A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
Looking for support?
Looking for a community?
~Icon~ ~by~ ~@Double_[email protected]~
Telegram for random public chatter/file storage(with password lock), talking to strangers without giving them your number. Signal for personal/private conversations.
Spread your data (encrypted or not) around, so a single entity doesn't own your digital life. Your device can handle 2 apps and don't give them permissions willy nilly. Geez, every one of these posts just wants to start a flame war.
Telegram rolls their own crypto. That should be the biggest red flag by far. I say this as a telegram user
Use signal and matrix. Telegram is as people pointed out usually unencrypted. Also unverifieble in its code . Signal is easy uses but phonenumbers ( you can register a fake one however) but always EE2E. Matrix does not require a number at all. But definatly is a bit harder to get started with and are therefore harder to get your contact to use it.
If we care about the planet & sustainability, we would not be recommending a eventual-consistency model for chat communications. Matrix’s protocol is so wasteful & expensive.
I won't be popular in this thread, but I don't fight this battle anymore. Telegram beats Signal in virtually every aspect of user experience. If a person is unlikely to be convinced that e2ee is worth taking all the UX hits, I don't try anymore.
I keep seeing this claim, but I may be too much of a computer nerd to notice when using them both. What does Telegram do better and how?
I may be too much of a computer nerd to notice when using them both
That's probably true of just about everyone on Lemmy.
What does Telegram do better and how?
User experience, like I said. How many less technically inclined people do you know who will understand why they have no message history in Signal after moving devices? Yes, they could have kept it if they'd had backups enabled and moved the archive over and restored from it, but it's too late now, their entire contact list has been notified that their safety number's changed (another aspect we get to attempt to explain). It's a bummer.
Signal needs a phone number.
I don't want to give them one. Also I don't have one.
Oh my, that seems to eliminate Signal as an option.
Next?
Apparently Signal still requires it, though you no longer must reveal it to others.
Wired last year: Signal Finally Rolls Out Usernames, So You Can Keep Your Phone Number Private
Those features, which WIRED has tested, are designed to allow users to conceal their phone numbers as they communicate on the app and instead share a username as a less-sensitive method of connecting with one another.
Whittaker says that, for better or worse, a phone number remains a necessary requisite as the identifier Signal privately collects from its users.
Apparently I still don't have one. Haven't had a phone number for about a decade. No SMS spam, no "survey" calls; nothing.
There’s a lot of answers itt but heres a simpler one:
If you want to prevent people in power from having access to communications there are two methods employed, broadly speaking:
The first is to make a very secure, zero knowledge, zero trust, zero log system so that when the authorities come calling you can show them your empty hands and smirk.
Signal doesn’t actually do this, but they’re closer to this model than the second one I’m about to describe. Bear in mind they’re a us company so when the us authorities come to their door or authorities from some nation the us has a treaty with come to their door signal is legally required to comply and provide all the information they have.
The second is to simply not talk to the authorities. Telegram was closer to this model than signal, using a bunch of different servers in nations with wildly different extradition and information sharing mechanisms in order to make forcing them to comply with some order Byzantine to the point of not being worth it.
Eventually the powers that be got their shit together and put hands on telegrams owner so now they’re complying with all lawful orders and a comparison of the tech is how you’d pick one.
The technology behind the two doesn’t matter really but default telegram is less “secure” than default imessage (I was talking with someone about it so it’s on the old noggin’).
While there may be better options out there, from a purely security standpoint.
The real world, with non-tech people needs solutions that are easy, fast and as close to foolproof as possible.
I choose Signal, because my mum, my sisters and brothers (none of which are tech people) can all go to their app stores and install Signal, it works and it is easy. Signal is private BY DEFAULT, I don't have to remind them to turn on security for each chat, there is voice and video chat for individuals and groups, I can use it to send files. It is really good. Secure communication is their primary goal.
I have been using Signal since it was called TextSecure and I only had one contact using it.
Yes it sucked when they dropped SMS support; but these days about 98% of my messaging goes through Signal. Any SMS is usually from my doctor/dentist/bank.
I never really trusted Telegram, too many compromises. Secure communication is not their primary goal.
All big 3, Signal Telegram SimpleX, are just go to app store install, and send invite to contacts. SimpleX gets framed as technical and dissuades new users from installing, while it's just as easy as the other 2.
Maybe, but I have had all of my family on Signal for close to 9 years now. Inertia and the network effect is a big part of why platforms stay around.
It took me saying to my mum, that I would ONLY share pictures of her new grandson on Signal to get her to install it. Once mum was on board, the rest followed pretty quickly.
The thought of getting mum to install a new messaging app now, and she is nearly 10 years older. Well it isn't worth the effort. My threat threat model is low enough, to choose the convenience/security slider at Signal.
As a side note, every month or two; another of my contacts shows up on Signal. I have around 50 contacts using Signal now, as I said before around 98% of my messaging is through Signal.
Signal tells me which contacts in my contacts list has Signal. It also alerts me when someone in my contacts installs Signal.
I believe Telegram also does that.
SimpleX does not.
If they haven’t already, SimpleX registers a URI handler, you could put an ID in a vCard just like your contacts on XMPP show up in a messaging client.
They reason this happens more often with Signal is a) Signal requires a phone number (which is not good for your privacy) b) your contact is more likely to put in their phone number but many forget to add other IM protocols to their vCard & the default contact managers do not make this very discoverable.
Let me start saying that for convenience I adopted Signal. Now, this argument that it validates your contacts is actually something that isn't the best feature of Signal since it implies that it is requesting and having access to phone numbers.
I don't let my number available as my contact, I created the ID and I'm using it in case someone wants to connect with me but that probably isn't something that everyone is practicing and the fact that they retain my number it doesn't digest well.
I'm not sure how is SimpleX nowadays but features like stickers and even some emoticons or message reactions were not possible. Family members and friends would be very difficult to persuade to go back to a very simplistic communication app.
I always keep an eye in alternatives and if usability reaches a good point we may need to consider SimpleX as the messenger for the mainstream recommendation.
The age ol convenience vs privacy. But fair that is user friendly
The fact that telegram operates in a country that scores 18/100 on global freedom and 30/100 on internet freedom.
You don’t have to learn Morse code.
I'm not an expert but I'll use this analogy.
Signal is you meeting a person who gives you secure devices. This person then can only ever provide the following information to someone else. From Signal website. "The phone number. the date and time a user registered with Signal and the last date of a user's connectivity to the Signal service." Only your device and your friends device can read the messages. It goes direct from you to them. The only way to read any message is having the device.
Telegram is like you making an agreement with another person. By default messages are encrypted but go to the other person for decryption before going to your friends device. This other person Telegram has and will give the phone number, messages, serverlogs, dates to legal entities by request. Now there is an option to bypass this person by using "secret chats" . This will make it so the message is directly from your device to their device. Telegram can't read messages but as I understand they can still potentially have metadata, server logs of when messages are sent, how many, what device they are sent from. Bottomline is they have activity logs Signal can only provide the date you signed up and the last time you used the app. Not only that but just being on the Telegram platform which allows bots makes you a target. Bots will contact you like spam. Sending you harmful links, etc.
Almost every security person I've ever read says. "I use Signal". Why wouldn't you go with the service that by default has end to end encryption? Telegram makes it a option you have to select for each person. Both use your phone number.
These are very basic descriptions. I'm Happy to remove or update if I got anything wrong.
I can't speak about telegram, but signal is absolutely not secure to use. Its a US-based service (that must adhere to NSLs), and requires phone numbers (meaning your real identity in the US).
Matrix, XMPP, or SimpleX are all decentralized, and don't require US hosting.
and requires phone numbers (meaning your real identity in the US).
This gets shared a lot as a major concern for all services requiring a phone number. It is definitely true that by definition, a phone number is linked to a person's identity, but in the case of signal, no other information can be derived from it. When the US government requests data for that phone number from Signal, like they occasionally do, the only information Signal provides them with is whether they do have a signal account and when they registered it last and when they last signed in. How is that truly problematic? For all other services which require a phone number, you would have much more information which is where it is truly problematic, say social graph, text messages, media, locations, devices etc. But none of that is accessible by Signal. So literally the only thing signal can say is whether the person has an account, that's about it. What's the big deal about it? Clearly the US government already has your phone number because they need it to make the request for Signal, but they gain absolutely no other information.
Reding the link now " The reason the US government hasn’t tried to block or hinder Signal, is because it’s satisfied with the amount of information Signal can provide to it." Well the metadata of who is contacting who can be acquired by other means. CIA also like to have secure tools. Just like you can argue the CIA connection in the TOR case . It doesn't mean backdoors and so on.
Centralisation argument sure, but that issue will always be there at some level, even for matrix.
Phonenumber discovarability argument is no longer correct as it is possible to use signal and not disclosing it to contacts, but yes still to signal.
I have a signal account with a fake number so that is an option as well, if even more work than matrix process.
So if I understand it Signal has your phone number but only logs sign up date and last activity date. So yes they can say this person has Signal and last used it on date X. Other than that no information.
Matrix doesn't require a phone number but has no standard on logging activity so it's up to the server admin what they log, and they could retain ip address, what users are talking in what, rooms, etc. and E2EE is not required.
I think both have different approaches. I'm just trying to understand. On one hand you have centralized system that has a standard to minimize logs or decentralized system that must be configured to use E2EE and to remove logs.
This entire article is guessing at hypothetical backdoors. Its like saying that AES is backdoored because the US government chose it as the standard defacto symmetrical encryption.
There is no proof that Signal has done anything nefarious at all.
This entire article is guessing at hypothetical backdoors. Its like saying that AES is backdoored because the US government chose it as the standard defacto symmetrical encryption.
There is no proof that Signal has done anything nefarious at all.
As an outsider, I mean isn't that the same for news coverage for chinese/russian backdoors, but everyone believes it without any proof.
Why is US company being a US honeypot a big surprise, and its government recommending it not a big red flag? but it is when China recommends wechat? Can't we be critical and suspicious of both authoritarian countries?
Do you have access to Signal servers to verify your claims by any chance? Afaik their servers are running modified codebase, and third party apps cannot use them. So how do you claim anything that goes behind closed doors at all? Genuinel curious.
As you say yourself (cryptocraphic nerd here):
Signal’s E2EE protocol means that, most likely, message content between persons is secure.
So a shame there are no free servers, are the server soft not open source, only the signal app itself?
SimpleX is taking a lot of venture capital money which makes it just slightly suspect, imho. Those guys usually want a return of some kind on their investment. I simply don't trust the motives of technocrats like Jack Dorsey.
The Matrix Foundation, on the other hand, seems a lot more democratic in governance and stewardship of the protocol.
Good projects require money. And SimpleX is still way better than Signal and Telegram, so imo it's worth supporting and using
Thank you for your post!
I want you to know your effort and knowledge is appreciated, this will help future readers make better decisions.✨
But the situation stands that my friend and their friends are not as technologically literate as we are, and I would rather have them on something easy and secured than unsecured at all, especially from my experience with getting communities to use such decentralized platforms you mentioned.
Matrix is no more difficult to sign up on than signal, and they don't forward your information to the US government.
Matrix is centralized around Matrix.org or servers they run tho. Since the protocol is a big data/metadata sync by design & medium–large-sized servers are expensive to run, almost all of metadata is with Matrix.org—of which was originally funded my Israeli intelligence & I wouldn’t be surprised if they were getting data out of it to this day.
Further, they're hosted in Germany, so they must still follow German law and court requests.
I am not uneducated in this matter, I run Matrix instances and have dabbled in development of tools around it.
Perhaps our experience is different, but I have had great difficulty in helping groups on the ground to use Matrix.
Regardless of our agreement that Matrix is better than Signal, it should not cloud our judgement in at least reducing the harm that is Telegram.
In the future we can keep joining hands to work towards a better future, but for now I hope you can understand my perspective and choice.
Telegram doesn't even encrypt group chats. And it doesn't encrypt private convos by default.
Get what you are trying to say but both are still encrypted. They simply aren't end to end encrypted. So the messages are private. Until obviously the company servers get hacked or police raided and the keys to the encryption get stolen. You are protected against this in E2E encryption. True.
Ii guess telegram once was the alternative to whatsapp, then made maany more featutes abailable in fast time paces which led to another bunch of migrators.
Now noone wants to move away because why? For the usual end user there is no negative to them.
I am fully on your side and am using signal and matrix and try to migrate as many people as possible but its hard.
Get what you are trying to say but both are still encrypted. They simply aren't end to end encrypted. So the messages are private.
You explain exactly why messages are not private: if they are not end-to-end encrypted, by definition Telegram can read all the messages. That's exactly what end-to-end is meant to protect against. So in that aspect, Signal truly is private and Telegram maybe, if you activate their private chats but I've not seen security experts praise their algorithm, compared to their regular endorsement for Signal.
In my view, by far the biggest reason to switch is that Telegram doesn't end-to-end encrypt chats by default.
Yes you can start encrypted chats specifically, but i'll bet 99% of chats on telegram aren't encrypted - meaning whoever has access to the telegram servers can read all the messages.
Signal claims to end-to-end encrypt all chats by default, and if you want to be 100% sure you can in theory read the source code and compile the app yourself. this means signal cannot read any of your messages, even if police asks them to or servers get seized. That's a massive advantage in privacy.
Additionally, E2E chats don't sync between devices (and iirc you can't use them on desktop at all), and group chats can't be encrypted at all.
Signal very recently made syncing between devices possible:
https://signal.org/blog/a-synchronized-start-for-linked-devices/
Note that this is sent at time of syncing rather than being in an archive on the company’s server 24/7
Breaking news hahaha
I was talking about Telegram. Syncing messages between devices has always been possible on Signal, just not the ones from before you connected the extra device.
There is also desktop clients for both.