Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Some might argue whatsapp or signal or Telegram E2E is exactly that. I talk about the email.

These three are not equivalent.

Signal is the gold standard for secure, end-to-end encrypted messaging. The client is open-source, and (at least on Android) builds are reproducible. It's possible to audit the code and confirm that Signal isn't intercepting the messages via side-channel and sending them to Signal's servers, encrypted with a different key. It also notifies you whenever a users's public key has changed (ie, when they switch to a different phone), which protects against someone hijacking your phone number using the telecom system.

WhatsApp does encrypt messages with per-user keys, but it's not end-to-end in the sense that Facebook still manages the keys and could provide you with a compromised key. Facebook also produces the only client, which means that it could easily eavesdrop messages and send them to Facebook's servers via a side-channel. Until recently, WhatsApp also didn't notify you when a user's key had changed. This wasn't a "backdoor" as the Guardian sensationally reported it, but it is a security liability for users looking for secure end-to-end encryption.

Telegram is completely insecure. For starters, group messages on Telegram are sent... in plain text. No encryption whatsoever.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: