[buyucu]

This is yet another red flag from Signal.

Telegram was not disrupted during the AWS crash, so they probably were not using it (or had a decent fail-over mechanism to a backup system). Telegram's user-base is two orders of magnitude larger than Signal, so 'we use AWS because we have to' argument clearly is bogus and nonsense.

[akimbostrawman]

That flag is tiny compared to the one telegram has been sailing with for years.

Despite there founder crying on twitter[1] how horrible and distopian chat control client side scanning to bypass E2EE would be, telegram is still only offering hidden and limited opt-in E2EE instead of making it global default like signal.

[1] https://twitter.com/durov/status/1976420399970701543

[buyucu]

E2EE is nice to have, but not the magic cure Signal advertises it is. The #1 most authoritarian governments access chats is by forcing people to unlock their phone. At which point Signal's obsession with phone numbers becomes a huge liability. You can't claim security while tying a phone number to each and every account.

[akimbostrawman]

>The #1 most authoritarian governments access chats is by forcing people to unlock their phone

How would you know this? If they access the data from the platforms server you would never know unlike with obvious forceful physical seazure. The point of E2EE is that the weakest link, the server, is removed. It increases the required threat model from simple dragnet surveillance to high effort targeted attacks. If the client is insecure nothing can protect your data and signal has said that many times.

I don't see how the debate about requiring a phone number is relevant to this discussion since telegram does too.

[buyucu]

Because I live in a very authoritarian government. That is how I know.

The weakest link is not the server. The weakest link is the user device. There is no security without anonymity.

[akimbostrawman]

That makes no sense. If you don't trust your government anything but E2EE is compromised from the get go. "But they could seize your device" is not an argument against but for mandatory E2EE because it moves the responsibility from the server you have no control over to your device that you do.

>There is no security without anonymity.

You don't understand what these words mean. You can be surveilled 100% by bodyguards and cameras to be secure but have 0% anonymity (or privacy).

[4gotunameagain]

Telegram vs Signal is really a moot comparison in the technical sense.

It is more of a question, who would you rather read your messages ? USA or Russia ?

Because even if there is E2E encryption and an open source client, unless you review it and compile it yourself, there is nothing to say that your messages are relayed to some agency's datacenter after decryption. The USA has all the legal framework necessary to achieve that with the tremendous power of the "intelligence" agencies, and Russia.. well.. doesn't even need that.

[buyucu]

Telegram's founders are in exile from Russia after the Russian government took over their previous venture (Vkontakte). It is misinformation to associate Telegram with the Russian government.

[throwaway74354]

Nikolai Durov lives in Saint Petersburg and works for the Russian Academy of Sciences. Pavel Durov had visited Russia multiple time since his "exile".

The public-facing story around Telegram is performative PR, which could be explained by the exact reasons listed in the parent comments: association with the Russian state had hindered VK growth besides the CIS region.

[buyucu]

I can't verify this anywhere. The latest information appears to be that Nikolai Durov lives in Dubai.

[throwaway74354]

Wikipedia quotes https://www.bbc.com/russian/articles/cdjwm9eew0xo , which uses this article as a source: https://www.kommersant.ru/doc/6920516

[balaz]

Telegram is not related to the government of Russia.

[f33d5173]

It isn't that it's impossible, but that it would take significantly more resources to accomplish the same thing.

[buyucu]

Why? AWS is neither cheap, nor reliable (as we saw last week).

[fulafel]

What does Telegram run on?

[throwaway74354]

Their possible DB-related single points of failure are located in on-prem DCs in the Netherlands.

[buyucu]

not AWS apparently