Reached for comment, a spokesperson for Telegram disputed that data is stored in plain text on the company’s servers, saying “everything stored in Telegram’s cloud is securely encrypted.” The spokesperson also said, “This kind of FUD is not surprising, coming from a minor competitor (and typical for this one). That said, we can confirm that we have neither developers, nor [servers] in Russia and we don’t see any of the mentioned risks.”
Okay, so, the spokesman said, a. No Telegram developers are in Russia, and b. There are no Telegram servers in Russia. Pretty straightforward, right?
…Except that’s not what Marlinspike said at all. What they actually said was,
Every msg, photo, video, doc sent/received for the past 10 yrs; all contacts, group memberships, etc are all available to anyone w/ access to that DB
Many TG employees have family in Russia. If Russia doesn’t want to bother w/ hacking, they can leverage family safety for access.
The Telegram spokesperson didn’t actually address any of the claims made by Marlinspike. They didn’t even talk about having a database that stored messages, and then strawmanned the arguments about how Russia could gain access to said database. It’s not the FSB knocking on a developer’s door demanding access to the database, it’s the FSB calling a developer and letting them know that their uncle is in custody, and something bad might happen if they aren’t given the access they’re asking for.
Seriously, don’t use Telegram for anything that needs to be secure.
More Ukrainians should also look into the Matrix protocol as it is end to end encrypted, the service is decentralized and the company that is behind the protocol is based on the UK.
The app element is good app to get started.
Ukraine could have multiple matrix servers for everyone to use.
5 for civilians. 8 for military branches and 3 for government.
polish MoD has siloed matrix instance that they use for their own communications, with their own client. it’s e2ee but not for classified information
Damn that’s great inspiration!
Is there a reason for it not being e2ee for classified information?
maybe they feel it’s not safe enough. client is called DSI Merkury 2.0 if you want to look it up more closely
e: lol it’s just element clone, they even left original theme in the same shape. it has forced 2FA and as governmental app could be tied to governmental qualified electronic signature infrastructure (every citizen can get one for free) but not sure about it
behold this pixellated screencap:
It’s not a good direct alternative to Telegram as it’s decentralized and is not based on phone numbers.
It can work as addition to Signal, but it’s not a good alternative.
Tied numbers make it easier for Russians to track you down.
[…] the most secure messaging app in the world, Signal.
That’s a very bold claim the author of the article makes.
I’m not aware of any messenger that is more secure. In fact, almost every other encrypted messenger uses the same algorithm.
It might not by the most anonymous messenger (as there is Session and Threema for example that don’t require a phone number) but it’s probably the most secure.
Signal no longer requires a phone number either.
It does. You can share your username with others. But for registering it still requires one and your account is still linked to one.
Well, that’s true but it barely affects anonymity.
All that can be determined from that is that the number in question has a signal account, and how recently the account has checked for messages. It doesn’t tie messages or contacts to the number. (Any more)
deleted by creator
Actually, it does not. Signal cannot build social graphs based on communications. This is one of many unique inventions that Signal implemented and what makes Signal so great.
Well even then it’s not the most secure but one of the most secure, no?
Here is where I gave up reading lol
WhatsApp does use that same Signal protocol for its messages but that’s very poor writing considering all the tracked metadata arguably makes it just as insecure as Telegram.
Ownership by Facebook renders WhatsApp inherently untrustworthy.
deleted by creator
Or possibly a user’s phone who was a party to the Whatsapp conversation was collected as evidence and unlocked by the user.
deleted by creator
I might be missing the point, but isn’t this a decently dumbed-down description of the difference between services that are end-to-end encrypted and those that are not?
Are you saying that is wrong?
‘Truly secure’ and ‘whatsapp’ don’t belong in the same sentence, I don’t know what else to say but that it is laughable.
Ah, gotcha. I thought your gripe was with the encrypted vs end to end encrypted bit.
Reached for comment, a spokesperson for Telegram disputed that data is stored in plain text on the company’s servers, saying “everything stored in Telegram’s cloud is securely encrypted.” The spokesperson also said, “This kind of FUD is not surprising, coming from a minor competitor (and typical for this one). That said, we can confirm that we have neither developers, nor [servers] in Russia and we don’t see any of the mentioned risks.”
Haven’t Telegram been throwing shade for a while at competitors?
People in glass houses should not be throwing stones…
they said the same about matrix
Could you please offer a source for that claim?
i don’t have it on hand, but dessalines had some receipts about it (“Why not Signal” piece)
I will look in that direction.
notice that dessalines covers a very specific threat model and signal would still be an improvement over, say, whatsapp
