If you want your data to end up managed by the US you can use WhatsApp, if you want it to end up in Russia you can use Telegram. They are very similar in features, but I'm not a fan of Telegram storing all the conversation in their server.
Do you believe that whatsapp is not storing your messages now ? They said they are not doing it to begin with but there are good reasons that they might be doing this. Fb and whatsapp have shared enough information to be fined by an EU court this week for 100 million euros. Although 've to agree that data with US is better than Russia.
Regarding "fined by the EU". They obviously transferred WhatsApp data to Facebook and vice versa.
But I don't think that they necessarily store all of your WhatsApp messages somewhere in the cloud. Otherwise they could provide a similar easy, device independent solution like Telegram - instead of using the smartphone as a general pipe for all of the messages. So yeah...maybe they do and maybe they just don't want to tell us - but for now I am pretty confident that they would provide their user base with some kind of storing back end advantages.
They are ignorant to the point that I simply can't understand. Durov is in 'fuck you and die sooner' relation with russian goverment, but people still claim that Telegram is under their control. Right now we are at risk of losing Telegram if he will not provide server location info to FSB in few weeks, and it seems Durov is ready to lose russian market completely to protect it from these guys.
I actually trust whatsapp way less, simply because it has NO problems with russian special forces, which became very high-tech last years. This alone is a big red flag today.
>Right now we are at risk of losing Telegram if he will not provide server location info to FSB in few weeks, and it seems Durov is ready to lose russian market completely to protect it from these guys
Honest comment. As a neutral (UK), it's a tough call as to which country I'd prefer in this scenario.
In terms of data, I imagine the US to be just as bad if not much worse (my prejudice) than Russia.
Someone can school me on this if I'm wrong but I prefer Telegram as a platform and I'm ambivalent as to which country my data ends up in (given this choice).
(Editing this comment based on above: "Small correction.
With Telegram your data ends up in Germany.
They are Berlin based and against the current Russian government")
Thanks for the link, I don't doubt that. But I meant specifically on the point of data-handling. Some Russian hackers or spooks vs American hackers and the NSA, etc
The UK sucks just as bad. The current PM has just announced plans to regulate the web if they win the next election.
That was more of a theoretical issue. And while some have named it a backdoor, the consensus among infosec experts (which I'm not) seems to be that it was a defensible and even sensible tradeoff of usability vs privacy (for the intended audience). If you want more privacy and less usability, use Signal.
Telegram and Russia are not connected. Any quick look at the history of the app and Durov the founder will tell you that vs whatever bias you most likely hold.
You feel more secure is not a good point. This needs to be technical of what kind of encryption feature is used, and not trust on "pappers" of the software creator, or try to feel safe just by using your "spider senses" while using the software.
And remember: You liking or not, WhatsApp is a Facebook developed software.
RING is the only real secure chat software, with DHT, peer-to-peer discovery and encryption.
https://ring.cx/
For security and privacy, neighter is a good option. If you compare Telegram and Riot, Telegram wins hands down from a UX point of view. Riot is seriously lacking in this department, but it offers true end to end encryption with multiple devices by default, so if that matters to you, that is the best choice.
> Riot is seriously lacking in this department, but it offers true end to end encryption with multiple devices by default, so if that matters to you, that is the best choice.
It all comes down to the author's personal preferences and concerns, but a blanket assertion that WhatsApp is not a good option from a security option is silly. WhatsApp is end-to-end encrypted with the Signal protocol by default, so the security of its message contents is top-notch.
But if the author is especially concerned about collection of metadata they should consider Signal itself, which also has a very well thought-out UX.
I've been using Telegram daily for 1-2 years now, I like them both but (1) I think Telegram's UX is superior, and (2) I get why WhatsApp's desktop app works the way it does [i.e. tunnel stuff through your phone], but I don't like using it.
That's true. But once registered you can use Telegram on any device. That's not true for WhatsApp: they have app only for iPhone and you can't run it on iPad even in compatibility mode.
Not really. What I missed most in Telegram was "delivered to device" status. While they claim such information wouldn't tell which of the recipient's devices received the message, I see it more as laziness on their side. They could have aimed for "delivered to any/one device" or "delivered to the default device". I personally care about whether a message was delivered (and the recipient would eventually look at their phone) or the server is down, recipient doesn't have a data connection etc. and I can try different communication methods. A "read" status is nice but the people I usually talk to tend to reply anyway.
In terms of message storage (ignoring government requests here), Telegram servers need to store them so that they can be provided to different clients/devices. For WhatsApp, OTOH, there are primary communication devices (phones) with end-to-end encryption and secondary clients that connect to the primary device to access the messages (rather than getting them from WhatsApp's servers). End-to-end encryption is available on Telegram as well but AFAIK you lose the ability to use secondary clients.
But...they do have a delivered status. I think it's "delivered to the servers" (probably doesn't work in "secret chats"), but it fulfils the same goal. Edit: It does work in secret chat as well
And yes, Telegram has an option (a default state actually) to store the messages on their servers, WhatsApp doesn't have that. Beyond "E2E should be on by default", I don't see how this point is for WhatsApp.
"delivered to server" is different from "delivered to device". Let's say my friend is abroad with no roaming, I have no idea whether a message was delivered to him/her or not. WhatsApp has both.
As I wrote, I think (I might be wrong though) that if you enable E2E encryption on Telegram you can no longer use additional/desktop client.
Telegram and Whatsapp are pretty interchangeable on feature set TBH. The support for bots in Telegram is nice, but Whatsapp currently has more user share - which is crucial.
Another interchangeable from user experience is Signal. I'm seeing more growth in Signal, which is great - and I trust it more than Telegram and Whatsapp combined.
I kind of lost my trust for Signal when moxie said it was not OK[1] that a fully free and open source fork of their client (built to remove the Google Play Services depency back then) was using their servers.
I've read the discussion and I find moxie's arguments pretty weak in this matter.
As the github user mimi89999 pointed, moxie wouldn't have to support LibreSignal directly, it behaves like a normal Signal client and there would probably be no impact in his servers at all because there was a very limited number of LibreSignal users.
Ah! But what if the non-official client causes a DoS of the server....
... then write server software that isn't vulnerable.
I have to agree... mandating what client software is used is a bit disappointing from moxie... I thought the world learned this lesson from Pidgin etc.
Next he'll say he only wants to support Chrome for their website.
Far from perfect in absolute security sense. That sense is not common afaik. Personally, I'm fine with that no one can read my texts, not that no one can actively make focused changes to my conversations or send fake messages from my device to decipher all previous conversations while I sleep. Non-terrorist people just want their messages mass-unreadable by automated inspection systems. Full protection against active high-tech investigations (i.e. special forces watching special you) is not on high social demand.
To my mind Telegram is a nice example of how to do things right. It's fast (in all senses), it's reliable and generally pleasant to use. It can be secure if you want it to :)
Not that WhatsApp is slow or not reliable. I can't formulate it but still I do like Telegram more. All the above is just my overall impression.
-------------
Speaking of security I'd like to admit that I'm not a terrorist or a serial killer so maybe I'm a bit out of this problem. I agree that it's generally bad to spy on regular citizens but at the same time it's obviously even worse to have negotiations regarding terroristic acts or other ways to commit a crime.
Personally I'm almost O.K. with government spying on me unless it tries to sell me goods and services =)
Or tries to put words you don't even remember into context, or new administration chases you for your older ideas and puts you on a list. Good for you living in centuries-stable country.
> I agree that it's generally bad to spy on regular citizens but at the same time it's obviously even worse to have negotiations regarding terroristic acts or other ways to commit a crime.
Telegram rolls their own non-standard crypto protocol as I understand it.
This is a bit of a no-no when it comes to security.
More importantly; chat's arent' end-to-end encrypted by default (I can't find a way to enable it in the web-app), which means the telegram-whatsapp comparison makes no sense. Whatsapp is secure, telegram is not.
Also; end-to-end encrypted chats in telegram (they call them "secret chats") won't follow you between devices. A secret chat started on one device, won't be accessible from another. This makes them far less useful, and dissuades users from using them.
Again; comparing whatsapp to telegram in terms of security is apples vs oranges.
Define "better". If all your friends use one, then that is probably better for you. There is also functionality differences between the two (mentioned by others), which might force your hand.
That said, there are other quantifiable measures. In terms of security, Telegram has two main drawbacks:
1) it supports insecure chats - which means that for many (especially non-technical) users, they won't use the end-to-end encrypted messaging at all
2) whilst the encryption algorithms they use are standardised, the protocol they uses to transfer the messages is not well understood by the cryptographic community - and when it has been analysed, well-known flaws have been found [1].
In comparison, WhatsApp also makes use of standardised encryption algorithms, but also uses the Signal protocol - which has been studied by multiple groups, with better outcomes (such as [2]). One drawback to WhatsApp is they will generally make security decisions that are primarily based around avoiding sacrificing usability - if that is a problem, then perhaps Signal[3] or Wire[4] is a better choice.
On the encryption debate, using Russian algorithms vs US (Belgian) algorithms is somewhat academic - I believe that both are considered by the wider academic community to be strong when correctly used. I don't believe there is any evidence that Telegram or WhatsApp are incorrectly using them (beyond the attack found against Telegram, which may have been fixed by now?). This is the mostly the same for considerations about data storage location - if end-to-end encryption is enabled in Telegram, they are roughly equivalent.
137 comments
[ 3.1 ms ] story [ 189 ms ] threadWith Telegram your data ends up in Germany.
They are Berlin based and against the current Russian government AFAIK.
I actually trust whatsapp way less, simply because it has NO problems with russian special forces, which became very high-tech last years. This alone is a big red flag today.
Do you have a source for this?
As for goverment intentions, I have no direct link, but those who simply ignored their demands were blocked. We wait and see what happens.
In terms of data, I imagine the US to be just as bad if not much worse (my prejudice) than Russia.
Someone can school me on this if I'm wrong but I prefer Telegram as a platform and I'm ambivalent as to which country my data ends up in (given this choice).
(Editing this comment based on above: "Small correction. With Telegram your data ends up in Germany. They are Berlin based and against the current Russian government")
For example, please see https://freedomhouse.org
The UK sucks just as bad. The current PM has just announced plans to regulate the web if they win the next election.
Please don't be so naive as to equate the UK and USA with Putin's Russia.
But given the light and dark elements to data operations within many countries, I'd imagine you might be the one possibly being naive.
I agree with you to a certain extent but, please, this is a broken "proof".
I use both of them consistently.
Telegram is full of nice features and their desktop client is well done.
Whatsapp doesn't have as many features but I feel far more secure and private in there.
And remember: You liking or not, WhatsApp is a Facebook developed software.
RING is the only real secure chat software, with DHT, peer-to-peer discovery and encryption. https://ring.cx/
I know that Whatsapp encrypts everything on the device so that's a really good start.
But I have no clue what security holes, backdoors, etc are in neither of them and we are leaving in dangerous times.
So basically the only thing I really trust is GPG-encoded emails which noone uses.
What about Wire?
https://github.com/wireapp
https://medium.com/@wireapp/open-sourcing-wire-server-code-e...
https://medium.com/@wireapp
But if the author is especially concerned about collection of metadata they should consider Signal itself, which also has a very well thought-out UX.
meanwhile whatsapp have this: https://www.whatsapp.com/faq/en/android/28000012
BTW that's not the main reason why I use Telegram for several years as my primary messenger.
In terms of message storage (ignoring government requests here), Telegram servers need to store them so that they can be provided to different clients/devices. For WhatsApp, OTOH, there are primary communication devices (phones) with end-to-end encryption and secondary clients that connect to the primary device to access the messages (rather than getting them from WhatsApp's servers). End-to-end encryption is available on Telegram as well but AFAIK you lose the ability to use secondary clients.
And yes, Telegram has an option (a default state actually) to store the messages on their servers, WhatsApp doesn't have that. Beyond "E2E should be on by default", I don't see how this point is for WhatsApp.
As I wrote, I think (I might be wrong though) that if you enable E2E encryption on Telegram you can no longer use additional/desktop client.
Another interchangeable from user experience is Signal. I'm seeing more growth in Signal, which is great - and I trust it more than Telegram and Whatsapp combined.
I've read the discussion and I find moxie's arguments pretty weak in this matter.
[1] https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
EDIT: spacing
... then write server software that isn't vulnerable.
I have to agree... mandating what client software is used is a bit disappointing from moxie... I thought the world learned this lesson from Pidgin etc.
Next he'll say he only wants to support Chrome for their website.
http://www.cryptofails.com/post/70546720222/telegrams-crypta...
Why not use, say, Ricochet? Or any other secure messenger (https://prism-break.org/en/all/#instant-messaging)
To my mind Telegram is a nice example of how to do things right. It's fast (in all senses), it's reliable and generally pleasant to use. It can be secure if you want it to :)
Not that WhatsApp is slow or not reliable. I can't formulate it but still I do like Telegram more. All the above is just my overall impression.
-------------
Speaking of security I'd like to admit that I'm not a terrorist or a serial killer so maybe I'm a bit out of this problem. I agree that it's generally bad to spy on regular citizens but at the same time it's obviously even worse to have negotiations regarding terroristic acts or other ways to commit a crime.
Personally I'm almost O.K. with government spying on me unless it tries to sell me goods and services =)
I'm not sure I would call that "obvious".
That said, there are other quantifiable measures. In terms of security, Telegram has two main drawbacks:
1) it supports insecure chats - which means that for many (especially non-technical) users, they won't use the end-to-end encrypted messaging at all
2) whilst the encryption algorithms they use are standardised, the protocol they uses to transfer the messages is not well understood by the cryptographic community - and when it has been analysed, well-known flaws have been found [1].
In comparison, WhatsApp also makes use of standardised encryption algorithms, but also uses the Signal protocol - which has been studied by multiple groups, with better outcomes (such as [2]). One drawback to WhatsApp is they will generally make security decisions that are primarily based around avoiding sacrificing usability - if that is a problem, then perhaps Signal[3] or Wire[4] is a better choice.
On the encryption debate, using Russian algorithms vs US (Belgian) algorithms is somewhat academic - I believe that both are considered by the wider academic community to be strong when correctly used. I don't believe there is any evidence that Telegram or WhatsApp are incorrectly using them (beyond the attack found against Telegram, which may have been fixed by now?). This is the mostly the same for considerations about data storage location - if end-to-end encryption is enabled in Telegram, they are roughly equivalent.
[1] https://eprint.iacr.org/2015/1177.pdf
[2] https://eprint.iacr.org/2016/1013.pdf
[3] https://whispersystems.org/
[4] https://app.wire.com/