A lot of privacy guides suggest avoiding Telegram. I understand that in its default mode there’s no E2EE (and no E2EE for groups at all). If people I know don’t wanttko use Signal, isn’t Telegram the lesser evil given it’s nicer privacy policy (than other popular ones)?
Say I use the FOSS version of it.
Despite you using the foss client of telegram there is no source for the server, signal has published it’s code.
What keeps me from using Telegram is the server side is closed source; they have been known to work with governments; and been willing to censor content. There are enough better options that I have zero use for them.
Probably another point is that the encryption for Matrix/Element has undergone multiple audits, one in 2016 and another one of their newer rust library. Whereas telegram just has not. There was this also a not too long ago. MTProto is also used nowhere else, whereas a lot of encryption has been influenced by the Double Ratchet which is well understood.
The other thing worth noting is that Matrix is the foundation for other products which many governments use for secure communications.
Depends on your goals.
For casual shit like sending files to yourself, bullshiting with memes, or stuff like that, the unknown factor of telegram doesn’t matter.
But it is an unknown. We don’t know what their server code looks like. So you can’t trust that it isn’t doing things other than what it is supposed to.
It’s a matter of preferences tbh.
We don’t know what anyones server code looks like. The code that is published may not be the one they are actually running.
In fact Signal stopped publishing server side code a few years back, and only resumed after the community got angry: https://www.androidpolice.com/2021/04/06/it-looks-like-signal-isnt-as-open-source-as-you-thought-it-was-anymore/
I don’t think that they published it as a response to the angry users. We wern’t that loud and signal had a reason to do so. That was when they worked on the cryptocurrency and the spam protection. In signals case it dosn’t matter much if the server is compromised since the important part happens on the client side. The server can only forward encrypted salad or not deliver a message. Or log the meta data of the messages. E2e will always be there, despite the server being compromised.
What bothered me was that Signal fanbase was trashing Telegram for not publishing the server source, while Signal was doing this.
Telegram straight up lies about sharing data with governments: https://restoreprivacy.com/telegram-sharing-user-data/
This. Our fucking government can instruct Telegram to ban any channel or user they don’t like.
Banning channels is not the same as sharing private data
If not the latter, how the former? Messages is and should be private data as well.
??? Channels are literally public by definition and viewable even without an account. That’s the whole point of channels. They’re more like blogs than messages.
