| >I strongly disagree with this claim. Can you back your claim with some evidence? Absolutely. Telegram isn't end-to-end encrypted by default. The author admits so here: https://telegra.ph/Why-Isnt-Telegram-End-to-End-Encrypted-by... Q.E.D. This set of 4 vulnerabilities isn't the issue with Telegram. Vulnerabilities can often be patched. The issue is the fundamental way Telegram functions. Also, since you're obviously going to claim the article justifies it as a design decision, read my refutal here before replying https://telegra.ph/Why-you-should-stop-reading-Durovs-blog-p... Finally, I'm a bit puzzled, you seem to be "open minded" yet your post didn't even touch on this massive issue of failure to provide E2EE for groups, desktop clients, or anything by default. Were you unaware of it? Or would you argue the endless list of competition that actually does E2EE properly (Signal, Wire, Threema, Element...), over-do security? You're also not even remotely interested in agreeing with the academic community, but instead just observe and basically imply: "no breaches have been made public, therefore it must be secure". How familiar are you with the field of computer security, do you know how security is quantified? |
My original post was about the fact that I am tired of media outlets making borderline denigratory titles all the time about Telegram.
You replied, stating that I claimed that "Telegram is secure", which I did not do. Then, I tried to clarify my original post.
Then you claim that these vulnerabilities show that "Telegram authors don't have the know-how on how to implement secure protocols". I asked you to back your claim, because I don't see how the discovery of a bunch of "almost impossible to carry out in practice" vulnerabilities might imply that Telegram's engineers are incompetent.
To which you reply that "Telegram isn't end-to-end encrypted by default". Now, unless I am missing something obvious here, you just stated a fact that has no relevance whatsoever with your former claim. The claim to prove was "Trivial vulnerabilities discovered --> Telegram authors are incompetent". Now, if you changed your mind, and want instead to argue that they are incompetent because they did not implement e2ee by default, it's a totally different discussion and has no relation at all with my original post, nor with the article we are commenting (imo).
> Finally, I'm a bit puzzled, you seem to be "open minded" yet your post didn't even touch on this massive issue of failure to provide E2EE for groups, desktop clients, or anything by default. Were you unaware of it?
I am aware of how Telegram works. But why do you suggest I should have talked about this? It is totally unrelated to my original point.
> Or would you argue the endless list of competition that actually does E2EE properly (Signal, Wire, Threema, Element...), over-do security?
I never stated such a thing.
> You're also not even remotely interested in agreeing with the academic community
It's not that I am not interested in agreeing with them. I am openly criticizing the behaviour of some of its members. It's a different thing. But also this is a different discussion, and I should not have included that comment, maybe.
> "no breaches have been made public, therefore it must be secure".
I did not claim this.
> How familiar are you with the field of computer security, do you know how security is quantified?
Please do not patronize me.
Finally, I am not interested in having a discussion that is unrelated with the topic of the article, or my original comment about it (because it would be too long and tiring). However, if you want to know my opinion on all this related issues that you brought up, you can read what I wrote about it here: https://germano.dev/whatsapp-vs-telegram/ (even though this does not talk about Signal or other open source e2ee messengers).