Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I found it interesting to read that their approach is supposedly to split encryption keys across jurisdictions. It sounds like they believe that they should therefore not be able to be compelled to reveal any plaintext because the keys are not in the jurisdiction asking for data, but as far as I can tell this is obviously rubbish, because a computer is not subject to the law, an individual is, and in this case an individual with the power to comply who is seemingly deciding not to.

What's weird is that there aren't really technical blockers to E2E encryption anymore (maybe different 10+ years ago), and with such a weak alternative, you'd expect Telegram to want to switch. The fact they haven't for so long, and have essentially doubled down on their flawed approach suggests that there's a reason we're not privy to as to why they don't want to move to E2E encryption. I'd hope not, and I don't want to throw around conspiracy theories, but when a decision doesn't make sense that's usually due to missing information, and I do wonder what we're missing.



> that there aren't really technical blockers to E2E encryption anymore

There are several disadvantages, and Telegram would lose its key features:

1. Cloud Sync

2. Instant Multi-device login

3. The ability to create large group chats, like thousands or hundreds of thousands of people in a single place.

4. Sending files up to 4GB.


Yes and no.

[1] Signal is working to support an encrypted "cloud backup feature" (some hints on this are on their code base), as per "sync" that's already done in the forward direction by Signal (by sending all new messages to all your devices) I'm sure you could provide some sort of backward sync as well. [3] Signal already supports groups up to 1000 people iirc, I'm sure a read-only channel larger than that could also be doable. [4] I'm not sure why that would not be possible.

I'm not sure exactly what [2] refers too but nevertheless I have some doubts that would cause a blocker.

I used Signal as an example since it's a well known encrypted messenger; although I must acknowledge it's not really a Telegram competitor and vice versa (one is a secure messenger and the other is a social media app).

That said, (proper) E2E encryption makes everything harder to do - again, you can take Signal as example and their development speed. But, I'd argue, is not impossible


> Signal already supports groups up to 1000 people iirc,

Which is where the practicality fails. This is why Telegram is the only app that works in large protests, unlike Signal.

Time and again, Telegram proves that the lack of E2EE actually becomes its strength, as proven by the protestors in Myanmar, Hong Kong, Iran and more countries: https://x.com/Pinboard/status/1474096410383421452

I'm not really against E2EE, but many of us fail to see how E2EE can hurt the usability of the app sometimes, and in cases where it is needed the most too.

Many Telegram groups have thousands of people, which is impossible to do on Signal at the moment. WhatsApp copied Telegram's features, large groups with topics and channels too!

> I'm not sure exactly what [2] refers too but nevertheless I have some doubts that would cause a blocker

1 and 2 are related. You can quickly login on Telegram and have your chats sync instantly, instead of waiting for manual backups or devices to sync. The devices run independently.

> But, I'd argue, is not impossible

I too don't think it's impossible. It's just computationally expensive and comes with limitations for now.

Durov does not want to use the Signal protocol either because he's been approached by the US agencies multiple times to include certain algorithms or libraries inside Telegram, not to mention that Signal itself is funded by the government.

Matrix could be better but it leaks tons of data, has been hacked multiple times in the past too.


What baffles me is why people use a centralised messenger to organise a protest? and the one that is hosted in another country.

And what do you imply 'funded by the government' means for Signal? It's a nonprofit org, app has e2e encryption and clients are open-source. How is it worse than an app owned by an LLC in UAE, with no e2e encryption by default, unknown funding sources and no information about what's going on on the server?


> What baffles me is why people use a centralised messenger to organise a protest?

Because it works and because real world is not theoretical.

> And what do you imply 'funded by the government' means for Signal?

I'm not implying anything. I just listed the reasons why Durov doesn't trust state funded american encryption systems.

> unknown funding sources

What do you mean unknown? They're pretty known.

> no information about what's going on on the server

All server side code is unverifiable. In fact, Signal itself was running a totally different codebase than what it made public, for a whole year.


> What do you mean unknown? They're pretty known.

I mean, you don't believe the fairy tale that he actually paid for everything himself?


> Matrix could be better but it leaks tons of data

Unless you use your server or a trusted one.

> has been hacked multiple times in the past too

Any links? Looks like it was long ago.


suspect the author is referring to https://matrix.org/blog/2019/04/11/we-have-discovered-and-ad... and also missed the point that the breach didn’t compromise any e2ee data, because of e2ee.


> 1. Cloud Sync

Cloud Sync of what? WhatsApp doesn't seem any less "cloud synced" than Telegram to me.

> 2. Instant Multi-device login

What does that mean?

> 3. The ability to create large group chats, like thousands or hundreds of thousands of people in a single place.

MLS scales very well to such large groups: https://datatracker.ietf.org/doc/rfc9420/

> 4. Sending files up to 4GB.

How so? WhatsApp, Signal, iMessage and others all support sending files. File size isn't a factor (assuming you're fine with leaking the metadata of who has received the same file).


Usually it's a power or money profit motive. Just think what tasty things some large corporation or government could do with that data. They could sell ads! Or hold dissidents hostage. All sorts of things.


Or train LLMs...


Several of the charges were about using unlicensed cryptographic tools; I am sure full E2E encryption would make those charges heavier.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: