Hacker News new | ask | show | jobs
by read_if_gay_ 2129 days ago
But the standard we should apply to secure chat protocols isn't how many awards it won, but whether it's watertight. Obviously winning a prestigious prize means it's watertight, but the converse doesn't follow. A protocol can be safe for practical use without winning any prizes.
2 comments
maqp 2128 days ago
It can, but given Telegram's history and professional cryptographers like Schneier[1] and Green[2] saying DO NOT USE IT, it's obvious it's _anything_ but watertight.

[1] https://www.schneier.com/blog/archives/2016/06/comparing_mes...

[2] https://twitter.com/matthew_d_green/status/72642891296898252...

link
read_if_gay_ 2128 days ago
Both four years old. Did they not improve since?
link
maqp 2128 days ago
No. Still not E2EE by default, still no E2EE for groups, still no E2EE for desktop clients. Why do you want to imagine Telegram magically got better when it's so obvious it didn't?
link
read_if_gay_ 2128 days ago
Because they “magically” updated and improved tons of stuff in the last four years. So I think it’s not unreasonable to consider whether their encryption improved too.

But yes, not having encryption on by default speaks poorly of them. OTOH it’s not concrete proof that the encryption still sucks as of now.

link
maqp 2128 days ago
Don't get me wrong, I'm not saying the E2EE encryption itself is flawed. I'm saying it's not being used at all by default. And I'm saying it's not possible to use it for groups or desktop clients. That's _the_ travesty, and the proof that this is the state of things is so obvious people don't realize how serious it is. And my concern is that will lead to a tragedy.
link
read_if_gay_ 2128 days ago
Yeah, it’s true that not having E2EE makes Telegram a bad choice for the purposes of the protesters. Convenience and inertia wins out though. And when you have groups of hundreds of thousands of people, there aren’t too many choices in the first place.
link
swinglock 2128 days ago
Of course not. You have to first admit you have a problem to be able to improve.
link
tptacek 2128 days ago
Does this comment have anything to do with the question I was responding to?
link
read_if_gay_ 2128 days ago
No, and obviously it doesn't have to, because I'm replying to you. You hint at Telegram's protocol being inferior based on the number of awards it won, a heuristic that isn't too relevant in practice.
link