It's a thread about comparing Signal to Telegram of all things. In comparison to Signal as anything secure Telegram doesn't exist in any quality.

At the same time Signal doesn't have mass group chats and is not intended for that purpose.

The first link does count, it's a valid failure from Signal devs. Humans err.

The second link does not, it's an unofficial centralized aggregator, not from Signal devs, and the "hack" was a direct consequence of how it worked. It's absolutely something that no sane person would use.

With my limited knowledge of cryptography, this is how I understand it:

The distinction to make is that the user's password is not the encryption key - it only gives access to the key. So even if the user has the same password on a new device, there would be no way to decrypt the data without the original key.

In order to maintain full privacy, data has to be encrypted on device before sending it through any server (whether to another participant in a chat, or for backup). This means that the encryption key has to be on device.

If that key was copied over to a location not controlled by the user (e.g. Telegram server), then that location would have access to the key and can decrypt any data encrypted by that key. In the same vein, if a user loses their phone then that encryption key must be lost, so encrypted data cannot be decrypted on a new phone.

Which means that the only way that Telegram can provide the chats on a new phone (when the user has no access to the old phone) is if they have access to the encryption key and can provide it to the new phone.

you can’t truly use Signal’s new “username” feature. If any of the recipients have your number stored in their phonebook, irrespective of whether you know them or not, the username goes for a toss.

Hm. I haven't interacted with a new Signal user in a while... but I do see in settings two knobs: "who can see my phone number" and "who can find me with my phone number". Both of these settings can be set to "nobody".

I'm guessing if I set "who can find me with my phone number" to "nobody", then even if someone has my phone number in their contacts, they wouldn't know I'm a Signal user?

Because it’s not p2p.

It doesn't matter how private and secure the messaging app is if the OS / keyboard / some random Google slopware with notifications access / physical device is compromised.

But for 99% of people, Signal, Telegram or even WhatsApp is good enough.

From my experience with that: Telegram restored all unecrypted chats when I swapped phones without asking me for any passwort / key. I literally just confirmed my phone number and all my chats / groups / contacts appeared.

Especially after Telegtam started working with authorities and handing out user / chat info.

Matrix results in way more meta data and through federation those meta data could be stored jn way more places.

Besides their main developer (element messenger) are cop / military boot lickers.

Those are some examples for why you might not use it, but depending on you use case you might still prefer it over signal.

Idk about that. Signal is the main alternative to WA in some parts of europe.

I'm sorry your free messaging app isn't perfect. /s

And I always assumed that nicknames was just as much to prevent screenshots from becoming a liability.

It’s a thread about comparing Signal to Telegram of all things

The relevance is that it’s not some unaligned security professional talking in the article, it’s literally the guy that runs Signal having a pop at his competition.

it’s literally the guy that runs Signal having a pop at his competition.

The right kind of pop, saying only the obvious and nothing more.

and in the US, as ab example, the gov is actively targeting citizens and noncitizens without the required warrants.

so yeah. assume the worst and prepare accordingly.

Well, that something common in Russia as a metaphor is also common in Estonia wouldn't be a surprise, but in English seems a bit less common. Anyway, that wasn't the point of my comment.

What are you talking about?

I literally installed Signal on my Linux laptop yesterday and it automatically downloaded all my messages from my phone.

Telegram has approximately 1 billion global users. Signal only has around 100 million. Telegram is about 10x the size of Signal.

We have to choose our threat level. Signal is great when you don't want to expose your data to companies mining it for their profit. It is not so great when you are a person of interest, and need absolute privacy.

The metadata is worthless and pricy to use it for an awarage joe.

The thing is that there's nothing special about Signal that makes it better than alternatives like SimpleX. I just don't see why it should be promoted instead of them. Yes, it's better than WhatsApp where meta has a master key and can read your messages, but why settle when you can use a platform without compromises?

Last time I did that, it would only sync new messages

Moxie might not be right on every issue and might even be a part-time fed but his bona fides are impeccable

Dude is an OG from WAY back, used to frequent EFnet in the 90s and was already "elite" then.

I'm on dat Molly

Simple: I already migrated most of my friends over Signal. I did not know better alternatives at the time. While I agree with you, not about SimpleX I dont have enough info about it, but about that there are better solutions.

Yeah, that's fair. If you're already stuck on Signal, then it's difficult to make a move to something else. I'm mostly talking about people who are using something like WhatsApp, and it's better to make a fresh move to a platform that doesn't have the issues Signal has.

pretty much yeah.

Hmm maybe not whatsapp or telegram though. One of them is spyware and the other one is spyware and supports one of the (if not the) most evil tech companies in the world.

I assume you still had access to your old phone and could approve the transfer from it. If not, then your phone number is your password, which is even worse, in my opinion (it's basically public information).

Just...
Don't let them deceive you;

If you must use deceitful software like Gmail, Whatsapp, Discord, office or whatever, just try your best not to leak your personal data on them, and if you can hinder the tracking, do so.

If you can use other (preferably FOSS) software, do so, there's plenty of solutions out there and most of them are free, and sometimes selfhost-able.

Google, Meta, Microsoft or whatever corp can lie about security or privacy all they want, but in the end, they only fool themself thinking their monetary practices aren't obvious and they can fool everyone, trust is a hard thing to earn and they can't earn it with fraud.

The product mostly show itself, and you have to go around it to know what's it's deal, if you prefer to not do so, you can search if any security researcher or analyst did investigate the product;
For example Google claims Chrome browser is "safe" and "secure" dispute them giving so much trackable APIs for websites, and having a horrable default permissions, and don't forget the "Manifest V3" transition just to remove ads (and trackers) blockers like uBlock Origin.
You don't need solid proof to know what is what.

And then you just type " Foss Chrome Alternatives" or "Private Browsers" on a search engine like DDG where you can find many articles to help you find one (like this) and you'd be done.

Forget about ""Others"" right now, your well-being matters the most.

I got a one time password via SMS to confirm I am the one with access to this phone number.

Its not about being complicated, its about dumping the whole chat history with just a few seconds of physical acceas to the device.

LEA has used this method with messangers like Whatsapp for years to quicly exfiltrade the data from a victims phone to other software.

There's a pin. Just require the pin.

The Pin is not designed and used for such an authentication. Also can be changed at any time:

How do I manage or change my PIN?

On your phone, go to Signal Settings > Account > Change your PIN

It's been documented to have been in use in English in the 16th century

I think it's just so old that it's more or less ubiquitous