Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As kawera said two comments above yours:

Their servers do not store unencrypted messages so they need to come from the phone.

----

That's why some people criticise Telegram: Their messages have to be stored unencrypted for their setup to work.



Exactly. Telegram's "Secret Conversations" are encrypted end-to-end but then they aren't synced (or even supported on desktop).


My workaround for this is to create a group chat. I only talk to two people on Signal but I've asked both of them to message in the group chat that I've made. Now, I can answer chat messages on my nexus 5, nexus 6, and nexus 7. (I built the apk from source for the Nexus 7. I wouldn't recommend this if you actually want secrecy. I'm not doing anything confidential so I am not too worried about targeted attempts.)


What's stopping them from either providing a way to sync the key to other devices, or allow the device to register its own keys, and they just store a couple copies of the encrypted data?

It seems like there should be ways to do it without storing unencrypted data.


AFAIK Apple Message implements encryption and has independent clients. So I think the problem can be solved with some effort.


Each device has its own key. Before a message is sent, the client grabs all the keys for each device associated with the account of the recipient, it then encrypts the message separately for each device and sends a separate encrypted copy for each device.

This scheme has various weaknesses, eg. a rogue key could be associated with someone's account without their knowledge, and anyone who sends this person messages will therefore be sending a copy encrypted with the rogue key.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: