• 0 Posts
  • 405 Comments
Joined 2 years ago
cake
Cake day: December 28th, 2023

help-circle





  • A lot of websites actively interfere the reader from accessing them by pestering them with their “apps” these days. I don’t know where this fascination with getting everyone to download your app comes from.

    I’m kinda surprised the author is able to put together why the ad experience is bad, even directly calling out the data ining of the sites, but completely misses that apps are even better at mining your data





  • They’re probably assuming the chats aren’t encrypted because telegram doesn’t encrypt those. Source

    Multi-device End-to-end encrypted chats are a mess

    The concept of End-to-End Encryption has no limits for the number of communicating devices. However, if you want to access your end-to-end encrypted chats from multiple devices, you’re facing many technical difficulties, especially when it comes to connecting new devices, loading chat history and restoring backups.

    Most of our competitors (notably, Whatsapp and iMessage) solve these problems in ways that make their end-to-end encryption useless (this is a big topic, so requires a separate manual [poster note, that link goes to a ‘manual’ that hasn’t been filled out lol]). To solve them in a secure way, you’d have to sacrifice usability and some of the features you’re used to – the result would never be as fluent and simple as what we offer in Cloud Chats.

    Telegram says they don’t encrypt them and tries to imply that people who actually know how to use cryptography failed to solve this problem because they couldn’t solve it with their shitty self rolled ‘encryption’ algo that hasn’t been peer reviewed (unlike the signal protocol)











  • So if they were going to do an attack like this, they wouldn’t do anything like the DH attack you’re talking about, they’d have a custom CA in the browser’s SSL root store. That root cert means they can generate a certificate for any website you visit, and that custom root cert would be how they decrypt your traffic.

    Afaik there isn’t a current attack on proper DH key pairings, but you can’t block the custom certificate path at the browser level without some serious server side work/client side JS to validate