Telegram founder and CEO alledges signal has backdoors, they don't provide reproduceible builds, etc.

Here’s what he said in a post on his telegram channel:

🤫 A story shared by Jack Dorsey, the founder of Twitter, uncovered that the current leaders of Signal, an allegedly “secure” messaging app, are activists used by the US state department for regime change abroad 🥷

🥸 The US government spent $3M to build Signal’s encryption, and today the exact same encryption is implemented in WhatsApp, Facebook Messenger, Google Messages and even Skype. It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕‍🦺

🕵️‍♂️ An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media. But whenever somebody raises doubt about their encryption, Signal’s typical response is “we are open source so anyone can verify that everything is all right”. That, however, is a trick 🤡

🕵️‍♂️ Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones. Signal refused to add reproducible builds for iOS, closing a GitHub request from the community. And WhatsApp doesn’t even publish the code of its apps, so all their talk about “privacy” is an even more obvious circus trick 💤

🛡 Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github. For the past ten years, Telegram Secret Chats have remained the only popular method of communication that is verifiably private 💪

Original post: t.me/durov/274

eating3645,

Lol telegram calling signal insecure is too funny.

rollerbang,

Isn’t it that Telegram doesn’t claim to be super secure, apart from possibly their encryption on mobile?

This doesn’t prevent them from uncovering other possible plots in supposedly secure platforms.

possiblylinux127,

True but in this case there credibility is low

jws_shadotak,

Why all the emojis? Why can’t people just write an article?

clot27,
@clot27@lemm.ee avatar

he is maybe flexing the “custom emojis” feature of telegram, see original post

athairmor,

It’s like a memetic form of neoteny, “the retention of juvenile traits into adulthood.”

I’m waiting for the day when a politician responds to a motion on the floor with “bruh.”

snek_boi,

It seems like you’re passionate about emojis

sneakyninjapants,

Telegram’s server side software is closed source, owned and ran by them exclusively so they really have no room to talk. WhatsApp doesn’t even have OSS clients so they’re even worse in that regard

eager_eagle, (edited )
@eager_eagle@lemmy.world avatar

exactly, they (Telegram) don’t need to put sketchy code in the clients when most messages are not E2E encrypted and they control the servers lol

rottingleaf,

Still the code in telegram desktop client may not be sketchy, but is ugly as fuck, so that too should be considered.

itsnotits,

and run* by them

lemmyreader,

This comes a few days after Jack Dorsey confirmed that he had left the board of Bluesky and then starting to use Tw(X)tter and calling Tw(X)tter “freedom technology”. Coincidence ?

homesweethomeMrL,

Why does it say Telegram, but it’s about the Twitter/Bluesky guy?

Actually, nevermind. It’s just confusing.

LiveLM,

???
Is this guy stupid or what, current day Twitter could not be further than “Freedom technology”.
You can barely even see Tweets while logged out for fucks sake

lemmyreader,

theguardian.com/…/jack-dorsey-quits-bluesky-board…

Earlier on Saturday, he unfollowed all but three accounts on X: Edward Snowden, Stella Assange, the wife of the WikiLeaks founder Julian, and Musk.

“Don’t depend on corporations to grant you rights,” Dorsey tweeted. “Defend them yourself using freedom technology. (you’re on one).”

Despite his promotion of alternatives to the site he founded, Dorsey has publicly shared his admiration for Musk. In 2022, he called the multibillionaire the “singular solution I trust” for the future of Twitter, though a year later he criticised Musk for his “fairly reckless” moves after taking control of the site.

swooosh, (edited )

You can verify builds on android. That’s just an iphone problem.

Use Grapheneos if you need good security and privacy

DaseinPickle,

Maybe he should focus on adding e2e encryption to the default chats and group chats instead of spreading FUD.

Sneptaur,
@Sneptaur@pawb.social avatar

This is also just a few days after Durov published Nazi dogwhistles in the latest Telegram update blog post.

plush.city/

Zoop,

Dammit… Thank you for sharing this.

clot27,
@clot27@lemm.ee avatar

mostly because he got interviewed by tucker carlson, he said he has also given interview to a liberal reporter so as to show he is neutral and everyone has right to free speech

Sneptaur,
@Sneptaur@pawb.social avatar

Where’s the interview with the liberal reporter, lol?

ReversalHatchery,

Haven’t seen it published in his channel either

NoLifeGaming,

One is open source and you can check the code while the other is not completely open source and uses proprietary encryption. That’s right, proprietary encryption.

rivvvver, (edited )
@rivvvver@lemmy.dbzer0.com avatar

arent telegram chats unencrypted by default?

An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media

source?? (i bet this ends up being a “they had full access to my unlocked phone” situation again)

also the whole thing abt US funded encryption is the same bullshit argument ppl use against Tor all the time. it doesnt mean shit.

this just reads like someone desperately trying to get more market share by spreading FUD

penquin,
@penquin@lemmy.kde.social avatar

“an alarming number of important people” is the source. That’s more than enough, right?

jabathekek,
@jabathekek@sopuli.xyz avatar

read: “all my rich white friends”

DaseinPickle,

“One rich dude I met once at a dinner party. Totally legit. “

Ilandar,

“Who work for Telegram”

rivvvver,
@rivvvver@lemmy.dbzer0.com avatar

im gonna assume ur joking. its hard to tell sarcasm on the internet.

obviously i would like an actual source like at least one of those “important” ppl talking abt what happened to them

penquin,
@penquin@lemmy.kde.social avatar

😂. Of course I’m joking. That claim is bullshit. Hey I know a guy who sold a bridge, and he’s wealthy now. Source: trust me, he told me.

possiblylinux127,

"Signal is insecure"

  • Putin probably
rdri,

arent telegram chats unencrypted by default?

Encryption is always there. Problem is, some people refer to anything “not e2e encrypted” as “unencrypted” for some reason.

fushuan,

And it infuriates me to no end. It’s one thing to trust them and their servers and it’s another thing altogether to send actual plaintext data around the net, that’s crazy and it’s what people are implying.

For the record, until WhatsApp implemented e2e their messages were indeed fucking plaintext, and it took a while before they were pressured into e2e. It helps for them that their platform is very mobile based vs telegram, where the service is more server based. Telegram did have enough time to implement a server based e2e 0 knowledge encryption protocol though, it’s not really rocket science at this point.

rdri,

Telegram did have enough time to implement a server based e2e 0 knowledge encryption protocol though, it’s not really rocket science at this point.

What do you mean by server based e2e? From what I get, most people’s complain is that Telegram doesn’t support e2e in group chats, and that is what seems to be close to rocket science in my opinion. Also Telegram is historically filled with ever growing group chats, which means quite serious implications for server requirements from what I understand.

fushuan,

Tegram stores all the conversation in their servers, since you don’t need to be connected in the phone or have the phone witchednon if you want to chat in the pc, or in another phone. This means that the authority is the server. WhatsApp it’s not like that, if you delete a shared photo after a while it will be cached out and you will lost access to it, meaning that they don’t store that stuff. The same thing happens with WhatsApp desktop or web, they stay in an infinite loading icon until you twitch on the phone or sometimes even unlock it.

This means that whatever telegram develops must not only keep the group chat encrypted in the server, but any valid client of a user must be able to decipher the content, so every client must somehow have the key to unlock the content. One way of doing it would be for every client of a single user to generate keys (which I’m sure they already do) and reform a key exchange between them, to share that way a single shared key, which is what identifies your account. Then toy could use that shared key to decipher the group chat shared key which telegram can store on their server or do whatever is done in those cases, I’m not that well versed.

The problem here lies in what happens when you delete and/or logout of all the accounts, currently you can login into the server again, because telegram has all the info required, but if they store the “shared key” then it’s all moot, I guess they could store a user identifying key pair, with the private key encrypted with a password, so that it can be accessed from wherever. They should as always offer MFA and passkey alternatives to be able to identify as yourself every time you want to log into a new client, without requiring the password and so on.

This is some roughly designed idea I just had that should theoretically work, but I’m sure that there’s more elegant ways to go about this.

It’s work for sure to implement all of this in a secure way, provided that you have to somehow merge everything that already exists into the new encryption model, make everyone create a password and yada yada while making sure that it’s as seamless as possible for users. However, I feel like it’s been quite a while and that if they did not do it already, theybjist won’t, we either trust them with our data or search for an alternative, and sadly there’s no alternative that has all the fuzz right now.

rdri,

Sorry I have a hard time understanding the gist of your text. I don’t think it’s viable to be upset about what happens with access that was already acquired previously because that very fact already poses a bigger threat (which might have more to do with the nature of conversations vs how the platform works).

fushuan, (edited )

I wasn’t talking about situations with compromised accounts, I was talking about legitimate accounts that were created in a typical way being converted to a zero knowledge encryption method, I was aknowledging that it’s hard doing that conversion when a user might have several clients logged on (2 phones, 6 computers…).

My point was that if they have not put any motivation in the transition, they never will because the bigger the userbase, the harder for them to manage the transition. Also, I find that sad because they should have invested more effort in that instead of all the features we are getting, but whatever.

If you found the technical terms confusing, public/private keys are some sort of asymmetric “passwords” used in cryptography that secure messages, and shared keys would be symmetrical passwords. The theory between key exchanges and all around those protocols are taught in introductory courses to cryptography in bachelors and masters, and I’m sorry to say that I don’t have the energy to explain more but feel free to read about the terms if you feel like it.

If you however found it confusing because I write like crap, I’m sorry for potentially offending you with the above paragraph and I’ll blame my phone keyboard about it :)

rdri, (edited )

No that’s not what I didn’t understand. The problem itself as you described it seems either a non-issue or something very few people (who’s already using telegram for some time) would care about. I don’t understand the scenario that would pose a problem for the user. The moment some account legitimately gains access to some chat is probably what should trouble you instead.

VeganCheesecake,

spiegel.de/…/telegram-gibt-nutzerdaten-an-das-bun…

Well, Telegram seems to be giving user data to the German Federal Criminal Police Office, and if they’re cooperating with the German authorities, I don’t see why I’d presume they aren’t cooperating with others as well.

All this is actually documented, compared to those nebulous “important people”.

UnfortunateShort,

Tbf, they held a user vote in Germany (supposedly, although the app did ask me to vote) whether to work with them or risk to cease services. Iirc the backgrounds were extremist (terrorist?) groups operating on the platform

electric_nan,

Looks like a push to discredit Signal right now. While I know Signal isn’t perfect, I do like it and I haven’t seen anything that is better (on the whole). The 3rd “emoji-point” is quite an accusation, and I would love to see any evidence of this kind of thing, that didn’t result from the cops unlocking a defendants phone, or having infiltrated a chat.

CaptainSpaceman,

The 3rd emoji is just bs. Then again, most of his post is bs

possiblylinux127,

Tin hat time:

I wonder if Russia’s trying to get everyone on Telegram because they have control over it.

electric_nan,

This is probably just Telegram seeing an opportunity to peel some users away from Signal during a period of heightened paranoia in the West (anti-genocide organizing).

noodlejetski,

mastodon.social/

DaseinPickle,

Maybe not Russia, but they sure are working with a certain government:

mastodon.social/

MajorHavoc, (edited )

While I know Signal isn’t perfect, I do like it and I haven’t seen anything that is better (on the whole).

