Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

While I'm not a fan of Telegram's security model, I have to say that their dedication to create an awesome product is admirable.

EDIT: Just to be clear given the title, I'm not pro DRM, and we can be pro or against auto-removable content, but I just love how they implement features that their users are asking for and the quality of their apps.



I am amazed how high quality telegram's client apps are. Both on desktop (native), android, and even the web versions are feature full, native, blazing FAST. As I said once, telegram is not the best chat app I have to use, but the best... App altogether on my laptop/phone, I have to use :-)

The UX is slicker and more comfortable to use than that of whatsapp (and miles ahead signal). With the latest update if I got it correctly, even E2E encrypted chats can be synced to all clients (? Needs to be verified)

I guess you mean the security model of non-E2E chats. Although you can read into it that they can do MITM, the details reveal that the actual keys/messages are shared into datacenters in multiple countries so no government alone can retrieve plaintext from at-rest storage. To me (especially compared to anything Facebook products) is already much better than nothing. If it's an issue for you, opt in for E2E chats and enjoy!

Sometimes I have to use whatsapp with some contacts and it feels like a huge step back after telegram, especially in UX.


I'm a happy Telegram user as well! That being said:

> I guess you mean the security model of non-E2E chats. Although you can read into it that they can do MITM, the details reveal that the actual keys/messages are shared into datacenters in multiple countries so no government alone can retrieve plaintext from at-rest storage. To me (especially compared to anything Facebook products) is already much better than nothing. If it's an issue for you, opt in for E2E chats and enjoy!

It's unfortunately not that easy. For one, their promises of sharded keys is something we as users cannot verify, so we still just need to trust them here [0]. WhatsApp, on the other hand, at least attempts to have E2E. Secret chats are an option, but only the mobile clients support them [1] and you can't have them for groups at all. There's also some critique on mtproto, their roll-your-own encryption. I don't necessarily agree, but it's another strange point.

Like you I like the UX a lot and I have some trust in Durovs motivations, but the security model is questionable.

[0] They refuse to open source their servers, but I follow their argumentation in so far as that this would not help since we could not verify that the published source code is the one running on the servers.

[1] At least the official Linux desktop client and the web clients don't.


I think Telegram for macOS (not to be confused with Telegram Desktop, which also supports macOS) supports secret chats, and on Windows you can use a third party client called Unigram. But it would be nice to have official support for it in Telegram Desktop as well.


> but only the mobile clients support them [1]

I think my Mac Mini now allows me to create secret chats. I didn't test it but I am fairly certain I saw it less than a week ago.

I just checked on my Windows laptop and that does not allow it. My Linux machines are upstairs but I think we can trust your observation.


For [1], I saw in the yesterday update that the web version also can sync secret chats.

I don't have my laptop with me (for another month), so I have to check this, but based on the redesigned devices dialog, I can imagine that this is now solved.


It's much faster than Discord, especially on mobile. Sometimes I get notifications from Discord, then when I open the app, it takes a few seconds to create a connection and show the message. With Telegram it's just there


> Sometimes I get notifications from Discord, then when I open the app, it takes a few seconds to create a connection and show the message.

The exact same thing also happens on Telegram for me all the time, and I have a gigabit connection. The push notification arrives on my phone instantly, but when I open the app it loads for like 15 seconds before showing everything.


One thing I can't stand is that it's the only messaging app out there without a presence monitor. As soon as I receive a message all of my clients will start pinging.

It's the reason why I avoid it. I talk to someone on the desktop client, yet my phone, work laptop and tablet will ring on every message.

I can't be assed to go and mute 3 other devices every time I decide to talk to someone.


> I talk to someone on the desktop client, yet my phone, work laptop and tablet will ring on every message.

ime the desktop will pickup the message a few seconds before any of the mobile clients does and mark it as read, hence surpressing any notifications on the latter.

ofc chat notifications don't make any sounds on my systems to begin with.


That would be a nice feature, but for me it's not absolutely essential because my phone is nearly always on Do Not Disturb (I only let calls, SMS/iMessage and Viber through, but I still see other notifications when I pick up my phone), and even on my laptop I disabled the notification sound and just left the popup/badge on.


In my experience on macOS (swift) app, this does indeed detect presence - only if I ignore it for an (albeit short), few seconds will it ping my phone I think.


Neither the macOS swift app, nor Unigram on Windows does this in my experience.


Hmmm does my version have a presence monitor? I don't remember being bothered by this (using it on Linux desktop, android phone and android tablet)


it does have a presence monitor, but I believe it isn't uniform between the various platforms and it is quite fickle when it works (as soon as you close the window it marks you as totally offline)

on Android at least you can set telegram to limit the frequency of notifications (eg "at most 3 every 5 minutes") it is not perfect but it is an improvement


I agree. They do a great job. I like the drag and drop of images, depending how you drop it compresses or not the image.


I also don't understand its security model, at this point also speaking about automatic message deletion it seems to me they have been over-optimizing something. XMPP messengers have encryption, can even support forward secrecy and don't keep messages among other features. Since Smartphones are anyway not the most secure platform, it makes little sense to provide a completely sealed off messenger on top of that.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: