Telegram and Signal messengers on Linux



Both Telegram and Signal are available in the Software Manager for Linux Mint 21.3 as flatpacks
 
Makes sense. I am picking a new Buntu-based distro to install. Since I do not want to go old schoole Debian, maybe will look at Mint. Never tried it before.
 
What I kind of hate is that you have to tie both to your phone.

Signal was announcing they want to drop mobile phone numbers, but now there is just an option to not publish it to your contacts. Bit annoying..

I can highly recommend matrix. You will have to convince people to use it though, and its quite secure so bit more annoying to setup. Usage is great though, both on "Linux" and Android / IOS. You do not need a phone number and you can register with a throwaway email account. You can create an account here: https://app.element.io/ or, if you feel like working today :p you can setup your own matrix server (to much hassle).

Matrix is a bit like IRC with lots of public chatrooms for lots of Linux related and other topics, but its not the same scale as IRC (yet).
 
You are right. The phone number is the fatal flaw in both.
Telegram depends on it only during the registration, you use it only once and then the phone number becomes irrelevant.

Signal on the other hand continuously depends on the number to sync up a desktop version. Neither one is perfect but at least they work from the security perspective.

Telegram has the awesome "Secret chat feature".

Signal is cool because it gathers no data about you other than login time and such.
The only messenger that I know which doesn't require a phone number is wire.
 
yes, it is insecure by default. To me thats an immediate perban ;) - sadly I have to communicate with non-tech people somehow.
I have used Matrix once just to check it out, but since the rest of the world use Telegram, Signal and WhatsApp I tend to use the latter two. I did use Threema for a while which doesn't require a phone number but only several people that I know that used it so I don't use it anymore now.
 
yes, it is insecure by default. To me thats an immediate perban ;) - sadly I have to communicate with non-tech people somehow.

It is secure by default. If you are implying that messages are not safe -- Messages are encrypted with a one-time session key. So are voice calls, so are video calls. The Secret Chat feature is even more so, as it doesn't even hit any server.

Telegram with the Secret Chat enabled and short timeouts is the most secure method there is. A message is not just deleted, it's wiped.

Signal is very good also. Possibly better than Telegram.
It's very well thought out and very distrustful. I once cloned a SSD where the primary OS was installed. The clone disk where Signal was installed, would not work. It realized it became a clone and refused to work, to start, to connect. It somehow determines the authenticity of the computer it is installed on. You would have to clone not just the OS but the SSD itself, meaning the same serial number and everything. Possible but unlikely as hell. And even if done, Signal will still notify you that there has been a new login. It will realize that an additional device is accessing the account.
 
whatsapp is the largest user base in the world, over a billion. I hear the messages are secure.
The problem is not message security but that whatsapp collects too much info about you. Down to your phone charge level. Location, etc. Facebook owns it and they are like google, they want to know everything.
 
Wickr was nice but apparently stopped accepting new users.
It had that interesting feature that nobody else had. A message had 2 timeout settings. One, when the mesg got read, how long until it self-deleted. Two, even if the message did not get read, unconditionally delete it anyway.
 
It is secure by default.

When I start a new chat in Telegram, I have to manually:

  • click on the users icon thingy
  • click settings button thingy on the top right
  • click "Start Secret Chat"
  • Confirm "Secret Chat: Are you sure you want to start a secret chat?" -> yes

Now I have a end-to-end encrypted chat. This is hence not the default. In my experience, NONE of the people I know privately actually do this. They all just use the regular chat.

There is no downside to the usability of this. A end-to-end encrypted chat in TG looks to a DAU user like a regular chat. There is no reason to not have as much security as the user can handle without being overwhelmed by extra security measures.
End users dont use GPG encrypted Emails as its annoying to handle. But they do use Signal which has reasonably good security measures.
They do not use Telegram e2e encrypted chat because it requires you to click 5 more times. Thats just dumb and it should be the default and it's the reason I recommend to use Signal and not TG.

Not offering the best security possible is "broken by design" to me.

Signal is also not a company, its a foundation that uses only donations to fund itself and the apps development. I have googled for a bit about how TG makes money and the best answers I found were paied subscriptions (ok then). I think you can also buy stickers or something.

While I'm ranting around :p Neither Signal Whatsapp or Telegram set a message deletion timer by default. Who ever read old messages? Have you ever gone back to read what you've written "Alex", your buddy that you meet twice a year to go fishing with, 7 month ago? ;)

And while we are at it: use matrix
 
Last edited:
You can use regular telegram chats for every day everything. It's encrypted and nothing wrong with it. If you are implying it is not encrypted - it is.

In the settings, there is a value you can set and a time-out figure will be attached to all the chats you start, between 1 day and 1 year. I usually set mine to 1 week. If conversation becomes sensitive, depending on how sensitive, I either downgrade to 1 day or switch to Secret Chat for most security.
Non-Secret chat is fine for every day traffic, and users should encrypt all their traffic so the Alphabets have no idea what is important and what is not. Telegram does that. There are no special hoops to jump through. It's organic and pretty simple. And looks like a text messenger.

The reason the Secret Chat is not turned on by default is because Telegram is replicated to all the devices you are logged in. You can have x number of computers and tablets. A conversation you start on your phone will be replicated to your tablet(s). So if I see something on the phone, or desktop, like a cool place to eat, throw it in the "Saved messages" folder, then the tablet stored in the car will show that and all the other devices. A general chat like that is for low-priority low-security messages. It's not that the message is unencrypted, they don't have to break it, they just have to steal one of your computers/tablets/phones to get access to all the messages, and for high priority mesg short time outs are a must anyway. Say one day and there is nothing beyond 1 day that's shown.


Not offering the best security possible is "broken by design" to me.


It is a trade-off per user request. It's self-evidently not safe as if one your devices gets stolen, they will be able to read your messages. You can login to your master account and terminate all other login sessions. You trade security for convenience. If you want most security, you can trade convenience for security, Secret Chats are not replicated to your desktop or any other devices.

While I'm ranting around Neither Signal Whatsapp or Telegram set a message deletion timer by default.


They all do. For the chats you start, all 3 can be set to a default timeout value. whatsapp is kind of limited, it's either 1 day or 1 week or 90 days. Telegram is most flexible, it ranges from 1 day to 365 days. Signal ranges from 4 weeks, 1 week, 1 day, 8 hours, 1 hour, 5 minutes, 30 seconds and then there is the custom time for most granularity not to exceed 4 weeks. Viber does it too, up to 1 day.

To reiterate, you only need a phone once for telegram and you can buy a burner or use someone's else number, you don't need it past that point unlike whatsapp and Signal and Viber.

Another really neat feature of Telegram I haven't really seen elsewhere (Well Signal started doing it recently, apparently inspired by Telegram). You can set a message into the future. Say a week or a month from today. So the message will be sent if something does not happen, versus something happening. Say you do some risky international travel, and you can ping a mesg 2 weeks into the future with instructions how to proceed if your plane does not land, etc. etc. Very neat.

The cool thing about Signal is that it's uber paranoid, has a lot of security checks that it does. It also has more granular timeout settings, down to seconds and minutes and hours. I frequently donate to them.

The only thing I find mildly irritating is that the history of timeouts is not deleted, so if you carry a conversation, initially set to 4 weeks timeouts, then jump to 1 day, then to 2 hours, a person scanning your phone, even with all the messages are deleted, will deduce something important went down when you went from 4 weeks to 2 hours back to 1 week or such. There is no reason to keep the timeout or call history around. I want the whole thing wiped clean, like Wickr. They put even more paranoidal thought into their security features.

Signal too has the general sandbox type "saved messages" folder which is blasted across devices, and you can set a timer on it as well. And it's encrypted.

I think the biggest issue is someone hacking the computer, or placing malware or stealing the phone or something versus actually breaking one of these messengers. There is a a weak link and it's not Signal/Telegram itself.

There is the wire messenger. No phone needed. No other advantages over signal/telegram.

As a bonus there is also the Viber messenger, popular in Eastern Europe, it's more popular than signal world-wide. It has some interesting features. I don't know how secure it is, they claim messages are encrypted. It disables screenshots if the timeout is set. Its timeout settings are kind of weird, 10 seconds, 1 minute, 1 hour and 1 day. I wish they had a week also. But you can replicate the session to the desktop.

I almost forgot. The real power of telegram is that it is an entire ecosystem. You can easily spin up a channel or a group of up to 200,000 followers. And post media, all with the timeouts set. They put a lot of work into it. It's a messenger with social media built in, which is much nicer implemented IMO than Instagram/FB or anything else. It just works.

Signal too does groups.

So does whatsapp. So does viber. I would trust telegram/signal over whatsapp/viber.
 
Last edited:
You can use regular telegram chats for every day everything. It's encrypted and nothing wrong with it. If you are implying it is not encrypted - it is.
I am implying there is an end-to-end encrypted OPTION that is not the default.

To the end user there is no real difference. From what I know theres a green lock or something next to the chat if its the "secure" one.

The best (usable) security should be default. Designing software a bit secure, and optionally more secure, but the more secure version is 5 clicks further down the road, is bad software design (in my respectful opinion).

There is no reason to keep the timeout or call history around.
+1

While I'm ranting around Neither Signal Whatsapp or Telegram set a message deletion timer by default.
+5 ;) (/me allows himself that many votes on that one)

I think the biggest issue is someone hacking the computer, or placing malware
Yes, that is of course true. Sadly all of the paranoia dance is kind of bollocks while we dont have FOSS hardware.

TG is social media
Imho the only good way to implement social media is a decentralised system. Tell that to the facebook community.

I remember when fb got big (I'm getting old lol) and I was confused that people don't get who they are selling their data to (and they still dont). Now look at the internet :p Its very sad nobody cares still. With murphys law in mind, I'm wondering when a totalitarian government will come to take over facebooks data ;)

Long story short. Just send carrier pigeons. Hope nobody shoots them down.

I do enjoy the conversation :)
 
I am implying there is an end-to-end encrypted OPTION that is not the default.

To the end user there is no real difference. From what I know theres a green lock or something next to the chat if its the "secure" one.

The best (usable) security should be default. Designing software a bit secure, and optionally more secure, but the more secure version is 5 clicks further down the road, is bad software design (in my respectful opinion).

The best usable security or peer-to-peer encryption runs into the problem that a message would not be replicated to devices, from phone to desktop or laptop or tablet. That's the problem. Telegram is very convenient when messages are replicated to N number of devices via its cloud encryption. All the devices are synced. It's nice.

It would make no sense to start with the peer-to-peer encryption mode, device to device and have to downgrade to cloud-based crypto for blast the message across all registered devices. That means hardware ones and that also means web-based logins. That's is what's called convenience. Peer to peer makes no sense for evening dinner plans. Cloud based means if you are sitting next to the computer, you can accept a video call from the desktop, or a laptop and if you are in a vehicle, then continue the conversation from a mobile device.
Cloud based means you don't need your phone at all. If your phone dies, telegram keeps going. Very convenient.
If you initiate the secret chat, your device becomes that single point of failure. Many times it makes sense to shutdown the device and use a web-based login or via notebook/tablet or such. For example to keep the phone fully charged when travelling.

You should start a secret chat if you actually need the secret chat. One device, short timeout, peer to peer crypto.

So why doesn’t Telegram use end-to-end encryption by default? Durov has argued it’s because Telegram is a “feature-rich” app. “Signal represents one feature of Telegram, which is Secret Chats,” Durov wrote on Telegram when questioned about why the app didn’t use end-to-end encryption by default. “If you think you need a separate app for that feature only [end-to-end encryption], installing it might make sense for you.”

Durov also believes most people want more features rather than the greater levels of privacy end-to-end encryption offers. “The minority which doesn't want any of that and wants to maximise security at the expense of usability is welcome to use Secret Chats on Telegram – or install any of the apps that only have Secret Chats and nothing on top,” he wrote. He added he wouldn’t “cripple” Telegram by making it end-to-end encrypted by default and removing other features such as channels.
 

Members online


Top