Investigation by investigative journalism outlet IStories (EN version by OCCRP) shows that Telegram uses a single, FSB-linked company as their infrastructure provider globally.

Telegram’s MTProto protocol also requires a cleartext identifier to be prepended to all client-server messages.

Combined, these two choices by Telegram make it into a surveillance tool.

I am quoted in the IStories story. I also did packet captures, and I dive into the nitty-gritty technical details on my blog.

Packet captures and MTProto deobfuscation library I wrote linked therein so that others can retrace my steps and check my work.

  • arsCynic@beehaw.org
    link
    fedilink
    arrow-up
    5
    arrow-down
    5
    ·
    edit-2
    3 days ago

    I would most definitely not recommend Matrix for private or sensitive communication, no.
    https://soatok.blog/2024/07/31/what-does-it-mean-to-be-a-signal-competitor/
    https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/
    Matrix is fine as IRC replacement, it might also be a decent replacement for Telegram’s channels thingy, sure. But I would not trust my family photos to it. Much less anything actually important.

    Regarding Soatok, I am prone to completely ignore impolite individuals. As far as my experience goes, and for most of the general populace, Matrix is fine. And it is likely to continue improving. Compared to Signal and Telegram, who both incentivize crypto"currencies", a.k.a. tech bro multi-level marketing pyramid schemes, enshittification has already begun.

    Roy says: August 6, 2024 at 4:28 pm
    Interesting post! I would be really interested in knowing your opinion on SimpleX Chat.

    Soatok says: August 6, 2024 at 4:55 pm
    See, this is exactly the fucking problem. I never invited anyone to query me to look at YET ANOTHER fucking chat app. Yet this still keeps happening. Doing security reviews is labor. You’re asking me to work for free to satisfy your curiosity. This is annoying to do. I don’t have a fucking opinion about SimpleX. I don’t have an opinion about a lot of apps. If I want to share my opinion, I’ll blog about it WITHOUT being prompted. Until then, please stop asking.
    By Post Author

    • rysiek@szmer.infoOP
      link
      fedilink
      arrow-up
      11
      arrow-down
      1
      ·
      edit-2
      3 days ago

      Regarding Soatok, I am prone to completely ignore impolite individuals.

      Please feel free to ignore me as well then, because saying that technical analysis by an expert can be outright ignored just because the expert happened to be impolite that one time might make me become somewhat impolite.

      Imagine getting dozens of randos in your replies asking about dozens of random chat apps. At some point I am pretty sure you’d also reach a breaking point. Some would call that kind of behaviour a bit impolite, I’d wager.

      • arsCynic@beehaw.org
        link
        fedilink
        arrow-up
        6
        arrow-down
        4
        ·
        edit-2
        3 days ago

        I’m not saying arguments necessarily become invalid because of impoliteness. But to me it doesn’t convey trustworthiness on first impression, especially when not knowing someone. The world / the Internet already contains so much toxicity, there’s no need for needless additional discord. Especially when encountering something frustrating on the Internet—as opposed to real life—it is trivial to just take a breath, go for a walk, and come back and respond peacefully. The simplest thing for Soatok to have done would be to ignore the message, or use AutoKey to paste a generic neutral response denying the request.

          • arsCynic@beehaw.org
            link
            fedilink
            arrow-up
            1
            ·
            edit-2
            3 days ago

            Why do you conflate politeness and trustworthiness? Seems like a weird connection to make.

            Is it really that weird? Imagine someone going to a store and the owner starts swearing at them because they asked a question. Would said visitor be more or less likely to trust the owner? I agree that being impolite doesn’t necessarily equate to being ignorant in one’s subject, but I wouldn’t be surprised that on average the most knowledgeable and wise tend to be more polite.

            • Vodulas [they/them]@beehaw.org
              cake
              link
              fedilink
              arrow-up
              3
              ·
              3 days ago

              Because the inverse of that is how people get conned. Someone blowing absolute smoke with a confident tone and a sweet word. Tone is about the worst indicator of trustworthiness

              • arsCynic@beehaw.org
                link
                fedilink
                arrow-up
                1
                ·
                1 day ago

                Because the inverse of that is how people get conned. Someone blowing absolute smoke with a confident tone and a sweet word. Tone is about the worst indicator of trustworthiness

                Sure, skilled sociopaths con their way up that way, or that’s how soulless marketers manipulate the populace. However, that does not mean that most people who are kind are sociopaths or soulless. On average kind people are just being kind.

                • Vodulas [they/them]@beehaw.org
                  cake
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  19 hours ago

                  On average kind people are just being kind.

                  And that is great, it is good to be optimistic. My point is being kind has nothing to do with trustworthiness. Hell, someone that is kind can also just be plain wrong. They might think they know something when they do not. The kindness just does not factor in to knowledge. Plenty of experts are not what people would describe as kind, and plenty of misinformation peddlers are kind. It just has nothing to do with expertise

              • Gamma@beehaw.org
                link
                fedilink
                English
                arrow-up
                2
                ·
                2 days ago

                It seems like trusting the nicest voice in the room on a topic like security, rather than experts, could be a mistake

        • rysiek@szmer.infoOP
          link
          fedilink
          arrow-up
          9
          ·
          edit-2
          3 days ago

          Soatak

          Soatok. At least get the name right.

          The simplest thing for [Soatok] to have done would be to ignore the message

          Which also happens to be the simplest thing you could have done, even simpler as none of the toots you quote were addressed to you. Instead, you are dragging this one random exchange into this thread about something else entirely.

          • arsCynic@beehaw.org
            link
            fedilink
            arrow-up
            3
            arrow-down
            2
            ·
            edit-2
            3 days ago

            The simplest thing for Soatok to have done would be to ignore the message

            Which also happens to be the simplest thing you could have done, even simpler as none of the toots you quote were addressed to you. Instead, you are dragging this one random exchange into this thread about something else entirely.

            Does it really matter whether or not it is addressed to me? And, the simplest route is not necessarily the most virtuous one. To take an extreme example, if I see someone being bullied I will interfere to stop the bully and console the target. Here, I am simply arguing in favor of less toxicity for it improves credibility.

            • Soatok Dreamseeker@pawb.social
              link
              fedilink
              English
              arrow-up
              3
              ·
              2 days ago

              You say you’re arguing in favor of less toxicity, but your example was a screenshot of a comment where I asserted my own healthy boundaries (after being needled by hundreds of demands in the form of “what about <other app>?” from strangers over the course of months).

              Which is more toxic?

              • arsCynic@beehaw.org
                link
                fedilink
                arrow-up
                1
                ·
                edit-2
                1 day ago

                You say you’re arguing in favor of less toxicity, but your example was a screenshot of a comment where I asserted my own healthy boundaries (after being needled by hundreds of demands in the form of “what about <other app>?” from strangers over the course of months).

                Which is more toxic?

                The one that contains the most aggression.
                Do most of those strangers know that you are receiving hundreds of requests? They’re strangers, so I’m betting on no. Are they then deserving of any swearing and caps lock yelling? Even if they do know, I can recall few to no instances where unironically doing so packed a punch.

                A more reasonable answer would have been: “Sorry, no idea. For my own healthy boundaries I have to refrain from doing too much of this often-requested but time-consuming research.”
                Not toxic, more effective. And as I mentioned in another reply, with AutoKey you could configure that typing the word “sigh” or phrase ''goddammit not again" automatically expands into the alternative answer suggested above. Being frustrated is fine, and venting is absolutely necessary, but there are ways to do it that are healthy for everyone involved, such as the autoreply and then going for a run. Hope for the best, prepare for the worst.

                • Soatok Dreamseeker@pawb.social
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  1 day ago

                  Which is more toxic?

                  The one that contains the most aggression.

                  Aggression isn’t toxicity. The logical consequence of your stance is negative peace, and broken stairs.

                  Do most of those strangers know that you are receiving hundreds of requests? They’re strangers, so I’m betting on no.

                  Sure they do, because I tell them. The screenshot you posted is proof that I inform them.

                  The rest of this is needless language policing.

                  • arsCynic@beehaw.org
                    link
                    fedilink
                    arrow-up
                    1
                    arrow-down
                    1
                    ·
                    1 day ago

                    Aggression isn’t toxicity.

                    Subjective. “A toxic person is anyone whose behavior upsets you and adds negativity to your life.
                    Asking a simple question and out of the blue getting a response intermixed with full caps and “fucking” would be enough to add negativity to many if not most people’s lives. Also the unyielding need to defend one’s doing so doesn’t help to convey the converse.

                    Do most of those strangers know that you are receiving hundreds of requests? They’re strangers, so I’m betting on no.

                    Sure they do, because I tell them. The screenshot you posted is proof that I inform them.

                    You “inform” them afterwards, therefore they didn’t know.

                    The rest of this is needless language policing.

                    Not sure what the definition of “language policing” is, but welcome to the Internet. You’re free to be crude or toxic while others are free to point out it out, which is rarely needless.