Here’s what he said in a post on his telegram channel:

🤫 A story shared by Jack Dorsey, the founder of Twitter, uncovered that the current leaders of Signal, an allegedly “secure” messaging app, are activists used by the US state department for regime change abroad 🥷

🥸 The US government spent $3M to build Signal’s encryption, and today the exact same encryption is implemented in WhatsApp, Facebook Messenger, Google Messages and even Skype. It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕‍🦺

🕵️‍♂️ An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media. But whenever somebody raises doubt about their encryption, Signal’s typical response is “we are open source so anyone can verify that everything is all right”. That, however, is a trick 🤡

🕵️‍♂️ Unlike Telegram, Signal doesn’t allow researchers to make sure that their GitHub code is the same code that is used in the Signal app run on users’ iPhones. Signal refused to add reproducible builds for iOS, closing a GitHub request from the community. And WhatsApp doesn’t even publish the code of its apps, so all their talk about “privacy” is an even more obvious circus trick 💤

🛡 Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github. For the past ten years, Telegram Secret Chats have remained the only popular method of communication that is verifiably private 💪

Original post: https://t.me/durov/274

  • @swooosh@lemmy.world
    link
    fedilink
    0
    edit-2
    1 year ago

    You can verify builds on android. That’s just an iphone problem.

    Use Grapheneos if you need good security and privacy

  • @dolle@feddit.dk
    link
    fedilink
    01 year ago

    Yes, sorry, but I can’t take something seriously if every paragraph begins and ends with an emoji. I know it’s dismissive, but all my Facebook lunatic conspiracy theory alarm bells are blaring.

    • @rottingleaf@lemmy.zip
      link
      fedilink
      01 year ago

      It’s more normal in Russian-speaking Web.

      Shouldn’t trust this guy anyway, it’s VK’s founder talking.

  • firefly
    link
    fedilink
    01 year ago

    Telegram: We keep you private. Now enter your phone number to sign up.

        • @SLfgb@feddit.nl
          link
          fedilink
          0
          edit-2
          1 year ago

          You still need a phone number to register an account as far as I could tell when I did the other day. You no longer need to share your number with any contacts and can set it so noone who has your number can look you up on signal. You can optionally set a unique alphanumeric ‘username’ instead to hand to people to look you up. But yea, Signal still requires you to give them and their authenticatian service (through sms code) your phone number.

            • @SLfgb@feddit.nl
              link
              fedilink
              01 year ago

              Yes, XMPP, a long-standing protocol that’s also not a walled garden, doesn’t require a phone number or even a phone. For android I use the Conversations client combined with Dino on computers. Currently logged in to a handful of devices synchronously. You can choose what server to make an account on; conversations.im I found to be reliable. Drawback is Signal doesn’t let you bridge to it from anywhere outside of Signal. So I have accounts on both.

  • @Takios@discuss.tchncs.de
    link
    fedilink
    01 year ago

    I wonder if their recent blog post promoting conspiracy theorists and right-wing people turned away more people from telegram than they expected and now they feel the need to spread FUD against their competitors.

  • AFF
    link
    fedilink
    01 year ago

    The article about Maher is written by a conservative who can’t accept that we can limit individual freedom to reach true collective freedom.

    Also he wrote for FoxNews lol

    Stop spreading propaganda please, it’s just a CEO trying to shill its product

  • ☆ Yσɠƚԋσʂ ☆
    link
    fedilink
    01 year ago

    I find it weird how any discussion about Signal will inevitably have a bunch of people piling on dismissing any criticisms of it. Believing that Signal is perfect has become like a religion at this point. Whatever people might think of Telegram is completely irrelevant when it comes to the question of whether Signal is actually a secure tool or not.

    The fact that people working on Signal have direct ties to US intelligence agencies cannot be ignored. No can the fact that Signal is a centralized system based in US. These two things alone should make everybody very concerned.

  • NoLifeGaming
    link
    fedilink
    01 year ago

    One is open source and you can check the code while the other is not completely open source and uses proprietary encryption. That’s right, proprietary encryption.

  • @ChallengeApathy@infosec.pub
    link
    fedilink
    English
    01 year ago

    Sounds like someone is mad that security experts would rather trust a tried-and-true encryption standard over Telegram’s encryption which is known to not be anywhere near as secure as the Signal protocol.

    Pavel resorting to outright slander to promote Telegram is not something I expected to see.

    • @tetris11@lemmy.ml
      link
      fedilink
      0
      edit-2
      1 year ago

      he does raise very valid points about reproducible builds, which should be a priority if your product is security

      Edit: oh @Wolflink below points out that such builds are available for Android, but iOS has issues stemming from Apple and not Signal. This then begs the question, why is Telegram reproducible on iOS?

      • @aicse@lemm.ee
        link
        fedilink
        01 year ago

        You need some loops to jump through to get there. But that can be achieved for Signal as well, if you check the discussions regarding reproducible builds for Signal’s iOS client, you’ll see that people just decided it is not worth the hassle to push it through.

    • @rottingleaf@lemmy.zip
      link
      fedilink
      01 year ago

      Sounds like someone is mad that security experts would rather trust a tried-and-true encryption standard over Telegram’s encryption which is known to not be anywhere near as secure as the Signal protocol.

      There’s an issue in Russia with graduates of a few of the “kinda top” universities considering themselves elite, but not quite being as qualified as they think.

      Durov’s brother won a few programming competitions for highschoolers. Because of that apparently he should be considered something in cryptography. For people thinking like this at least.

      Pavel resorting to outright slander to promote Telegram is not something I expected to see.

      Why, it’s very much like him.

    • Dark Arc
      link
      fedilink
      English
      01 year ago

      I can’t read it because of the paywall but IIRC (based on a similar article) that was such a nothing-burger issue.

      People turned on an entirely optional (I think off by default setting) for some feature that allowed discovery of users by location … and shocked pikachu they could be tracked or something like that.

      • @DaseinPickle@leminal.space
        link
        fedilink
        01 year ago

        It’s not nothing if Telegram makes people believe they only share their location in a limited manner, but instead broadcast it to the whole world. That’s a serious breach of trust. I don’t know why Telegram users keep making excuses for that platform.

        • Dark Arc
          link
          fedilink
          English
          0
          edit-2
          1 year ago

          I don’t know why Telegram users keep making excuses for that platform.

          Honestly? Because the others are just so bad.

          • Element has an extremely clunky UX and uses Electron. The other Matrix app implementations are incomplete buggy messes.
          • Signal can’t sync old messages to the desktop, uses a messy Electron interface, and lacks a bunch of features/polish I’ve come to expect.
          • Discord doesn’t even pay lip service to privacy and uses a similarly doesn’t invest in native apps.
          • Threema has been saying that cross-platform/multi-device connectivity is coming for like 2+ years and has had nothing but the most minor of unexciting features added.
          • WhatsApp is run by Meta, has a crappy desktop experience, and has had several serious security vulnerabilities.
          • Jami is … extremely glitchy.
          • Session is basically Signal backed by a Crypto platform.

          If someone took Telegram’s UX and feature set and paired that with Signal’s approach of “everything is encrypted”, that would be a winner. I kinda hope someday Telegram just does that and moves everything to E2EE. When Telegram was launched E2EE for group chats/at scale wasn’t really a thing … now it’s not nearly as novel but nobody has deployed E2EE with a feature set like Telegram’s.

          It’s not nothing if Telegram makes people believe they only share their location in a limited manner, but instead broadcast it to the whole world.

          That’s not even what happens by the way. It’s just that you can spoof a device into random locations and eventually figure out where someone is.

            • Dark Arc
              link
              fedilink
              English
              01 year ago
              • Signal can’t sync old messages to the desktop
              • Persistent voice rooms
              • Custom emoji
              • Animated emoji
              • Location sharing
              • Chat folders
              • Topics/rooms for larger group chats
              • Support for larger group chats
              • Quoted replies (i.e., quote part of a reply or create an arbitrary quote block)
              • Code snippets
              • Message forwarding
              • Polls
              • Animations in the UI
              • Detailed custom theming
              • Chat room theming
              • A content index (e.g., view only the files, links, videos, etc that were sent in this chat)
              • Group invite links to people you don’t have in your contacts
              • Channels (i.e., micro-ish blogging)
              • A nice bot API
              • Subjective UI/UX changes to put things in more reasonable places (e.g, why can’t I right click on a chat to pin it in the desktop client, why is the Electron menu bar shown by default)

              And probably several other things I’ve forgotten because … basically nobody I know is still using Signal.

                • Dark Arc
                  link
                  fedilink
                  English
                  01 year ago

                  Signal’s location share AFAIK can’t be a live location share (which is useful during events like amusement park trips and stuff)

                  They have invite links to group chats? I don’t know how that would work

            • Dark Arc
              link
              fedilink
              English
              01 year ago

              A “toot” isn’t a very persuasive piece of journalism.

              I can verify that it absolutely impacts groups run by queer communities in the Gulf, because I was in one such group that was monitored and shut down by Etidal.

              That claim needs a lot more investigation and context. At the very least, it needs investigated by a credible third party.

              Also, do you even know what the feature you’re criticizing is? A “channel”? Because it’s not even really a part of the messaging portion of Telegram. It’s basically an in-app blogging platform.

  • @WolfLink@lemmy.ml
    link
    fedilink
    01 year ago

    Go read the GitHub issue. The main difficulty in implementing reproducible builds is the code signing Apple requires as well as other tweaks Apple makes to modify the binary from what the dev submits to what gets downloaded from the App Store. Note that Android already has reproducible builds. Also the reason the GitHub issue was closed wasn’t “refusal” to implement the feature, they wanted to move the discussion to their forums.

      • @Thetimefarm@lemm.ee
        link
        fedilink
        01 year ago

        Who knows how apple decides to do anything? There may be some really stupid arbitrary reason apple modifies signal but not telegram just because apple insists on being difficult. If you don’t trust apple don’t use an iPhone and just download it on android.

  • You don’t need a backdoor in signal to bypass its encryption.

    All you need is to exploit the phone and wait for them to open or use signal.

    If you think your phone is safe from the NSA or similar services, I got some bad news for you.

        • Greg Clarke
          link
          fedilink
          English
          01 year ago

          I forgot to post an affiliate link and explain how routing all your internet traffic though one company equals security

    • All you need is to exploit the phone and wait for them to open or use signal.

      Physical access is root access. But just because you can’t make something NSA-proof dosen’t mean you can’t make it bloody difficult to break into.

      • @NotMyOldRedditName@lemmy.world
        link
        fedilink
        0
        edit-2
        1 year ago

        There’s been enough zero day remote exploits that there’s bound to be more.

        Pretty sure there’s more than 1 about receiving an SMS and the payload rooting the phone and you not even knowing it happened. At least 1 but I think 2 or more.

        Something about a malicious image also rooting a phone.

        It goes on and on and phones don’t always get security updates.

        You can do your best, but then longer you use a given phone the higher the risk. That’s why people switch out phones frequently when doing shady or important shit