The cryptography was thrown together in the very early days as a proof of concept, that reached some level of adoption because of how nostr suddenly grew at the end of 2022. The community has since largely switched to a new standard (NIP 44) which has been independently audited, although there are some popular clients that haven't yet transitioned.

▲

tptacek 5 days ago | parent [-]

From a brief scan, NIPS 44 seems reasonable; it's just AEAD ChaCha20, which is boring, which is good.

▲

eduction 5 days ago | parent | next [-]

Interesting way to spell “i was extremely wrong”

▲

skinkestek 5 days ago | parent | next [-]

I think it is an HN standard:

I am less on HN these days, but as far as I have seen:

Telegram is still judged by its very early releases, still called "unencrypted" while it is about as encrypted as your bank transactions (they definitely aren't e2ee either).

Signal can do what they want including dabbling in crypto currency without being open about it. Signal can also have extremely "interesting" bugs (didn't it at some point send messages to random people?) and glaring security issues (relatively trivial remote code in the desktop client IIRC a few years ago).

Last I checked WhatsApp was supposedly also good since they now use good encryption despite now being owned by Facebook, sending my social graph to them and sending peoples entire backups (including chats with me) unencrypted to Google for "free" (IIRC) backup.

That said these days I am definitely looking for Telegram alternatives.

▲

tptacek 5 days ago | parent [-]

Your bank doesn't operate in Telegram's threat model! You are never concerned that your bank's servers are attacking your transactions: if you can't trust your bank, you're fucked anyways. That's precisely what's not supposed to be the case about a messaging service!

	▲	nout 4 days ago \| parent [-]
		I agree with your bank related statements, but for the wrong reasons. You should not trust your bank.

▲

tptacek 5 days ago | parent | prev [-]

Is the protocol the paper was written about no longer deployed anywhere, or is this just a dunk?

	▲	jonstaab 3 days ago \| parent [-]
		It was (and still is) deployed in a number of places, so it's a valid criticism in that context. That said, it's mostly dunk.

▲

5 days ago | parent | prev [-]

[deleted]