Telegram's "Privacy" is Bullshit (Video)

Dark_Arc , 9 months ago

Wow, not to pick on the narrator, but this comes off like the worst small town used car dealership TV advertisement I've ever seen.

Here's a real rundown I've put together over the years:

Pavel Durov's argument is that there should be a high functioning UI/UX experience for "non-secure" communication, and when you need it there's something much closer to Signal's very secure client-to-client encryption.

Arguably Telegram secret chats are even "close enough" to cloud chats an adversary might not notice you're doing the "super secret things" (making it harder to identify what to target).

MTProto Cloud: https://core.telegram.org/file/811140746/2/CzMyJPVnPo8.81605/c2310d6ede1a5e220f

MTProto Secret (Wrapped in MTProto Cloud): https://core.telegram.org/file/811140633/4/hHw6Zy2DPyQ.109500/cabc10049a7190694f

They also provide verified builds even on iOS (though it's a bit of a hack, not "really" quite the same thing).

The only things that can really be said about Telegram's secret chat crypto are that:

1. It's not "the default"
2. It's their own crypto (i.e., they broke "rule #1" and "rolled their own")

Ultimately though, it's been just shy of 10 years since Telegram entered the scene, and nobody has actually broken Telegram crypto in any meaningful way -- AFAIK, to this day. Still, there are hypothetical holes in the crypto when scrutinized vs something like signal. So, is it as good as Signal or Threema? Eh, probably not, is it good enough for the average person that isn't target by a nation state? I'd say probably.

library_napper , 9 months ago

I think you missed the most important part: all accounts are tied to a phone number

Dark_Arc , 9 months ago

Except that's not even true... https://www.livemint.com/technology/apps/telegram-brings-new-update-no-phone-number-needed-for-sign-up-more-features-11670403019183.html

And for most people, it doesn't matter. It really doesn't. I'm not even going to argue about that. I personally couldn't care less about instant messaging with anonymity; anonymity and private are completely separate concerns.