Agreed. But it is worth mentioning that XMPP with OMEMO seems to be the current gold standard - runs almost everywhere, tons of available (free) servers, secure end to end messages, and fully auditable public source code.

refalo,

That may be true, but wake me up when they capture 0.5% of the messaging app market :)

electric_nan,

I have used xmpp a lot, but I can’t really recommend it to friends and family as a secure messenger. There are too many compatibility issues between clients and servers. If your friend is on a client or server that doesn’t support the same encryption protocols, then you can’t have a secure chat. Basically there is too much user knowledge and effort required at this time, for xmpp to be a good, secure, general use chat. I very much look forward to this changing. I also really like Matrix, but it is still a bit rough around the edges as of my last check.

MajorHavoc,

Agreed on all points. It’s not the best solution when I can’t get both parties into it successfully.

That’s why I still use Signal a good bit.

SLfgb,

I use xmpp all the time. Biggest hurdle for certain fam/friends using xmpp has been certain android builds (samsung) and ios interfering with timely notifications. User knowlege is not a problem as I can recommend the apps that are compatible encryption protocols with mine.

electric_nan,

That’s great, and I’m happy it’s working out for you. It’s still kind of a bummer that this open protocol ends up fragmented across all those clients and severs. I’ve met other Linux enthusiasts online, connected with them via xmpp only to find we can’t encrypt our chats. Neither of us wants to give up our preferred client for various reasons, so we have a non-working situation.

SLfgb,

Hmm, I see. But isn’t there an obvious solution to this? One of you just run two different clients side-by-side?

electric_nan,

Sure there are workarounds, but every one of them erases a bit of convenience or is at odds with the benefits of federation. Again, I think XMPP is great, but I wish it was better. As it is now, it doesn’t fully meet my needs better than Signal does.

SLfgb,

Yea, I hear you. I use both.

SLfgb,

Well if only those samsung & ios users that never get my messages until I see them and tell them to open their app had phones that didn’t interfere with it running in the background / push notifications it would be working out for me even better, but that’s not an issue with the protocol or client but with OS’s being hostile to xmpp.

toastal,

client or server that doesn’t support the same encryption protocols

Outside of TLS which most any server uses by default, XMPP or not, the server is not responsible for E2EE. Conversations Compliance & Are We OMEMO Yet have existed for a long while & I never see anyone recommending a client not on these lists so while certain features may be fragmented, the communication essentials have been more or less established for years now. XMPP is an extensible format, and some applications that aren’t for chatting with your friends/family, don’t need many of these features which allows the protocol to morph into something stripped down for the task… which is why the base spec is basically barren, & community XEPs are what folks get behind for adding new features for different use cases.

drwho,
@drwho@beehaw.org avatar

Points 0 and 1: None of this is new. This goes back to 2011 or 2012.

Point 2: If someone gets hold of your phone and unlocks it (meaning, they can interact with it), they have access to your Signal messages on-board. This is why additional security measures (not using biometrics, encrypting your phone natively) are recommended. If your phone is off and someone dumps the data from it, they get encrypted data.

jmanes, (edited )
@jmanes@lemmy.world avatar

I logged into Telegram today to this update from Durov. It reads like a bunch of hogwash from someone who is hiding something. They are eyeing investor funding soon, right? (EDIT: eyeing an IPO techopedia.com/…/telegram-eyes-ipo-as-it-aims-to-…) A lot of things seem to be coinciding with him slinging mud about his competitors.

eager_eagle, (edited )
@eager_eagle@lemmy.world avatar

Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github.

Not true. Signal has a very similar client verification process to Telegram’s, described here. The lack of an iOS reproducible build is an Apple limitation / nuisance.

It’s very complicated, the 2nd jailbroken device is necessary because there’s no other way to download the .ipa, but even if you manage to do that and bit-for-bit reproduce the .ipa you downloaded from source, there’s no way to know if the App Store is sending every user the same .ipa or if your other, non-jailbroken iPhone downloaded a backdoored one.

Telegram docs even acknowledge these limitations.

