this post was submitted on 02 Oct 2024
350 points (98.6% liked)

Privacy

31431 readers
1107 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 4 years ago
MODERATORS
 

Telegram CEO Pavel Durov recently announced that Telegram would be handing over user data (such as phone numbers and IP adresses) to the authorities. Now it turns out that it has been doing so since 2018.

My previous post may have seemed to announce a major shift in how Telegram works. But in reality, little has changed.

Since 2018, Telegram has been able to disclose IP addresses/phone numbers of criminals to authorities, according to our Privacy Policy in most countries.

For example, in Brazil, we disclosed data for 75 legal requests in Q1 (January-March) 2024, 63 in Q2, and 65 in Q3. In India, our largest market, we satisfied 2461 legal requests in Q1, 2151 in Q2, and 2380 in Q3.

To reduce confusion, last week, we streamlined and unified our privacy policy across different countries.

Telegram was built to protect activists and ordinary people from corrupt governments and corporations — we do not allow criminals to abuse our platform or evade justice.

Full text of the post.📰 My previous post may have seemed to announce a major shift in how Telegram works. But in reality, little has changed.

🌐 Since 2018, Telegram has been able to disclose IP addresses/phone numbers of criminals to authorities, according to our Privacy Policy in most countries.

⚖️ Whenever we received a properly formed legal request via relevant communication lines, we would verify it and disclose the IP addresses/phone numbers of dangerous criminals. This process had been in place long before last week.

🤖 Our @transparency bot demonstrates exactly that. This bot shows the number of processed requests for user data.

✉️ For example, in Brazil, we disclosed data for 75 legal requests in Q1 (January-March) 2024, 63 in Q2, and 65 in Q3. In India, our largest market, we satisfied 2461 legal requests in Q1, 2151 in Q2, and 2380 in Q3.

📈 In Europe, there was an uptick in the number of valid legal requests we received in Q3. This increase was caused by the fact that more EU authorities started to use the correct communication line for their requests, the one mandated by the EU DSA law. Information about this contact point has been publicly available to anyone who viewed the Telegram website or googled “Telegram EU address for law enforcement” since early 2024. 

🤝 To reduce confusion, last week, we streamlined and unified our privacy policy across different countries. But our core principles haven’t changed. We’ve always strived to comply with relevant local laws — as long as they didn’t go against our values of freedom and privacy.

🛡 Telegram was built to protect activists and ordinary people from corrupt governments and corporations — we do not allow criminals to abuse our platform or evade justice.

top 50 comments
sorted by: hot top controversial new old
[–] todd_bonzalez@lemm.ee 7 points 12 hours ago

This is a wild admission. Not only does it show that Telegram completely betrayed all of their users, but it also reveals that they know about all the terrorism and child porn channels on their service, and deliberately didn't delete them.

[–] Phoenicianpirate@lemm.ee 8 points 18 hours ago (2 children)

Good thing I never trusted it.

[–] quant@leminal.space 2 points 12 hours ago

Implementing an in-house encryption was raising eyebrows already back then. No e2ee as default was also a red flag since it gives users without proper knowledge a false sense of security.

[–] Duamerthrax@lemmy.world 1 points 13 hours ago

There was some privacy centered linux group that used Telegram that I thought I needed to follow, but noped out when they required a real phone number.

[–] celsiustimeline@lemmy.dbzer0.com 9 points 20 hours ago (2 children)

I assume every single chat app is either a honey pot or is more than willing to hand over all logs to law enforcement. Anything advertising E2EE is basically saying "hey all you pedophiles and money launderers, have I got a data tracking app for you!"

[–] Pika@sh.itjust.works 9 points 19 hours ago* (last edited 19 hours ago)

I know you didn't directly say it but it's implied so I wanted to clarify.

telegram chat isn't E2E, the only E2E on the platform is secret chats, which is only available to mobile users of the platform and not enabled by default. It does have client-server encryption but, in the terms of privacy that is worthless if you don't trust the host (and it opens the host up to legal information requests as it has the capability of decrypting the messages)

[–] Frostbeard@lemmy.world 1 points 18 hours ago

No mobile platform is secure. Even EncroChat was broken.

[–] ReluctantZen@feddit.nl 3 points 17 hours ago

You mean they've lied all along?

[–] SorryforSmelling@lemmy.blahaj.zone 17 points 1 day ago (3 children)

ok this feels like a real hot take. but i am somewhat glad about this. in my country telegram has the reputation to be the nazi (and sometimes the pedo-) app. so i am not unhappy those people online activity can be used against them in court. That beeing said i can respect people who feel otherwise.

[–] JargonWagon@lemmy.world 3 points 16 hours ago

I'm with you. If they're verifying the information request, as in vetting it to determine if there is actual criminal behavior going on i.e. pedos/money laundering/etc, then good. Hand them over to the authorities.

They state that they don't cater to corrupt governments or organizations - good.

Everyone here arguing against these things are throwing up major red flags. Didn't the CEO just go to court because he wasn't handing over information willy nilly? I would hope Signal and Proton would be doing the same things.

load more comments (2 replies)
[–] dwt@feddit.org 11 points 1 day ago (1 children)

Surprised pikachu face….

[–] Mojeek@lemmy.ml 2 points 1 day ago

noone expected this

[–] zante@lemmy.wtf 55 points 1 day ago (3 children)

Everyone was told, from the outset , not to trust telegram. Amnesty International, the EFF, the cryptography community all said this as long as 10 years ago.

It’s actually pathetic to read a Russian talking about how it was “built for activists and not criminals “ . What a worm.

[–] loutr@sh.itjust.works 2 points 1 day ago

I know "security experts" from a top French bank who insisted on using telegram instead of signal. So even people who were supposed to stay informed about this stuff fell for the hype and marketing.

[–] drwho@beehaw.org 10 points 1 day ago

There are lots of things I could say to agree with you, but all I can do is gesture helplessly.

load more comments (1 replies)
[–] xiao@sh.itjust.works 103 points 1 day ago (6 children)

Telegram was built to protect activists and ordinary people from corrupt governments and corporations — we do not allow criminals to abuse our platform or evade justice.

Criminals according to what standard ? In some countries, activism or sympathy with a cause is considered criminal behavior.

Evade justice ?? What justice is he talking about? The justice of the United States of America, Chinese justice, or the justice of the nationalities he possesses?

Better to avoid this platform

[–] melroy@kbin.melroy.org 27 points 1 day ago (1 children)

You are 100% correct!

When governments are corrupt; rebellion is the same as criminal, because you are going against the government. That is the whole problem.

load more comments (1 replies)
[–] msage@programming.dev 8 points 1 day ago

Criminals like Edward Snowden I guess

[–] zante@lemmy.wtf 15 points 1 day ago

As a Russian he should know better anyone the difference between an Activist and a criminal is one phone call from the FSB

load more comments (3 replies)
[–] delirious_owl@discuss.online 15 points 1 day ago (4 children)

Why do you think they (and Signal) require phone numbers?

[–] dependencyinjection@discuss.tchncs.de 1 points 12 hours ago (2 children)

Doesn’t signal allow signups without a phone now?

Also second SimpleX that the other person mentioned.

[–] delirious_owl@discuss.online 1 points 7 hours ago

No, it gives usernames in addition to phone numbers. They refuse to remove the phone number requirement. How else could they help the feds identify your account?

[–] khalil@beehaw.org 1 points 9 hours ago

AFAIK signal stil requires a phone numer for registration, however you now can add people by their username.

[–] Pika@sh.itjust.works 2 points 18 hours ago* (last edited 18 hours ago) (1 children)

In terms of end-to-end encryption I don't mind if they have my phone number or not, if it's done right.

Let's use signal for example, because honestly they do it pretty decently, the most information that you can obtain from signal in a data information request is the date and time that an account is created, and the last time the account went online.

Actual content such as the user's contact list, the people that user was talking with(including groups), and of course the messages that you sent are fully end to end encrypted meaning that signal does not have access to it meaning that they cannot give that information out in a data information request as they never had it in the first place.

The most that signal is able to confirm in a data information request, is yes this specific account ID has a signal account and this is the last time they went online.

[–] delirious_owl@discuss.online 2 points 18 hours ago (1 children)

Are you mad? The phone number tells you what phone company to call. In most countries, that tells them your name and government ID.

The phone number is the thing that tells them everything about you.

[–] Pika@sh.itjust.works 2 points 17 hours ago* (last edited 17 hours ago)

and what is that going to give them? The information that they have is yes, they have an account, and that's also saying that they used an actual number and not a VOIP number for registration. but if they are asking via phone number, they will already have that information at hand. They won't get any information about what chats that number is part of, or even any info really at all, anything about the account is encrypted and not visible.

If they are able to provide my phone number without knowing the info you said there, there is some other leak already involved, and either way they won't get anything but a "yes he has an account and he was last connected on X"

[–] jaypatelani@lemmy.ml 5 points 23 hours ago
[–] ByteOnBikes@slrpnk.net 8 points 1 day ago (1 children)

I've been calling this out for years.

And every time, some commenter goes, "Nu uh, look at their website bro! It's super private!"

load more comments (1 replies)
[–] sparky@lemmy.federate.cc 1 points 21 hours ago* (last edited 21 hours ago)

Pretty sure this is the same as every other messaging app - metadata is never protected information. The contents of the messages may be encrypted to some extent (which on Telegram they are, not end-to-end as with iMessage, but they’re not plain text), however your IP address, username, etc are subject to subpoena on any messaging platform.

[–] zephorah@lemm.ee 23 points 1 day ago (13 children)

This is really simple. Use Signal or WIRE. Proton or maybe Tutanota for email.

Avoid garbage like Telegram and FB Messenger. Discord as well.

[–] floquant@lemmy.dbzer0.com 11 points 1 day ago (2 children)

There seems to be a gross misunderstanding of how everything works here. Any platform will need to provide data to authorities when "asked properly" - as in, receives an actual order from some enforcing body that has authority on the subject in question. No commercial company will fight the CIA in court to protect your data. The best you can hope for is that they minimize what kind of data they collect about you in the first place - in the case of E2EE, they will only have access to IPs and other metadata such as connection timestamps and nothing else. But all of the services you listed will collect at least IPs and most will do phone numbers as well. The only difference with Telegram is that they're transparent about it. You can either avoid using commercial platforms altogether, or use them in a way such that data retrieved from them will be useless. But believing that "Signal will never give my IP to law enforcement" is delusional.

load more comments (2 replies)
[–] clot27@lemm.ee 1 points 21 hours ago (1 children)

Does those apps have unlimited storage? Channel with unlimited subscribers? Or much more

[–] GhiLA@sh.itjust.works 1 points 17 hours ago* (last edited 17 hours ago)

Does this cup hold infinite water?

Would any?

[–] sibachian@lemmy.ml 1 points 22 hours ago* (last edited 22 hours ago)

I see a lot of people mention WIRE recently. Did everyone collectively forget how they sold out in 2019 and removed their canary (aka. compromised)?

In July 2019 Wire raised $8.2m investment from Morpheus Ventures and others. On July 18 of the same month, 100% of the company's shares have been taken over by Wire Holdings Inc., Delaware, USA.

[–] possiblylinux127@lemmy.zip 13 points 1 day ago* (last edited 1 day ago) (9 children)

Wire isn't that great. Definitely avoid email as it is riddled with problems that aren't easily fixable despite what the email companies tell you.

Simplex Chat, Signal or possibly Matrix

load more comments (9 replies)
load more comments (9 replies)
[–] underisk@lemmy.ml 17 points 1 day ago (7 children)

Never trust a third party to keep your shit private. Especially if privacy is their main selling point.

load more comments (7 replies)
load more comments
view more: next ›