Despite the claims that #Telegram never shares any data or metadata, there are relatively clear cases of them having shared metadata with an Indian court and German law enforcement.

There are strong indications, as reported by Wired, they might have shared message contents with the Russian government, targeting activists in Russia.

By default, Telegram chats do not use end-to-end encrypted mode aka "Secret Chats". End-to-end encryption is also completely unavailable for groups and channels.
🔗🔝

@waldschnecke it's important for Ukraine and people in danger because people choose to use it. We should guide them to safer alternatives instead, Telegram is putting people in harm's way.

I write about the encryption and why it is bad.

One of the main points is that Telegram is misleading people about it.

Secret Chats are unwieldy and limited, and have to be turned on explicitly for each contact separately – and thus almost nobody uses them.

But Telegram pretends everything is encrypted.

@waldschnecke

> By that standard they should get to other CEO's too.

Other CEOs of what kind of services?

Facebook, Instagram, Twitter? Yeah, probably there is some responsibility to consider for unencrypted social networks.

Signal? WhatsApp? Absolutely not, these are end-to-end encrypted internet messaging services, and the service providers have no access or control over the contents of conversations.

Telegram is a social network that pretends to be an encrypted IM.

Yeah, it is weird how articles about Telegram in mainstream press try to paint it as some kind of trusted privacy service.

Has Telegram PR department been briefing press in this way?

@m @waldschnecke

> In Signal and Whatsapp you have the problem that your Phone number is known to anyone in a group chat

Not in Signal anymore. They finally solved it:
signal.org/blog/phone-number-p…

@m

I've been playing around with Snikket as a potential way to get more people trying XMPP. Have you any views on it?

For what it's worth, the default Snikket app has OMEMO on by default, voice/video calls and voice messages, plus image/document/location attachments, but it doesn't have stickers or GIF pickers.

@Orca @m

Yeah, I saw that, but it didn't say what happens if a centralised service like Signal sells out. The owner of Signal is the guy who sold Whatsapp to Facebook, so this is a totally plausible scenario because it has happened on his previous messenger services.

The whole point of decentralisation is that if a server turns to crap you can switch to another server without losing your contacts. There's no way to do this on Signal, you're just stuck there even if the service removes its privacy protections.

@ArcaneAlchemist it's not "some blog", Soatok is a solid security researcher. Ignore his insight at your own peril.

Also, did you really just argue that surely a certain solution is perfectly fine because nation states use it? Really?

Because that would make Microsoft Teams by far the best communication solution in the world.

@m

@ArcaneAlchemist I am not arguing that "devs and auditors are all incompetent", please kindly refrain from putting words in my mouth.

People miss things all the time. The fact that A Large Organization or State is using a given tool does not necessarily mean they audited it. And even if they have, it doesn't mean there are no security issues.

I linked to a specific piece of information on specific security issues found by a good security researcher. Do what you will with that info. 🤷‍♀️

@m

@kkarhan I consider a service that actively, relentlessly misrepresents its security and encryption stance way worse and more harmful than a service that does not.

@signalapp @torproject

@kkarhan it's worse than HTTPS, MTProto broadcasts cleartext a device identifier.

@simonboggis