this post was submitted on 13 Sep 2024
61 points (89.6% liked)

Privacy

32173 readers
500 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

Hi :) I know that Telegram is not save and not a good messenger if you are a privacy-geek. Sadly some parts of my family still think so. I brougth up the arguments, that they are cooperating with Russia, that they or closed-source on the server-side and that e2ee is not on by default and only available for 1-on-1 chats.

My question now is, if you gals and guys might have some other arguments or sources I could use.

I don't want to convince anyone to switch away from Telegram (because I am no missionary :D) I just want people to understand the risks of using Telegram.

top 39 comments
sorted by: hot top controversial new old
[–] [email protected] 27 points 3 months ago (1 children)

Can we be real for a minute though?

It's still better than not having it as an option.

By telegram existing, it diversifies the non private messaging landscape. It's obviously not better than actually secure and/or private services, but the more options that are out there, the less centralization there is, which is a net positive.

You just have to be aware of its limitations and don't use it for anything significant. In that regard it's no worse than something like discord.

You already covered the warnings about not trusting it for privacy or security, so that's really the beat you can do in informing people. Once you've done your due diligence for the people you care about, you gotta let them do what they're gonna do. It's either that or go hard and refuse to communicate on anything other than the services you deem best for your preferences and hope for the best

[–] andylicious1337 1 points 3 months ago

you are correct and it is true that it is better to have many options. Although it is a little iffy that still many people belive in the fact, that it is private and secure.

Also I totally agree on what you are saying: dont push people into something they dont want simply explain the possible downsides and move on.

I'd still wouldn' t use it so communicating with me is will still not be done via Telegramm :D

[–] [email protected] 26 points 3 months ago (2 children)

WIRE or Signal. Granted, convincing your people to move with you is like trying to get an act of Congress in play.

[–] [email protected] 21 points 3 months ago (2 children)

people download apps for all kinds of bullshit.
but messaging? nah...

[–] [email protected] 6 points 3 months ago

They download apps for all kinds of bullshit because all their friends and people they follow are on there. They won’t install a messaging app if none of the people they interact with are there. It’s not specific to messaging. I was able to convince my immediate family to move to Signal just for our family group chats. It’s not much but it’s a start.

[–] [email protected] 2 points 3 months ago

Couldn't even get a friend to swap to whatsapp from facebook messenger. I collect messaging apps like pokemon it seems

[–] andylicious1337 1 points 3 months ago

sad but very true 🙈

[–] [email protected] 11 points 3 months ago* (last edited 3 months ago) (3 children)

Is it true that Telegram doesn't encrypt group chats at all? Maybe that would get their attention?

My biggest criticism of Telegram (but not the only one) is that they use homebrew crypto. Of course, I don't know if your family would understand why that's bad.

[–] ByteMe 10 points 3 months ago (1 children)

It's true. I'm also really annoyed with rising telegram premium stuff. It used to be just a nifty addon, now it's everywhere.

[–] andylicious1337 2 points 3 months ago (2 children)

what exactly do you mean by "telegram premium stuff"?

[–] [email protected] 4 points 3 months ago

Basically more perks which honestly is just more useless bloatware imo.

[–] ByteMe 2 points 3 months ago

Gift someone premium, do this and do that with premium, now there are some ads too etc

[–] [email protected] 3 points 3 months ago

Their crypto is still AES it's just the stuff around it that's home brewed... And even then telegram has been around 10+ years now with no known breaches via the encryption.

That argument was a lot stronger years ago.

[–] andylicious1337 2 points 3 months ago

oh yeah that is a good point (well tge encryption-part and the one with the group-chats). they will not understand why this is bad but that should be easy yo explain (i guess :D ).

[–] [email protected] 10 points 3 months ago (1 children)

e2ee chats are super annoying. They don't sync between desktop and mobile, so almost nobody will use them,

Even if I insist they do and create a secret chat, they'll message me back in an unencrypted chat because they changed to their other device.

This isn't an issue on Wire and Matrix

[–] andylicious1337 1 points 3 months ago

another great point. thank you

[–] [email protected] 7 points 3 months ago* (last edited 3 months ago)

There are Ukrainian and Russian ties... AFAIK it's used heavily on both sides of the conflict. The founder had some commentary as to why the stance they've taken is the stance they've taken.

https://t.me/durov/266

His mother is also from Ukraine herself:

https://t.me/durov/272

... and Pavel is a French / UAE citizen (as additionally demonstrated by the French government holding him for questioning). The "Telegram is a Russian puppet" arguments are fairly weak.

[–] [email protected] 5 points 3 months ago (2 children)

People always going on about signal, but it still requires phone number, but never hear talk of threema, threema is reasonably solid choice for privacy.

[–] andylicious1337 4 points 3 months ago* (last edited 3 months ago) (1 children)

hm I dont really agree on this. it is a swiss service (i think) but it is all closed source so that is a red-flag for me (if talking about privacy or transparency).

[–] [email protected] 2 points 3 months ago (1 children)

Yeah good point, the closed source def is not ideal. Hmm back to signal as best option??

[–] andylicious1337 2 points 3 months ago

well I'd say signal is one of the best options as there are many others. Regarding the phonenumber: as far as I know, it is stored hashed so signal does not really know your phonenumber. so this would not concern me.

[–] [email protected] 1 points 3 months ago

I'm always advocating for Signal, but I'm worried for the time their billionaire-backing eventually runs out.

[–] [email protected] 5 points 3 months ago (1 children)

A solid privacy conscious youtuber, The Hated One, just published a video on this exact topic. It's very detail oriented and should be easy for anyone to follow along. Here's the link: https://youtube.com/watch?v=A8ZXDiQLH9I

[–] andylicious1337 1 points 3 months ago

awesome, thanks for the link, I will have a look 👍

[–] kitnaht 5 points 3 months ago* (last edited 3 months ago) (3 children)

How about: Signal is better? Though, they recently were caught with some unencrypted shit on the desktop client.

[–] [email protected] 7 points 3 months ago (2 children)

Sauce? I tried searching and couldn’t find anything (at least not on the first page of results). Thanks.

[–] [email protected] 16 points 3 months ago

i think they mean that signal on desktop does not encrypt their content at rest, which is acknowledged and not an issue they are intending on addressing.

But it seems to have recently changed? I'm learning thus as I wanted to find a source.

Source: https://candid.technology/signal-encryption-key-flaw-desktop-app-fixed/

[–] Zak 8 points 3 months ago (1 children)

Lemmy thread and link.

Basically, anyone who can read your home directory could decrypt your Signal database. That's about typical of traditional desktop applications, but questionable for security-oriented software. Mac OS and (sometimes) Linux have more robust credential management options, and Signal signaled (yes, pun intended) its intent to adopt them.

[–] [email protected] 15 points 3 months ago (1 children)

I feel that if someone can read your home directory, signal isn’t your worst worry. However, it’s still an issue and I’m glad they’re going to move to better security.

[–] Zak 3 points 3 months ago

I'm inclined to agree, and said so in the linked thread.

[–] [email protected] 5 points 3 months ago

Caught? It was like kinda obvious. You could always locate your Signal folder where everything is downloaded and just see all pictures...

I ignored this flaw as I kept my PC Luks encrypted, but a friend on Windows might not, where everyone with physical access could read everything.

So, yeah. I also dislike the idea that its not encrypted in some sort of way.

[–] [email protected] 4 points 3 months ago (1 children)

The messages in the desktop client aren't encrypted. However, someone would need access to your machine to get them

[–] [email protected] 2 points 3 months ago (1 children)

Also, if the data were encrypted, the encryption key would have been on the Computer anyway, but yes it could have been better protected.

[–] [email protected] 1 points 3 months ago

Technically they could require a password. However, people would forget it

[–] [email protected] 4 points 3 months ago

It's a great idea for the Right! They're too stupid to notice that group chats are not encrypted and they conspire to commit crimes right out in the open. Don't take that away from us!

[–] [email protected] 3 points 3 months ago* (last edited 3 months ago)

Telegram is the best social network. Not so much a private messenger.

As for risks... http://kremlingram.org/ has the Russian ties well-documented, even if theystretch the evidence at times, the latest border cross leaks are proofs enough

[–] ffflorian 3 points 3 months ago

Quite simple: Telegram is not end-to-end encrypted by default, that means that they can read all your chats if they want to.

Better switch to Signal.

[–] [email protected] 0 points 3 months ago (1 children)

Telegram is not just IM. Open the search and search for channels. Get creative, they have keyword filters. City name is always a good start. Check the channels with ❄️ and 🍄 emojis. This is where people are scammed for drugs. Maybe sometimes not scams.

A lot happens on Telegram, and it's right behind that little search icon.

[–] andylicious1337 0 points 3 months ago

reading my post would've help ;)