undefined | Better HN

0 pointsFnoord7y ago0 comments

> To participate in some parts of society WhatsApp is now a de facto requirement. A whole nation blindly agrees to whatever terms of use Facebook drafts.

Same if you don't have a Facebook account. Speaking of which, WhatsApp was the defacto IM standard before it was bought by Facebook. Previously it was MSN Messenger (or whatever it is called these days. Skype?) and that was horrible as well. XMMP was at least federated, and had backwards compatibility.

The advantage WhatsApp has over MSN is that the data is E2EE.

There are some people who push for an alternative called Telegram, which uses home brew cryptography instead of established standards.

Though if I look at the Mastodon drama (recently posted on HN, apparently from 2017) federated in practice can lead to fractured communities. Heck, you can even see that in the history of IRC (how EFnet and IRCnet got started).

0 comments

5 comments · 2 top-level

arkadiytehgraet7y ago· 2 in thread

Have you actually seen the implementation of the WhatsApp clients on iOS / Android? How can you say that the data is E2EE when there are no sources, no verifiable builds, nothing but just statements that "yes, we do use E2EE"?

On the contrary, you have open protocol with verifiable implementation and available sources of the Telegram client for mobile platforms; yet you automatically disregard it just because it is not developed by Moxie or whatever.

I am still baffled how people completely turn off their critical thinking when it comes to encryption; I guess this is a fine example how marketing actually works well.

Canada7y ago

Yes, and Telegram being open allows us to confirm with absolute certainty that it uses no E2EE by default.

We don't have the WhatsApp source code, but we don't have to do a lot of reverse engineering to see that it uses this:

https://github.com/signalapp/libsignal-protocol-c

But yeah, you're right, it could be sending plaintext or deliberately leaking keys somewhere. Unless someone really reverses it we won't know it doesn't as surely as we know that Telegram doesn't use encryption at all.

reitanqild7y ago

> Unless someone really reverses it we won't know it doesn't as surely as we know that Telegram doesn't use encryption at all.

Telegram uses encryption by default, just not E2EE.

You can criticise them for

- using their own crypto

- misleading advertising regarding the quality of said crypto

... and possibly more, but I still suggest we try to stick to the facts.

1 more reply

ReverseCold7y ago· 1 in thread

> There are some people who push for an alternative called Telegram, which uses home brew cryptography instead of established standards.

No, it might as well have no end-end cryptography.

The crypto is only enabled for "Secret Chats" and Calls, and I have never seen anyone actually use the secret chat functionality. Using a secret chat limits you to one device and blocks features like bots, so most people don't want to use it.

reitanqild7y ago

>> There are some people who push for an alternative called Telegram, which uses home brew cryptography instead of established standards.

> No, it might as well have no end-end cryptography.

Parent says cryptography, not end-to-end cryptography.

Cryptography provides value even if it is not end-to-end (it limits the attack surface).

There's a lot to say about Telegram, but can please stick to the facts?

j / k navigate · click thread line to collapse

0 comments

5 comments · 2 top-level

arkadiytehgraet7y ago· 2 in thread

I am still baffled how people completely turn off their critical thinking when it comes to encryption; I guess this is a fine example how marketing actually works well.

Canada7y ago

Yes, and Telegram being open allows us to confirm with absolute certainty that it uses no E2EE by default.

We don't have the WhatsApp source code, but we don't have to do a lot of reverse engineering to see that it uses this:

https://github.com/signalapp/libsignal-protocol-c

reitanqild7y ago

> Unless someone really reverses it we won't know it doesn't as surely as we know that Telegram doesn't use encryption at all.

Telegram uses encryption by default, just not E2EE.

You can criticise them for

- using their own crypto

- misleading advertising regarding the quality of said crypto

... and possibly more, but I still suggest we try to stick to the facts.

1 more reply

ReverseCold7y ago· 1 in thread

> There are some people who push for an alternative called Telegram, which uses home brew cryptography instead of established standards.

No, it might as well have no end-end cryptography.

reitanqild7y ago

>> There are some people who push for an alternative called Telegram, which uses home brew cryptography instead of established standards.

> No, it might as well have no end-end cryptography.

Parent says cryptography, not end-to-end cryptography.

Cryptography provides value even if it is not end-to-end (it limits the attack surface).

There's a lot to say about Telegram, but can please stick to the facts?

j / k navigate · click thread line to collapse