Telegram Hits 2B Messages Sent Daily(telegram.org)
telegram.org
Telegram Hits 2B Messages Sent Daily
https://telegram.org/blog/2-billion
110 comments
I am really happy to see Telegram growing. I am one of those people who deleted Whatsapp (and lost touch with 30-40 people and several groups) when Facebook bought it.
So far I have been happy with it, even though only like 5 of my friends use it. Yeah, it may (or may not) have security flaws like many on HN complain, but I would take it anyday over FB owned give-us-all-your-data product.
So far I have been happy with it, even though only like 5 of my friends use it. Yeah, it may (or may not) have security flaws like many on HN complain, but I would take it anyday over FB owned give-us-all-your-data product.
Same here, except the people I wanted to communicate with are either the same or kind enough to install it also. If they don't care about WhatsApp already why should they care about installing Telegram next to it? Doesn't make a difference (to them anyway).
Why did you delete Whatsapp?
I deleted it when this happened: https://4d43.wordpress.com/2014/05/29/whatsapp-and-facebook-...
Not the person you're asking, but for me personally I never wanted it. I installed it because a group in school wanted to kick me from the project because I'm "unreachable" (which meant I had no WhatsApp -- email, telegram, IRC, sms, calling, anything would have worked, but no WhatsApp was a reason to make me fail my year). I was sad that I couldn't uninstall it before Facebook bought it.
[deleted]
I've been trying to get friends and family to switch to Telegram from iMessage and WhatsApp. Their native apps are great platform, speed is awesome, and, above all, it's a platform-agnostic system. I highly recommend it.
This is a huge hurdle in my opinion. Most of my friends own an iPhone and since I also own one, we group message on iMessage. If I wanted to switch to an Android, I would have to either convince them to switch to WhatsApp, Telegram etc etc or stop being part of that group chat, I think they call this FOMO. So having a bunch of friends with an iPhone that I regularly communicate with is a big pressure to continue buying Apple products.
Isn't WhatsApp more secure than telegram now that it implements the textsecure protocol? I guess the biggest hurdle with whatsapp now is what to do when the public key for a user changes...
WhatsApp is still a complete pain to use once you are used to Telegram. Wanna switch phones? Better get ready to backup all your messages by hand. Want to use something other than a phone? Here, use our shitty web app. Your phone is out of battery? sucks for you i guess!
>> Your phone is out of battery? sucks for you i guess!
??
Can you use telegram from another device? I think WhatsApp now has a windows client, maybe macos as well, recently announced.
No idea what the security is like though.
--edit-- Erm, I'm confused at the downvote, the parent raised a series of objections to WhatsApp and I asked for clarification of what they meant and suggested a non-phone client was available.
I've done the research now and it turns out to be utterly useless if your phone's out of batteries as it does some sort of sync'ing and relies on the phone being on, so it's not fit for the purpose.
But I'm still mystified at the downvote...
--edit 2-- More downvotes! Yay! Wtf?
??
Can you use telegram from another device? I think WhatsApp now has a windows client, maybe macos as well, recently announced.
No idea what the security is like though.
--edit-- Erm, I'm confused at the downvote, the parent raised a series of objections to WhatsApp and I asked for clarification of what they meant and suggested a non-phone client was available.
I've done the research now and it turns out to be utterly useless if your phone's out of batteries as it does some sort of sync'ing and relies on the phone being on, so it's not fit for the purpose.
But I'm still mystified at the downvote...
--edit 2-- More downvotes! Yay! Wtf?
You can use Telegram on any device you want at same time. PC, Phone, tablet, you name it.
WhatsApp on the other hand only works in one device (your phone). They released a webchat, that just works as a proxy to connect to your phone. So in order to use the WhatsApp web, you need your phone on and with internet connection.
WhatsApp on the other hand only works in one device (your phone). They released a webchat, that just works as a proxy to connect to your phone. So in order to use the WhatsApp web, you need your phone on and with internet connection.
People will probably continue downvoting you as long as you continue to complain about downvotes. Downvotes happen, whether randomly or because someone is having a bad day. Making a fuss out of it is counterproductive.
I'm not complaining really, I was just wondering why.
I upvoted you. Last time I tried it, using Whatsapp on your computer requires you to have the phone on. I think this is because the app on the phone holds your private key. I imagine this is also the reason why you can't use your whatsapp on a tablet or on multiple phones.
They say they have done it for Android, but as far as I know there hasn't been any similar announcement for iOS. There doesn't seem to be a way to verify public keys either like how Threema does.
iPhone users can't do WhatsApp from their computers. I will resist WhatsApp in my social circles to the greatest extent possible until that's fixed.
I wonder whether telegram could offer a bridge service to proxy WhatsApp accounts, meaning you could switch to WhatsApp without losing any contacts...
Alternatively, perhaps the API can be glued to WhatsApp somehow.
They market themselves as open source but as far as I can tell none of their server side code is available.
And if you want to build an app using the telegram system it's basically using their cloud servers.
Does anyone know what their tech stack is?
And if you want to build an app using the telegram system it's basically using their cloud servers.
Does anyone know what their tech stack is?
Where does it say open source?
I see where it says they have an open API and protocol, but nothing about source code.
So how secure is Telegram?
As far as I understand, not encrypted by default, and not very secure even when encrypted:
http://www.alexrad.me/discourse/a-264-attack-on-telegram-and...
http://www.alexrad.me/discourse/a-264-attack-on-telegram-and...
Not encrypted by default? Really?
There are varying degrees of what "encrypted by default" means.
WhatsApp used port 443 but sent plain text messages for years. Only fairly recently they switched around to actual encryption.
Telegram messages have never been readable across the network and they claim that they also can't read the messages themselves. This is due to storing the encryption key in a different data center, but that begs for the question of how they deliver my phone the message if they don't have the decryption key. (Answering "incorrectly" that they can read my messages was how I didn't make it on the support team.)
Then there is MTProto which everyone is buzzing about but which isn't even supported in all clients. This is the "secret chat" feature you see here and there, and it is actually encrypted end to end (and verifyably so). Clients are all open source so we can check that they are end to end encrypted -- WhatsApp or Facebook can ship you a backdoored version and you'd never be the wiser.
Saying Telegram is "not encrypted by default" is like saying "https is not encrypted by default" because the server software can read the private messages you send to other people.
WhatsApp used port 443 but sent plain text messages for years. Only fairly recently they switched around to actual encryption.
Telegram messages have never been readable across the network and they claim that they also can't read the messages themselves. This is due to storing the encryption key in a different data center, but that begs for the question of how they deliver my phone the message if they don't have the decryption key. (Answering "incorrectly" that they can read my messages was how I didn't make it on the support team.)
Then there is MTProto which everyone is buzzing about but which isn't even supported in all clients. This is the "secret chat" feature you see here and there, and it is actually encrypted end to end (and verifyably so). Clients are all open source so we can check that they are end to end encrypted -- WhatsApp or Facebook can ship you a backdoored version and you'd never be the wiser.
Saying Telegram is "not encrypted by default" is like saying "https is not encrypted by default" because the server software can read the private messages you send to other people.
Yes, to clarify I assumed OP was asking about end-to-end encryption not SSL.
I think it's not end-to-end encrypted by default; for "private" chats they claim to use end-to-end encryption, but use some homebew cryptographic protocol of dubious security.
And, as far as I can tell, an idiotic visual key comparison only, so I've no way to call a contact and verify keys.
They claim in their FAQ that messages are encrypted during transport and at rest - by default.
End to end encryption isn't enabled by default though, the argument being that this way you lose some features (like a shared history on their servers..).
End to end encryption isn't enabled by default though, the argument being that this way you lose some features (like a shared history on their servers..).
I wonder why isn't there a "text messaging mobile app" out there which just uses openPGP signed and encrypted email as the backend. Email is not that far from text messaging anyway.
The answer is forward secrecy.
If an attacker were to record all of a target’s ciphertext traffic over some extended period of time, and then compromise that one key at any point in the future (perhaps by seizing the device it’s on), they would have the ability to decrypt all of the previously recorded ciphertext traffic belonging to the target.
https://whispersystems.org/blog/asynchronous-security/
If an attacker were to record all of a target’s ciphertext traffic over some extended period of time, and then compromise that one key at any point in the future (perhaps by seizing the device it’s on), they would have the ability to decrypt all of the previously recorded ciphertext traffic belonging to the target.
https://whispersystems.org/blog/asynchronous-security/
I believe the reason is that exchanging public keys is, unfortunatly, to much work for the average user.
Telegram is fantastic with the glaring exception of mandatory read receipts.
Am I the only one that can't stand having people know when I've read their messages? It seems like every major chat platform (except for iMessage) has read receipts enabled without any option to disable them. Why has this become so popular?
Am I the only one that can't stand having people know when I've read their messages? It seems like every major chat platform (except for iMessage) has read receipts enabled without any option to disable them. Why has this become so popular?
> Why has this become so popular?
It settles the age old question of "Hey, did you get my message?". Many people like this functionality.
It settles the age old question of "Hey, did you get my message?". Many people like this functionality.
I'm more than happy to show "delivered reciepts" since that covers the question of whether the message arrived.
I prefer to be able to read and reply later if I want to without feeling guilty that it'll look like I just couldn't be bothered. I mean, it's true, I couldn't be bothered, I just don't want to broadcast that fact :p
I prefer to be able to read and reply later if I want to without feeling guilty that it'll look like I just couldn't be bothered. I mean, it's true, I couldn't be bothered, I just don't want to broadcast that fact :p
If you're on android, read the messages in the popup status window, it'll leave it "unread" until you open the conversation. You might need to enable the preview function for popups and/or popups for out to work. Kind of works unless someone sends a massive amount of messages/text.
Also, it seems to be missing an obvious way to export your message history? Am I missing something or does anyone know if this is on the todo list?
Having said that I really like it and am encouraging my group to switch to test it out.
I wonder how effective that will be: "The Inertia ... the inertia" (said in full-on Marlon Brando Apocalypse Now voice)
Having said that I really like it and am encouraging my group to switch to test it out.
I wonder how effective that will be: "The Inertia ... the inertia" (said in full-on Marlon Brando Apocalypse Now voice)
Almost certainly because it increases engagement. By optimizing purely on metrics, psychologically undesirable effects creep in (guilt, in this case). c.f. online gaming apps and their addiction inducing behaviour.
Everyone I talk to on Telegram understands I might read their message at one moment and respond later (or not at all). It's not an issue for me.
[deleted]
The link here says that WhatsApp hit 800 million users last month: https://news.ycombinator.com/item?id=9538717
Telegram hit 1 billion messages in December 2014, and had 50 million active users at that time[1].
So, is it reasonable to assume that WhatsApp sends around 16 billion messages every day?
[1] https://telegram.org/blog/billion
Telegram hit 1 billion messages in December 2014, and had 50 million active users at that time[1].
So, is it reasonable to assume that WhatsApp sends around 16 billion messages every day?
[1] https://telegram.org/blog/billion
"Telegram is free forever. No ads. No subscription fees."
How is that sustainable?
How is that sustainable?
+1, 2b messages is not cheap, where is their revenue if not from subscribers or from selling data?
My only guess is that they are planning to charge for their api when they hit scale.
My only guess is that they are planning to charge for their api when they hit scale.
My dad is still an "avid" Blackberry user (as much as anyone who uses a blackberry these days is avid) and I note Telegram does not have a Blackberry client. Until that changes, we're still on whatsapp.
EDIT: I want a polished official product, not something put together in a hackathon: https://telegram.org/blog/bb-results
EDIT: I want a polished official product, not something put together in a hackathon: https://telegram.org/blog/bb-results
Telegram is great. I've got all of my friends upgraded from WhatsApp (and SMS) and we haven't looked back.
I switched to Telegram with my fiancée because of troubles with migrating WhatsApp data when she bought a new phone. When we powered up the new phone we realized that WhatsApp message history hadn't been transferred in the device migration (Windows Phone here) and there was some data that we wanted to preserve. WhatsApp on the old phone stopped working because the account had been used on the new phone so we couldn't even look at the chat history without using the SIM card to reactivate it. Reactivating WhatsApp on the old phone involved some extra hassle because the two phones had different SIM card slot sizes. After reactivation we could look at the old messages before moving the SIM card back to the new phone but couldn't transfer them, since WhatsApp chat history transfer on WP requires that both phones have an SD card slot. Being pretty fed up with WhatsApp at that point I found Telegram and have used it ever since.
[deleted]
Threema FTW.
Why is another closed source/paid product better than this one?
I'm okay with a price for something that I might use every day, but if I'm accepting closed source solutions - what's the benefit of Threema here?
I'm okay with a price for something that I might use every day, but if I'm accepting closed source solutions - what's the benefit of Threema here?
Telegram is as good as closed source too. Look more into what they've actually open sourced...
I know. [1] Which is a pity.
If you'd want to believe their promise [2] they do plan to open up everything, but at the moment they're a closed source IM provider.
But that's irrelevant. The GP hijacked a thread about Telegram with Threema, with a three letter acronym and nothing else. For me, Telegram and Threema have the same flaw (not open). If I'd have to pick one of the two, I'd go with Telegram I guess - it's free (as in beer) and offers clients for nearly every platform I could care about.
So 'Telegram isn't open either' is correct, but misses the point: Given 'Threema FTW' my reaction was 'Why'?
1: When I wrote Why is another closed source/paid product better than this one? I tried to say (not my native language) Why is Threema, a closed source/paid product, better than this (closed source) one?
2: https://telegram.org/faq#q-why-not-open-source-everything
If you'd want to believe their promise [2] they do plan to open up everything, but at the moment they're a closed source IM provider.
But that's irrelevant. The GP hijacked a thread about Telegram with Threema, with a three letter acronym and nothing else. For me, Telegram and Threema have the same flaw (not open). If I'd have to pick one of the two, I'd go with Telegram I guess - it's free (as in beer) and offers clients for nearly every platform I could care about.
So 'Telegram isn't open either' is correct, but misses the point: Given 'Threema FTW' my reaction was 'Why'?
1: When I wrote Why is another closed source/paid product better than this one? I tried to say (not my native language) Why is Threema, a closed source/paid product, better than this (closed source) one?
2: https://telegram.org/faq#q-why-not-open-source-everything
I actually like Threema. But convincing others to pay $2 when whatsapp is free is a tough sell.
Why?
It's a little frustrating to see that the most secure (yet still usable) alternatives aren't the most popular (perhaps with the exception of iMessage, although 95% of the security of those messages is compromised anyway by the backup system that's enabled by default).
I like to tell myself that this is because the really good open source options don't have enough money or clout to make themselves popular, while apps like Whatsapp or Skype or Telegram do. It's just unfortunate that the least secure apps and services get pushed to the mainstream simply because of money.
I like to tell myself that this is because the really good open source options don't have enough money or clout to make themselves popular, while apps like Whatsapp or Skype or Telegram do. It's just unfortunate that the least secure apps and services get pushed to the mainstream simply because of money.
It 100% isn't about popularity, it's about usability.
I tried to get my friends on Tox, but ultimately had to get them on Telegram because it was the only app that was truly 100% cross-platform.
I tried to get my friends on Tox, but ultimately had to get them on Telegram because it was the only app that was truly 100% cross-platform.
Yeah, because xmpp doesn't exist.
You got my upvote and I stated elsewhere in this thread that I'm currently upgrading my xmpp server (to the unreleased 0.10 version of prosody).
But let's be honest: xmpp is still not there. To have something comparable to what these clients offer you need a good number of extensions, notably (ymmv)
- Message carbons (i.e. a message reaches all online devices)
- Stream management (because without it, people are going to consider xmpp broken. "It loses my messages")
- MAM (for shared archives between clients/devices, the reason for me upgrading to an unstable server now)
Given that one of these isn't even (widely) available so far, I'd say xmpp is in a bad position. I love the idea. But it's hard to imagine that it can gain traction right now, given that the 'only' thing it has to offer against all the other systems is federation. I care about that. But .. most don't.
But let's be honest: xmpp is still not there. To have something comparable to what these clients offer you need a good number of extensions, notably (ymmv)
- Message carbons (i.e. a message reaches all online devices)
- Stream management (because without it, people are going to consider xmpp broken. "It loses my messages")
- MAM (for shared archives between clients/devices, the reason for me upgrading to an unstable server now)
Given that one of these isn't even (widely) available so far, I'd say xmpp is in a bad position. I love the idea. But it's hard to imagine that it can gain traction right now, given that the 'only' thing it has to offer against all the other systems is federation. I care about that. But .. most don't.
You know, I've always been planning to set up my own xmpp server, so I haven't looked to hard at the public offerings. Unfortunately there doesn't appear to be any good list over public service providers -- one that includes things like does the server support server side archiving etc.
I was hopeful when I saw that duckduckgo[ddg], fastmail[fm] and mailbox.org[m] had public chat services. But of the three, none support standard archiving [XEP-0136] and only fastmail supports a custom form of archiving (via special emails to your fastmail-account). The latter at least gives you an option to archive chats (for eg: search) -- but it appears there's a market for a good, public and full-featured xmpp/chat service.
Most of the other public servers appear to a) be free-only -- not a business -- and b) focused on privacy. I find it a bit surprising that noone has tried launching a free+paid option -- say reserving some features for paying users (and charge maybe 1 USD/month?).
Actually, I think duckduckgo.com would be happy to "host" a services free tier -- have a trial account mode, and point user that just want a free chat service to ddg. Ddg gets more registered users, more users of their services, and those that are willing to pay for some features (eg: server side archiving, server side notes... others?) can pay a small amount for the service.
Only draw back would be no seamless transition from one to the other (change of username/domain). On the plus side, all my trial accounts can talk to each other without problem (via server side federation) -- it just works.
[ddg] https://duck.co/blog/using-pidgin-with-xmpp-jabber
[fm] https://www.fastmail.com/help/clients/chat.html
[m] https://mailbox.org/en/mailbox-org-launched-secure-instant-m...
[l] https://list.jabber.at/
[edit: And while mailbox.org has an interesting offering, like some kind of deal with yubikey -- they seem to have neglected their xmpp setup somewhat -- there are some issues with ssl certs. Pidigin can't seem to figure out that xmpp at fastmail is chat.messagingengine.com, nor that mailbox uses xmpp.mailbox.org. Both give additional certificate errors if not adjusted. I suppose fastmail hasn't set up srv-records/dns aliases for their vanity domains (I registered mm.st -- as it was the shortest). It'd be better if one could just type in <user>@mm.st and have everything work. The bug might be in Pidgin, but fm really needs to test things. Of the three, ddg was by far the easiest to get started with -- register right in the im client (which also generates an account that works for ddg); and go.]
I was hopeful when I saw that duckduckgo[ddg], fastmail[fm] and mailbox.org[m] had public chat services. But of the three, none support standard archiving [XEP-0136] and only fastmail supports a custom form of archiving (via special emails to your fastmail-account). The latter at least gives you an option to archive chats (for eg: search) -- but it appears there's a market for a good, public and full-featured xmpp/chat service.
Most of the other public servers appear to a) be free-only -- not a business -- and b) focused on privacy. I find it a bit surprising that noone has tried launching a free+paid option -- say reserving some features for paying users (and charge maybe 1 USD/month?).
Actually, I think duckduckgo.com would be happy to "host" a services free tier -- have a trial account mode, and point user that just want a free chat service to ddg. Ddg gets more registered users, more users of their services, and those that are willing to pay for some features (eg: server side archiving, server side notes... others?) can pay a small amount for the service.
Only draw back would be no seamless transition from one to the other (change of username/domain). On the plus side, all my trial accounts can talk to each other without problem (via server side federation) -- it just works.
[ddg] https://duck.co/blog/using-pidgin-with-xmpp-jabber
[fm] https://www.fastmail.com/help/clients/chat.html
[m] https://mailbox.org/en/mailbox-org-launched-secure-instant-m...
[l] https://list.jabber.at/
[edit: And while mailbox.org has an interesting offering, like some kind of deal with yubikey -- they seem to have neglected their xmpp setup somewhat -- there are some issues with ssl certs. Pidigin can't seem to figure out that xmpp at fastmail is chat.messagingengine.com, nor that mailbox uses xmpp.mailbox.org. Both give additional certificate errors if not adjusted. I suppose fastmail hasn't set up srv-records/dns aliases for their vanity domains (I registered mm.st -- as it was the shortest). It'd be better if one could just type in <user>@mm.st and have everything work. The bug might be in Pidgin, but fm really needs to test things. Of the three, ddg was by far the easiest to get started with -- register right in the im client (which also generates an account that works for ddg); and go.]
Now, there are good and bad answers that I can provide here.
Bad: Lots of things you take for granted if you look into WhatsApp/Hangouts/Telegram et al are extensions, lots of these extensions are optional, lots of optional extensions are not supported in a coherent way.
Somewhat bad: Archives had a decent XEP, but it's not 136. It's 313 (which I mentioned above, MAM). You probably won't find any improvements in 136, it's - as far as I can tell - considered superseded, although 313 is still not really available (which is the reason for me listing this as 'bad').
Good: Running your own server is trivial. Really. People always say that running a mail server is hard and - maybe it is. It certainly has a number of issues you can run into. Running an XMPP server? Install, configure, done. Easy. Give it a try this weekend?
Bad: Lots of things you take for granted if you look into WhatsApp/Hangouts/Telegram et al are extensions, lots of these extensions are optional, lots of optional extensions are not supported in a coherent way.
Somewhat bad: Archives had a decent XEP, but it's not 136. It's 313 (which I mentioned above, MAM). You probably won't find any improvements in 136, it's - as far as I can tell - considered superseded, although 313 is still not really available (which is the reason for me listing this as 'bad').
Good: Running your own server is trivial. Really. People always say that running a mail server is hard and - maybe it is. It certainly has a number of issues you can run into. Running an XMPP server? Install, configure, done. Easy. Give it a try this weekend?
Well, the "bad" is still better than using WhatsApp (or whatnot) -- even if there's only one combination of foss-cross-platform-client-x and foss-server-y that work together to give what's needed -- the protocol(s) are documented, and the implementations are available.
Thanks for the reality-check on server-side archiving :-/
As for running the server being trivial: I can believe that (I do run my own mail). I'm not really in a hurry to set it up for myself -- I have most people I chat with on xmpp (still!) on fb -- and they won't be moving any time soon.
I'll set it up as I move into my new dedicated server. My current "main" vps is running Debian oldstable lts, and I really don't want to set up anything new on that box, as I'm transitioning away from it.
After playing with Pidgin on windows (for testing the above), I've been playing with the idea of forking it and ripping out all the non-xmpp stuff, and maybe trimming the (G)UI/UX a bit too.
I should perhaps mention that when I occasionally do chat with people it's usually over IRC w/IRSSI.
Thanks for the reality-check on server-side archiving :-/
As for running the server being trivial: I can believe that (I do run my own mail). I'm not really in a hurry to set it up for myself -- I have most people I chat with on xmpp (still!) on fb -- and they won't be moving any time soon.
I'll set it up as I move into my new dedicated server. My current "main" vps is running Debian oldstable lts, and I really don't want to set up anything new on that box, as I'm transitioning away from it.
After playing with Pidgin on windows (for testing the above), I've been playing with the idea of forking it and ripping out all the non-xmpp stuff, and maybe trimming the (G)UI/UX a bit too.
I should perhaps mention that when I occasionally do chat with people it's usually over IRC w/IRSSI.
My server of choice would be prosody, and if you're willing to try the (unreleased) 0.10 you'd even get the archive options listed above.
Plus, it integrates rather cleanly with a good number of systems, in my case it's using dovecot as authentication agent for example (and therefor relies on virtual users specified ~elsewhere~).
It can work. And it's really not hard. It's just not seamless, unfortunately.
Plus, it integrates rather cleanly with a good number of systems, in my case it's using dovecot as authentication agent for example (and therefor relies on virtual users specified ~elsewhere~).
It can work. And it's really not hard. It's just not seamless, unfortunately.
> the implementations are available.
the clients are categorically awful :)
re forking:pidgin and libpurple are huge. focussing on webclients first and pidgin gajim etc afterwards is a better bet.
the clients are categorically awful :)
re forking:pidgin and libpurple are huge. focussing on webclients first and pidgin gajim etc afterwards is a better bet.
I don't really need a web client. At any rate, I have chatsecure for Android -- a good command-line client with a way to access logs would be nice -- but a GUI app would also work.
given federation is going the way off the dodo, if you do decide to set up a server, you are going to need people on that server to talk to. or else it's an echo chamber.
so while it may be that you have a client that you use for android, if you want to talk to other people, you are going to need a client that supports the features they want.
what i am telling you is, is that the clients are a crapshoot that all support their own subsections of features. finding clients that people will use, for every platform is a massive timesink.
my advice therefore, is to pick a nice webclient.
so while it may be that you have a client that you use for android, if you want to talk to other people, you are going to need a client that supports the features they want.
what i am telling you is, is that the clients are a crapshoot that all support their own subsections of features. finding clients that people will use, for every platform is a massive timesink.
my advice therefore, is to pick a nice webclient.
> given federation is going the way off the dodo
I'm not sure what you mean. Sure facebook and to a lesser extent google are wilfully screwing their users for no good reason (well no good reason for the users). But mailbox.org, fastmail and duckduckgo all federate just fine with each other.
It's not like I'm expecting whatsapp to suddenly enable xmpp and server federation over ssl (does anyone know why google doesn't just turn on ssl for server federation? I could understand killing xmpp, but why keep federation, but refuse to use ssl, on this one service?).
Suprisingly, I can't seem to find anyone that both provides on-line registration, federation and a web client...
In my case, I assume the more pragmatic route would be to set up a gateway to gtalk and fb, leaving me to use whatever client(s) I enjoy. I suppose I might host a public web client as well... but I don't see who would use that, rather than just send me an email, sms or call.
I'm not sure what you mean. Sure facebook and to a lesser extent google are wilfully screwing their users for no good reason (well no good reason for the users). But mailbox.org, fastmail and duckduckgo all federate just fine with each other.
It's not like I'm expecting whatsapp to suddenly enable xmpp and server federation over ssl (does anyone know why google doesn't just turn on ssl for server federation? I could understand killing xmpp, but why keep federation, but refuse to use ssl, on this one service?).
Suprisingly, I can't seem to find anyone that both provides on-line registration, federation and a web client...
In my case, I assume the more pragmatic route would be to set up a gateway to gtalk and fb, leaving me to use whatever client(s) I enjoy. I suppose I might host a public web client as well... but I don't see who would use that, rather than just send me an email, sms or call.
well it was my assumption that the only people you wanted to talk to were on google/facebook. if you have people on other networks that support federation to talk to - fair enough. if you don't have people on those networks, you'll have to convince people to move. or harder again, you'll have to get them on to your server.
bluescat(probable google employee) says webRTC is the way things are going, so no further development on xmpp. so i think that's the explanation for no s2s tls.
https://productforums.google.com/forum/#!topic/hangouts/T2t1...
bluescat(probable google employee) says webRTC is the way things are going, so no further development on xmpp. so i think that's the explanation for no s2s tls.
https://productforums.google.com/forum/#!topic/hangouts/T2t1...
if you go the DIY route:
xep-0136 is regarded as an overreaching fuckup that nobody will ever get right and 313 is the heir apparent, and it's yet to be delivered.
having been through a lot of this, the issue is not the servers or the features thereof, but cross platform clients which support all the features.
main piece of advice is to settle on a webclient.
xep-0136 is regarded as an overreaching fuckup that nobody will ever get right and 313 is the heir apparent, and it's yet to be delivered.
having been through a lot of this, the issue is not the servers or the features thereof, but cross platform clients which support all the features.
main piece of advice is to settle on a webclient.
I've tried that as well... but (1) it's not a good platform for mobile and (2) it's not easy to set up for non-technical people.
I'm quite happy with chatsecure[1] on Android. It apparently even supports registering a new account (eg: via duckduckgo) -- but I only use it with chat.facebook.com for now. Used it a bit with google as well, but I don't have anyone I talk to there (or rather: I've not used, so no-one knows I'm still available via that channel...).
Not sure what you mean by "not a good platform". Compared to what?
[1] https://play.google.com/store/apps/details?id=info.guardianp...
Not sure what you mean by "not a good platform". Compared to what?
[1] https://play.google.com/store/apps/details?id=info.guardianp...
Text messaging is cross platform
It doesn't have any desktop platforms, which was a critical criteria, and it doesn't support group chat in the way we needed it.
Why not promote them here? What are the "the really good open source options"?
I think the consensus here is that TextSecure (and whatever the iOS client is called) is the Right Thing.
Personally, I'm doing a last effort to use xmpp right now (just in the process to migrate to the unreleased prosody 0.10 for some features that I require) and otherwise Telegram looks like the 'sanest' option so far.
Doesn't require a phone number as identifier
Clients for ~all~ platforms that I care about
Personally, I'm doing a last effort to use xmpp right now (just in the process to migrate to the unreleased prosody 0.10 for some features that I require) and otherwise Telegram looks like the 'sanest' option so far.
Doesn't require a phone number as identifier
Clients for ~all~ platforms that I care about
TextSecure doesn't work more than 50% of the time for me. Messages I send never get delivered, or they get delivered and replies disappear. Or they send and show up 2 days later. Or the client cannot cope with key changes and just fails to do anything whatsoever
TextSecure = no web, windows, linux, or OS X client. Automatic fail for my uses.
You can help with that if you want: https://github.com/WhisperSystems/TextSecure-Browser
What's wrong with Telegram?
Arguments as far as I'm aware (please correct me where I'm wrong):
- Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven
- End to end encryption isn't the default
- Crypto is 'home made' and - in spite of their crypto-challenges (or, as another school of thought states, related to the fact of trying to use these challenges to appear 'secure') unproven
- End to end encryption isn't the default
I'm looking at this: https://core.telegram.org/techfaq#q-why-are-you-mostly-relyi...
While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems.
So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
While there seem to be "home made" elements, these are in how they are combining well-known cryptosystems.
So there may well be flaws in how they put it together or in the implementation, it doesn't appear to be a classic case of "home made" snake oil encryption. Also, it seems to be public, not the usual "trade secret" of snake oil.
So to me a 'cryptosystem' is the way the elements are combined.
Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem.
Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either.
Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
Block ciphers are used in a selection of modes and when combined into a protocol with integrity and authentication catered for, we have a cryptosystem.
Constructing these is hard, even with well-known algorithms, and is the source of many sneaky attack vectors. The fact that they have effectively invented their own mode is suspect, and the cryptosystem as a whole is not really well-validated either.
Their "$300,000 if you break it" contest is seen as a trust-gimmick as it provides no cryptographical or mathematical guarantees, it simply shows that nobody has yet broken it for whom 300k is more important than access to the data.
You're right; that was poor wording. At the link they talk the "crypto algorithms" not cryptosystems that they combine.
That's wrong in comparison to Viber/WhatsApp/Skype or just in general?
Back in the day, one of the main arguments were that they're "rolling their own crypto", although I don't know how it stands today[0].
[0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...
[0]: https://core.telegram.org/techfaq#q-why-did-you-go-for-a-cus...
[deleted](1)
Telegram is not governed by VCs or large corporations with ambiguous ties to government. Its code is open-source. It hasn't needed to spend money to make itself popular...its users did it for them.
Which you could really say about all the services you mentioned.
The difference is in who's footing the bill for all the other costs.
The founder of Telegram is a privacy and civil liberties activist who has publicly committed to keeping Telegram as secure as possible, and that until a revenue model is determined that honors that standard, he'll continue funding it on his own (he's loaded from equity in VKontakte).
What else are you looking for?
Which you could really say about all the services you mentioned.
The difference is in who's footing the bill for all the other costs.
The founder of Telegram is a privacy and civil liberties activist who has publicly committed to keeping Telegram as secure as possible, and that until a revenue model is determined that honors that standard, he'll continue funding it on his own (he's loaded from equity in VKontakte).
What else are you looking for?
The default protocol is share everything with the server:
https://telegram.org/faq#q-how-secure-is-telegram
That is clearly prioritizing user convenience over "as secure as possible".
https://telegram.org/faq#q-how-secure-is-telegram
That is clearly prioritizing user convenience over "as secure as possible".
Without prioritising user convenience you do get the best security, mainly because you have zero users to protect
Yes, it could be better, but it's still better than whatsapp, facebook messenger and sms
(I'm a telegram user, and wouldn't be if it didn't sync across devices)
Yes, it could be better, but it's still better than whatsapp, facebook messenger and sms
(I'm a telegram user, and wouldn't be if it didn't sync across devices)
When security is important, users are far better off not using anything than they are using something that they have misunderstood to be secure.
So the share with server by default, brag about security approach is really bad, especially in the instances where the need for security is very clear.
It also seems to be the case that Telegram is not making users aware enough of the importance of verifying the keys used to establish the secret chats (see the link here https://news.ycombinator.com/item?id=9538879 , users are sharing channel keys over the channel they are trying to establish). So there is a second level of traps that a user has to avoid to even have a chance of using Telegram securely.
So the share with server by default, brag about security approach is really bad, especially in the instances where the need for security is very clear.
It also seems to be the case that Telegram is not making users aware enough of the importance of verifying the keys used to establish the secret chats (see the link here https://news.ycombinator.com/item?id=9538879 , users are sharing channel keys over the channel they are trying to establish). So there is a second level of traps that a user has to avoid to even have a chance of using Telegram securely.
Just thought I would mention that only the client is libre; the server is still closed.
[deleted]
What's the popularity of 'WhatsApp' like at the moment?
IIRC the folks at Open Whisper Systems (TextSecure, Redphone and Signal) did some work with them to integrate the TextSecure protocol into that.
So while I use TextSecure with friends who are happy to use that, I'm not upset about using WhatsApp with others as it's more mainstream and friendly, but has decent security under the hood.
IIRC the folks at Open Whisper Systems (TextSecure, Redphone and Signal) did some work with them to integrate the TextSecure protocol into that.
So while I use TextSecure with friends who are happy to use that, I'm not upset about using WhatsApp with others as it's more mainstream and friendly, but has decent security under the hood.
800 million users:
http://blogs.wsj.com/digits/2015/04/17/whatsapp-hits-800000-...
I haven't heard the final word on that. For all we know Facebook could pull the plug on the "in-development E2E encryption" in the next few months and act like nothing changed. Whatsapp has never made a public statement about it so you can't trust that it uses "decent security under the hood" right now.
When they make a public statement about rolling out E2E encryption to all of its clients and change their Privacy Policy to reflect that change (since they aren't supposed to "get your data" with E2E encryption anymore - therefore if the Privacy Policy doesn't reflect it, that means they aren't using E2E encryption) then we can at least have a reasonable expectation of them committing to it (even if in theory they could still bypass it and we would never know, because it's a closed source app, but at least if we do find out about it, we can hold them to it - right now we can't hold them to anything because they've never said anything about the E2E encryption themselves).
http://blogs.wsj.com/digits/2015/04/17/whatsapp-hits-800000-...
I haven't heard the final word on that. For all we know Facebook could pull the plug on the "in-development E2E encryption" in the next few months and act like nothing changed. Whatsapp has never made a public statement about it so you can't trust that it uses "decent security under the hood" right now.
When they make a public statement about rolling out E2E encryption to all of its clients and change their Privacy Policy to reflect that change (since they aren't supposed to "get your data" with E2E encryption anymore - therefore if the Privacy Policy doesn't reflect it, that means they aren't using E2E encryption) then we can at least have a reasonable expectation of them committing to it (even if in theory they could still bypass it and we would never know, because it's a closed source app, but at least if we do find out about it, we can hold them to it - right now we can't hold them to anything because they've never said anything about the E2E encryption themselves).
As far as I'm aware:
- Your WhatsApp messages don't use that 'security' by default (or do they?)
- That thing isn't open source and they could rip or swap out any encryption support they offer
- Your WhatsApp messages don't use that 'security' by default (or do they?)
- That thing isn't open source and they could rip or swap out any encryption support they offer
WhatsApp only uses encryption if both people are using Android and if the server approves it. There's also no way to know whether you're using it or not.
I feel that Silent Text is omitted from these lists too frequently, unfortunately, as it's one of the most secure texting apps currently on the market (I would know, I work for SC).
I feel that Silent Text is omitted from these lists too frequently, unfortunately, as it's one of the most secure texting apps currently on the market (I would know, I work for SC).
Silent Text is $10/month or so that's why there is no mass adoption.
SC's other big problem is your CEO making false or at least extremely exaggerated statements. Comes off as a sham. (I've met some of you at ClueCon and don't think it's trying to be like that, just the marketing isn't as truthful as it could be.) Encrypted PSTN calls? Please do tell how it's better than using a VPN then going to a big VoIP provider.
I think it's on by default. I could be wrong, it's worth checking now you mention it!
And I know they didn't implement it for group chats, only 1-1 so far.
And yes, you're correct, they could rip it out at any moment, in fact they could already have done so, and as a facebook subsidiary I'm not huge on the idea of trusting them.
OTOH getting the whisper systems folks in was positive and from reading what they wrote about it, it didn't seem they were just being used for a PR exercise.
And I know they didn't implement it for group chats, only 1-1 so far.
And yes, you're correct, they could rip it out at any moment, in fact they could already have done so, and as a facebook subsidiary I'm not huge on the idea of trusting them.
OTOH getting the whisper systems folks in was positive and from reading what they wrote about it, it didn't seem they were just being used for a PR exercise.
I think a lot of it is timing and momentum. I just bought an Ubuntu phone only to discover there is no whatsapp on it. I am happy to use Telegram, but convincing friends is an uphill battle.
WhatsApp was first, that's all
T: "Our security system is so secure that we'll give you a prize if you manage to break in through the front door"
HN: "But real criminals won't necessarily use the front door. What about other potential points of entry?"
T: "We won't confirm or deny the existence of any other point of entry, and to be clear, the competition is strictly about the security that our front door provides"
Is this still the case?