Despite the claims that #Telegram never shares any data or metadata, there are relatively clear cases of them having shared metadata with an Indian court and German law enforcement.

There are strong indications, as reported by Wired, they might have shared message contents with the Russian government, targeting activists in Russia.

By default, Telegram chats do not use end-to-end encrypted mode aka "Secret Chats". End-to-end encryption is also completely unavailable for groups and channels.
🔗🔝

@waldschnecke it's important for Ukraine and people in danger because people choose to use it. We should guide them to safer alternatives instead, Telegram is putting people in harm's way.

I write about the encryption and why it is bad.

One of the main points is that Telegram is misleading people about it.

Secret Chats are unwieldy and limited, and have to be turned on explicitly for each contact separately – and thus almost nobody uses them.

But Telegram pretends everything is encrypted.

@waldschnecke

> By that standard they should get to other CEO's too.

Other CEOs of what kind of services?

Facebook, Instagram, Twitter? Yeah, probably there is some responsibility to consider for unencrypted social networks.

Signal? WhatsApp? Absolutely not, these are end-to-end encrypted internet messaging services, and the service providers have no access or control over the contents of conversations.

Telegram is a social network that pretends to be an encrypted IM.

Yeah, it is weird how articles about Telegram in mainstream press try to paint it as some kind of trusted privacy service.

Has Telegram PR department been briefing press in this way?

@m @waldschnecke

> In Signal and Whatsapp you have the problem that your Phone number is known to anyone in a group chat

Not in Signal anymore. They finally solved it:
signal.org/blog/phone-number-p…

Keep your phone number private with Signal usernames

Signal’s mission and sole focus is private communication. For years, Signal has kept your messages private, your profile information (like your name and profile photo) private, your contacts private, and your groups private – among much else.

^{Signal Messenger}

@m

I've been playing around with Snikket as a potential way to get more people trying XMPP. Have you any views on it?

For what it's worth, the default Snikket app has OMEMO on by default, voice/video calls and voice messages, plus image/document/location attachments, but it doesn't have stickers or GIF pickers.

@Orca @m

Yeah, I saw that, but it didn't say what happens if a centralised service like Signal sells out. The owner of Signal is the guy who sold Whatsapp to Facebook, so this is a totally plausible scenario because it has happened on his previous messenger services.

The whole point of decentralisation is that if a server turns to crap you can switch to another server without losing your contacts. There's no way to do this on Signal, you're just stuck there even if the service removes its privacy protections.

@ArcaneAlchemist it's not "some blog", Soatok is a solid security researcher. Ignore his insight at your own peril.

Also, did you really just argue that surely a certain solution is perfectly fine because nation states use it? Really?

Because that would make Microsoft Teams by far the best communication solution in the world.

@m

@ArcaneAlchemist I am not arguing that "devs and auditors are all incompetent", please kindly refrain from putting words in my mouth.

People miss things all the time. The fact that A Large Organization or State is using a given tool does not necessarily mean they audited it. And even if they have, it doesn't mean there are no security issues.

I linked to a specific piece of information on specific security issues found by a good security researcher. Do what you will with that info. 🤷‍♀️

@m

also #Telegram - like @signalapp - demand and collect #PII like #PhoneNumbers which ain't possible to acquire anonymoisly in more and more juristictions.

• Plus, both are #centralized, #SingleVendor & #SingleProvider solutions that don't allow for #SelfCustody of all the keys nor #SelfHosting and thus violate #KerckhoffsPrinciple, meaning they are inherently #insecure.

Using #XMPP+#OMEMO by contrast is secure and adding @torproject / #Tor to tunnel it makes it even more anonymous.

• So don't expect any messenger to cover your 6, but instead go out of your way so that even when held at gunpoint, they can't decrypt comms!

Cnsider every #Messenger that doesn't #decentralize and support #Tor oit of tue box to be insecure!

thaddeus e. grugq on Twitter

“I’m gonna tell you a secret about “logless VPNs” — they don’t exist. Noone is going to risk jail for your $5/mo https://t.co/Q2aOQJkG4g”

^Twitter

@kkarhan it's worse than HTTPS, MTProto broadcasts cleartext a device identifier.

@simonboggis

@simonboggis AFAIK #Durov got arrested because #Germany #MLAT'ed #France for #NetzDG violations and he refused to integrate #Govware #Backdoors in compliance with French Law, which is rather a case if #incompetence by #LEA|s than actual #security.

• The only "#encryption" that #Telegram has is using #HTTPS - that's it!