Hacker News new | ask | show | jobs
by Shank 666 days ago
> Platforms like Signal can get away with this because they are properly E2E encrypted, and cannot identify illegal content. Telegram, on the other hand, has decryption keys for the messages and media sent in group chats, meaning they can identify and remove illegal content if they choose to.

I feel like I must emphasize this because it's repeatedly missed. Telegram has mainly 3 different components. The first is a server-side encrypted messaging platform, which is unremarkable, and as-secure as Discord or Slack. The second is its "E2EE" system, secret chats, which don't sync, and have not been broken (though people have raised some concerns historically about it). The third system is channels, which are basically subscription feeds from users. Channels are as secure as Slack or Discord or Twitter or Facebook. The whole point of Channels is that you can subscribe to channels and get messages in Telegram from them, but they're basically open access. A good example is Durov's channel: https://t.me/s/durov

Now I say all of this because the vast majority of people believe that E2EE would solve the problem here. The reality is that channels doesn't make sense to be E2EE since anyone can join, and channels are where are a large amount of the "interesting" content to law enforcement occurs. Abuse definitely occurs to some degree on all 3 components, but channels simply don't exist in Signal, as an example.
2 comments
BlueTemplar 666 days ago
Also Telegram behaves better than you would expect from a platform : they still provide(d?) a quite open interface for others to crawl :

https://www.wired.com/story/the-kremlin-has-entered-the-chat...

(The downside of course is that it's then also open to «bad actors».)

link
xvector 666 days ago
We have robust cryptographic constructions for channels at this point. One is described in https://www.ietf.org/blog/mls-secure-and-usable-end-to-end-e...
link
HL33tibCe7 666 days ago
If you’d have read the comment you’re replying to, you’d know that “robust cryptographic constructions” are irrelevant here, because channels are publicly-accessible.
link