this post was submitted on 25 Aug 2024
132 points (96.5% liked)
Privacy
31876 readers
1 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I mean really, we don't need an entire article to explain how encryption works on Telegram.
Chats by default aren't fully e2e. Your key must be kept on the server(s) to enable instant sync with other devices
There is a full e2e chat, you can enable this at any time. But, it doesn't do groups, it's only between 2 parties, and it doesn't sync across devices.
Telegram's encryption isn't open source, so no one can verify it's soundness or risks.
None of this is new info, it's been talked about for 2 years now.
Are there any programs that can do e2e in a group chat? My limited knowledge of e2e and encryption makes me think that'd be extremely difficult and even clunkier
Messages app by Apple. Not extremely difficult, but has its trade offs, and easier when all devices share a CA.
CA?
Certificate Authority
Doesn't the concept of using a CA (which are generally also central authorities) go against the idea of E2EE that only required to (or more) endpoints or am I missing something? Signal group messages (and the protocol/concept behind it) work without a CA. I think I'm missing something, can you connect the dots for me?
The CA is purely a way to provide validation that the endpoints being connected are who they say they are; the actual signing certificates are still private. Apple uses a central directory; Signal depends on certificates linked to one way hashes of phone numbers.