Hacker News Reader

Comment by saos | Hacker News Reader

The app does have E2E encryption. It's just not the default. My one wish is they would change this.

I know, and I agree. MTProtov1 criticisms aside, the E2EE system Telegram uses is perfectly safe.

It's just disabled by default, unavailable in group chats or channels, and enabling it reduces usability (i.e. you can't use multiple devices to chat if you enable E2EE).

Telegram as a chat app has the best UX of any chat app out there in my opinion, so the lack of proper E2EE is simply disappointing. I don't really trust either, but I consider WhatsApp more secure than Telegram, despite Meta mining my metadata.

> but I consider WhatsApp more secure than Telegram, despite Meta mining my metadata

Ha, I still prefer Telegram. I just use secret chats by default and enjoy the awesome UX

Yes, Secret Chat's awesome UX of requiring both recipients to be online and the inability to use it on desktop.

Try Unigram to start "secret chats" though it will not sync with other clients. Unigram works in Windows Desktop.

the E2EE system Telegram uses is perfectly safe

Is it? How would you go about confirming that?]

> WhatsApp more secure than Telegram

Why is that? With WhatsApp client being closed source, we simply don't know if it really is doing E2EE at all.

>we simply don't know if it really is doing E2EE at all

Why don't we know? Isn't it trivial to set up a MITM test setup and snuff the traffic and analize it?

It's trivially easy to encrypt the traffic and then send a copy of the private key to Facebook's servers. You would not be able to decrypt it, but they would.

That's not how it works: https://news.ycombinator.com/item?id=11432661

This makes no sense. There is nothing to prove that that WhatsApp is really using the aformentioned Signal code. It's closed source, so it could be anything inside.

The answer to your objections is literally in the comment I linked, did you read it? One keyword is RE.

Yes we do as there are 3rd party clients (eg yowsup) that also need to implement it.

Problem is that you don't know of the app is leaking your keys somewhere else.

This is my point exactly. It doesn't matter as long as the app is closed source. You could do the worlds most secure E2EE implementation, but then send a copy of all keys to Facebook servers.

If your message in WhatsApp gets reported approximately 1000 employees from Facebook/Meta will be able to read your last 5 messages you made in WhatsApp.

https://oneandroid.net/whatsapp-will-read-your-last-5-messag...

No E2EE protects you from the receiver (the reporter in your example), it's the same if I forward the message I receive to the world.

What? It’s not E2EE by default? This is honestly disappointing. So most of their privacy-focused stance is just a marketing ploy? A lot of my peers now use Telegram to move away from the Facebook ecosystem and now you’re telling me they’re just as worse?

Reply on news.ycombinator.com