://telegram.org/faq#q-why-not-just-make-all-chats-39sec...
Technically, the correct way to use e2ee chat on both Signal and Telegram is to verify the key fingerprint using a secure channel separate from Telegram. In reality, few people do it, so the default makes a huge difference.
If all of my Signal chats are e2ee by default, and I operate under the assumption that most if not all of my chats are encrypted and secure by default, when a chat that really needs to be secured comes in, I wouldn't think of verifying the fingerprint in a separate channel first, because Signal didn't train me to do so. If it did, Signal would have been a lot more annoying to use, because it'll have to pop up warnings and all that.
Enabling e2ee in Telegram is an explicit act, which means that what that mean is enabled, I know for sure I need to make sure it's really secure, and it will trigger my memory about verifying fingerprints. I would argue this trains the user to think more about operational security instead of just theoretical information security.
As far as I can understand, Telegram's secrecy by default is __good enough__. They control all of their data centers and internal networks, and they have been known to refuse to comply with government orders. Given that I continue to use Apple and Google services with similar or lessor guarantees, I consider that good enough, and I'll choose my messaging app based on secondary factors such as usability and features. Telegram wins hands down in these areas.
As others have pointed out, there's no good reason to have no E2EE by default in 2020.
Signal also protects against a whole lot of passive attacks (e.g. bulk collection), which Telegram doesn't. Any vulnerability in Telegram's servers and all your chat history is made public. I don't know how Signal secures their servers, and I don't have to care.
Security-wise there's no good reason to use Telegram vs Signal.
In Signal, at least as recently as in August, you may still get messages from the group you just quit if a member send a message to the group before the group metadata is reconciled. This happens because every group message is an e2ee message to every other group member.
If you have signed in from two devices, disappearing messages that have disappeared on one device will still show up on another. This happens because the server cannot store or sync the states of two sessions participating in the same chat.
Signal is full of little distributed system data consistency bugs that you just wouldn't expect in traditional client-server model application.
I understand your argument about the marketing and UI blurring the definitions, but I disagree on the fundamental issue. My messages should be readable only to me and whomever I sent them to.
If your point is that telegram is no more private than a public message forum like, well then OK.
But I think that's at odds with the "only problem is hand rolled crypto" comment I was replying to.
I'd rather Telegram be able to read my chats with a way I can control, that use whatsapp and feed all my messages into google drive with no way for me to control my contact's backup settings.
Durov has answered this multiple times. He even explained it yesterday.
So, what is the Telegram excuse for not being able to put the same amount of effort? That sounds dubious to say it is reasonable when in fact it is only the very bare minimum that everyone does.
As a matter of fact, trusted computing is a very active and practical field as far as I know.
That's up to the user, I've never backed up my WA data to any cloud service.
Telegram's UX is better for security. You know when you can expect difference levels of security, and the best that can be done is just as good if not better.
Fair comment. Still, at that point, you're trusting a third party just like in Telegram case. In any case, if anything, the default settings in WA are closer to an ideal E2EE than Telegram.
The default setting in whatsapp is to show a full screen prompt asking you to backup to google drive. 98% of users enable this, meaning it is worse than Telegram. You don't even know who has enabled it.
You don't trust WA nor Facebook regarding your data, which is what we were discussing. You do trust them regarding your metadata, and it's indeed a problem.
You don't but almost every person you chat with backs it up.
They back it up. Your chats are included in the backups that happens to their Google accounts.
WhatsApp pushes the drive backups frequently. Every single person I chat with has enabled it. I've checked.
https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia
Please don't post such accusations without sources.