Ultimately, this client verification is not the selling point Telegram’s founder makes it sound like, since most messages are not E2EE and the server code is closed.

shrugal, (edited )

It’s hard to overstate what a nothing-burger this article really is! Let me break it down:

  • Signal got $3 million from the Open Technology Fund at some point in its development
  • Some anonymous source alleges that the OTF’s ultimate goal is to promote US foreign interests
  • The current chairman of the board Katherine Maher worked at the National Democratic Institute and Wikipedia before
  • The same anonymous source says she was recruited because of connections to the OTF
  • She has at some point voiced the opinion that a completely free internet without regulation just reproduces existing power structures, and that balancing regulation and 1st amendment rights is a tough problem
  • Signal doesn’t have reproducible builds on iOS (it absolutely does on Android btw)
  • Some people feel like Signal chats come up more often than they should in court cases and media reports

That’s it, that’s the whole story. That’s the reason why the Telegram guy of all people thinks you should be careful, and better use his chat service instead, and the Twitter guy agrees.

I mean, reproducible builds on iOS would be nice, but that platform has much bigger problems from a privacy/security/sovereignty/freedom standpoint anyway. And the rest is just nothing turned up to 11.

eager_eagle,
@eager_eagle@lemmy.world avatar

tl;dr “Signal might be untrustworthy because the tech came from a State-sponsored project and the current chairman acknowledges that Wikipedia has a white and Western bias.”

just wait until they find out pretty much all tech we have can be traced back to government-funded research.

9488fcea02a9,

Did you know the early early internet researchers were part of a clandestine government organization known as ARPANET??? The entire TCP/IP stack is just a state-sponsored backdoor into your life!!!

WAKE UP SHEEPLE!!!

refalo, (edited )

yea just wait until they find out why the first digital computer was made:

ENIAC was designed by John Mauchly and J. Presper Eckert to calculate artillery firing tables for the United States Army’s Ballistic Research Laboratory (which later became a part of the Army Research Laboratory). However, its first program was a study of the feasibility of the thermonuclear weapon.

Coasting0942,

Getting “Tor is pentagon spyware” vibes from OP

eveninghere,

I guess it’s the usual Russian propaganda tactic throughout Telegram. Mixing conspiracy theories with half-truths.

The NSA indeed distributed a defected encryption library in the past. These days I’m pretty sure big techs use open source encryption to avoid this trap.

And Telegram says blah, blah, iPhone is exploited. But IF Telegram is correct on this one, Andriod versions would be defect as well.

Sims,

I feel hustled, bc I recommended Signal to others :-( However, ANY contact with the US elite is a clear sign of the NSA/CIA/NED propaganda/spying network. I think It is safest for everyone, to voluntarily adopt the Russian, Chinese, Iranian, etc blocklist/firewall of western big-tech propaganda and spy methods, and seek out trustworthy open source. Oc Lemmy/federation as well as any other point of contact with the commoners are valid targets for these guy’s, but a minimum of defense like that seems to be the only way to keep the US Capitalist elite out of our lives.

Anyway, bye bye Signal. Gnu? Alternative ?

rivvvver,
@rivvvver@lemmy.dbzer0.com avatar

please get some more opinions on this, try to understand the arguments here better, before making up ur mind and believing the founder and CEO of a competing platform that u should switch away from their competitors

kixik,

Jami is the GNU alternative, if you’re wondering

dukethorion,
@dukethorion@lemmy.world avatar

I read something on the internet, so it must be true!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • privacy@lemmy.ml
  • DreamBathrooms
  • ngwrru68w68
  • modclub
  • magazineikmin
  • thenastyranch
  • rosin
  • khanakhh
  • InstantRegret
  • Youngstown
  • slotface
  • Durango
  • kavyap
  • mdbf
  • GTA5RPClips
  • JUstTest
  • tacticalgear
  • normalnudes
  • tester
  • osvaldo12
  • everett
  • cubers
  • ethstaker
  • anitta
  • provamag3
  • Leos
  • cisconetworking
  • megavids
  • lostlight
  • All magazines
    •