- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
You must log in or register to comment.
[French media] said the investigation was focused on a lack of moderators on Telegram, and that police considered that this situation allowed criminal activity to go on undeterred on the messaging app.
Europe defending its citizens against the tech giants, I’m sure.
There’s a lot of really really dark shit on telegram that’s for sure, and it’s not like signal where they are just a provider. They do have control the content
So does Facebook and twatter
I don’t recall CP/gore being readily available on those platforms, it gets reported/removed pretty quickly.
I do but ok
Riiight
Edit: Is telegram really an encrypted messaging app (spoiler: no) get off your high horse defending exiled russian oligarchs in the name of encryption.
https://www.comparitech.com/blog/vpn-privacy/child-abuse-online-statistics/
Can’t claim how valid any of that info is but confirms my bias
A quick search will produce a lot reddit discussions on the topic too.
FFS we had Catholic clerky raping children and our clown society just said Mehh that’s just how things be for the peasants
Then clowns like you try to down play the issue so you can cope that your team is good 🤡
In your head in confirms what you want, because you’re biased. You just don’t know what “readily available” means. Can’t help you there. Your entire article makes my point…
The content on telegram is there almost indefinitely, and readily available. What youre sharing is almost instant bans, includes also reports to links of suspected activity, not the content directly.
https://thebrainbin.org/m/[email protected]/t/264641/Yemen-weapons-dealers-selling-machine-guns-on-X
You’re not using the right search terms?
Readily available means you don’t need to search. Y’all are on another level searching for this shit lmao.
You’re young. It really was a thing. It never stayed up long, and they found ways to make it essentially instantaneous, but there was a time it was easy to find very unpleasant things on Facebook, whether you wanted to or not. Gore in specific was easy to run across at one point. CP, it was more offers to sell it.
They fixed it, and it isn’t like that now, but it was a problem in the first year or two.
And there are still informal networks of Pedos and other pests operating on these platforms to this day.
Haha, young ? i wish. But go on making stuff up.
So now it’s not that it’s readily available, it’s that it was in the beginning. So everyone is allowed to let CP go in the first years of their platform? Is that what youre going with. Eww
The fuck are you smoking?
Damn, I hope there’s no upper limit to block lists
I guess he just wanna links
Removed by mod
If they similarly go unmoderated then action should be taken
Removed by mod
Telegram does moderation of political content they don’t like.
Also Telegram does have means to control whatever they want.
And sometimes they also hide certain content from select regions.
Thus - if they make such decisions, then apparently CP and such are in their interest. Maybe to collect information for blackmail by some special services (Durov went to France from Baku, and Azerbaijan is friendly with Israel, and Mossad is even suspected of being connected to Epstein operation), maybe just for profit.
Do you have any links/sources about this? I’m not saying you’re wrong, I’m just interested
No, but they do sometimes delete channels for gore and such. I remember a few Azeri channels being banned for this during/after 2020 war.
About having means - well, with server-side stored unencrypted everything it’s not a question.
About hiding channels per region by governmental requests - I’ve heard about that on Lemmy.
Where did you get that the data on the servers are not encrypted?
You are, ahem, not decrypting it when getting history and not encrypting it when uploading files. That should be sufficient.
Anyway, look at TG Desktop sources. They are crap, but in general it’s clear what happens there. At least that’s how I remember it.
Thank you, really appreciate it!
Removed by mod
Removed by mod
Why arrest him? Why not threaten to block the app in France or something like that?
And why only arrest him? Should the discord creators also be arrested for some shady channels? Should Elon Musk be arrested because twitter is the equivalent of fhe fifth circle of hell?
So they can make a very convincing case for a backdoor, in exchange for his release. And maybe some compensation for continued cooperation. Both come out winning and they get to claim nothing happened.
Government cyber security dealings as usual. or not. who knows?
It’s one of the most popular social media apps in Russia that is not banned or blocked. I would bet they already have a backdoor for the Russian police and intelligence agency…
That conspiracy theory is so dumb.
The government almost certainly doesn’t need a backdoor as telegram is almost completely unencrypted (only one-to-one channels can be but aren’t by default). The real (but more boring) conspiracy theory is that governments generally don’t mind Telegram because its willfully terrible security model allows them to keep an eye on terrorists and activists’ communications (I have a hard time believing that the NSA or even DGSE don’t have their own backdoors already).
However the EU does have laws mandating the moderation of said unencrypted messages, especially when it comes to CSAM, which Telegram is notoriously poorly moderated. It’s certainly reason enough to arrest and question this guy, at least until formal charges are brought or he walks free. Maybe there are additional political considerations, but there doesn’t have to be.
Also how would arresting this guy help with backdooring. He doesn’t have access to the source code. Whoever he calls to get that done is out of reach of the French police. He has no reason not to disable that backdoor as soon as he gets out of the EU. If he can be bought off he already has been (Crypto AG style except way lamer because no-one clever&important trusts Telegram), you don’t need to arrest someone to pay them. I’m no DSGSE bigwig but pressuring lower level engineers to backdoor their code seems like a 1000% more effective approach.
Clearest difference I can see is:
- people who act more in the interest of society and less in the interest of those in power get arrested
- people who help those in power tighten the leash on society (fuckerberg, muskrat, etc) get courted and don’t ever face consequences
In other words: A high profile person in tech being threatened with arrest / being arrested by western countries is a pretty good sign that they were not cooperating with our totalitarian overlords & providing us with ways to preserve our privacy.
And why only arrest him? Should the discord creators also be arrested for some shady channels? Should Elon Musk be arrested because twitter is the equivalent of fhe fifth circle of hell?
Stop asking question and go back to work
you’re right, I forgot about the shareholders!
Or those places actually do have measures in place to moderate the content. Seems simple enough
I don’t use Telegram because I don’t think it’s secure, but this is still bullshit.
Yea, no way I’m giving them my number
You don’t have to, you can use telegram with username only
You still need a phone number to sign up
What do you use?
Signal.
Removed by mod
There’s moderation per community and per server. There’s no “fediverse moderator”, of course, but I think you’re vaguely worrying for nothing.
I don’t think much of the fediverse is compliant with the DSA, including the rules on content moderation. I really doubt that any lemmy instance is. Can we really assume that no one will ever complain?
At some point the Fediverse is going to have to protect itself from Europe.
Would be horrible if they went after our child porn
I don’t mind when they genuinely do go after child porn. But I suppose I’m not as principled about freedom of speech as some others
There is always a tension between security, privacy, and convenience. With how the Internet works, there isn’t really a way - with current technology - of reliably catching content like that without violating everyone’s privacy.
Of course, there is also a lack of trust here (and there should be given the leaks about mass surveillance) that the ‘stop child porn powers’ would only be used for that and not simply used for whatever the powers that be wish to do with them.
If we let Fediverse become unmoderared and rife with child porn then I’d be fine with them coming after it, is all I’m saying.
It certainly is against the GDPR to federate with US instances. US law enforcement could get their hands on our data!
Unless you dox yourself what kind of personal information are instances sharing? On top of that stuff that isn’t due to the normal functioning of the site as a public message board?
What’s questionable is embedding images, lemm.ee mitigates that with proxying, but ultimately the web is the web and you can’t proxy the whole web. Clicking a link will still lead you somewhere else and if your browser pre-loads links then that’s up to you.
Unless you dox yourself what kind of personal information are instances sharing?
Don’t IP addresses get associated with posts?
Why would they? Serves no purpose.
I’ll quote the definition from the GDPR:
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Little of the information that instance share is not personal. Identifiable is also very broad. It’s enough that it would be possible for someone with the right tools and access to other information to identify you. EG Your ISP could be subpoenaed to reveal the customer behind a dynamic IP-address, making it a personal datum.
It’s an extremely broad definition. If it wasn’t, tracking cookies would not be a big deal unless you had the real name of someone connected to the cookie ID.
ultimately the web is the web and you can’t proxy the whole web. Clicking a link will still lead you somewhere else and if your browser pre-loads links then that’s up to you.
That’s exactly what my first reaction was. But the law sees it differently. No one is required to use an ad-blocker, VPN, or know anything about the internet. When you make a website or something, it is up to you to make sure that no one’s rights are violated. In fairness, if it was otherwise, tracking pixels would be fine.
We’re not at a point yet, where outgoing links must come with a warning, but it would be safer. Someone is always the first to lose a court over something. I noticed news media use rel=noreferrer. I think that’s the least one needs to do (“data minimization”).
Don’t expect me to defend the GDPR. It’s neoliberal/conservative bullshit; even an abandonment of enlightenment values. But it’s the law nevertheless and a lot of people on Lemmy positively love it.
Little of the information that instance share is not personal.
The only PII contained in that post you wrote is your user name. My instance has no idea what IP address or whatnot you used, it gets sent “user posted message”, “user voted”, etc. messages by lemmy.world. It does not interact with you.
The information that your instance shares with the rest of the world is a) pseudonymous, unless you dox yourself no connection can be made between your handle and your actual person and b) said information transfer is part of the primary service of the platform. You wouldn’t be here if things wouldn’t get shared that way, hence, you consented.
If it wasn’t, tracking cookies would not be a big deal unless you had the real name of someone connected to the cookie ID.
Cookies are no issue. Tracking without consent is. Lemmy isn’t tracking you. You have an account with lemmy.world. You presumably have taken notice of its privacy policy. lemmy.world is run by a Dutch foundation, and yes they have a legal department… or at least lawyers. If you’re a EU citizen the GDPR applies, otherwise other stuff might apply, they’re spelling it all out.
EG Your ISP could be subpoenaed to reveal the customer behind a dynamic IP-address, making it a personal datum.
…yes? You gave lemmy.world the right to log your IP when you signed up. They’re not retaining it longer than necessary because of the general GDPR provision of data frugality, but if a court order knocks on their door saying that they need your IP they can also be required to wait until you log in and then send that fresh IP directly to the authorities. Newsflash: The GDPR does not provide opsec against EU state actors. Off to the darknet with you if you care about that. It does provide opsec against ad networks, data brokers, etc… well at least in so far as it’s actually enforced.
Don’t expect me to defend the GDPR. It’s neoliberal/conservative bullshit; even an abandonment of enlightenment values.
The fuck are you on about.
The only PII contained in that post you wrote is your user name.
I think you have California law in mind here? I’ll boil down the GDPR’s definition of personal data for this particular case.
‘[P]ersonal data’ means any information relating to an identifiable natural person.
All the data that is associated with a user account relates to that user. All of it is personal data.
[A]n identifiable natural person is one who can be identified by reference to an identifier such as an online identifier
Now that I come to mention it, I think a static IP is a sufficient identifier in itself, without further recourse to ISP data.
lemmy.world is run by a Dutch foundation, and yes they have a legal department… or at least lawyers.
Indeed, it’s heart-warming to see how the legal section grows every time I check. Which is a problem, because I’m pretty sure they need to give everyone the option to decline or accept every time they change it. Well, maybe in another couple months or years, it will be somewhat in compliance with EU regulations.
You gave lemmy.world the right to log your IP when you signed up
The IP was simply an example that came from the court case I linked earlier. Oh, but not in this particular fork. https://www.techdirt.com/2022/02/07/german-court-fines-site-owner-sharing-user-data-with-google-to-access-web-fonts/
The fuck are you on about.
The enlightenment bit was too much? I see where you’re coming from. Well, you probably don’t want to read my rant.
All the data that is associated with a user account relates to that user. All of it is personal data.
Yes and it’s identifiable. That’s why I mentioned your online handle. You also not just consented, you tasked lemmy.world with broadcasting it all over the place. Complaining about that is like complaining about an email provider sending an email to a recipient.
That has nothing to do with the data transfer lemmy instances are doing among each other. Which was what you complained about. Yes, it’s personal data, yes, you consented. No, the GDPR has no issues with that. I could’ve been more clear in the beginning, let me ask again:
Which personal data do lemmy instances exchange that you did not consent them to share. That is not necessary for them to share to function as federated social network. That, in fact, isn’t available via the web interface. Exactly one thing comes to mind: Votes are identifiable and not everyone knows about that but there’s also a discussion going on.
You know what? Why am I even talking to you. If you have something to complain about, contact your data protection officer.
The enlightenment bit was too much?
Nope it already started at the neoliberal/conservative bits. Neoliberals would like to own all your data freely, privately, while conservatives would like the police to own all your data. Things like Chat Control come out of the neolib/conservative corner of the EU while data protection is a Pirate/Greens/EFA thing, with Socdems and Demsocs not minding it but not taking the initiative, either. Oh and there’s also some conservatives who are in favour because digital sovereignty and such.
You also not just consented, you tasked lemmy.world with broadcasting it all over the place.
Didn’t Meta try the same argument? I very much doubt this will work in court.
Under the GDPR, you need informed consent. That consent may only be for specific, limited purposes. A blanket permission for any broad purpose is not going to work. People know that their comments and posts will be read, so that’s fine. One should probably tell people that their posts will also be crawled and stored in various databases. That federation means that their personal data is actively sent to other instances and processed there, is not something your average person knows. To be legally above board, this should happen only under contract, with instances under the GDPR or equivalent, and only by informed consent.
Every once in a while, there are debates around federating with or blocking certain instances. In particular, federating with Meta’s Threads is a hot button issue. Clearly, a number of people explicitly do not consent to having their data sent to just anyone. I think they have the law on their side.
Complaining
I’m not complaining. I’m explaining the law. You asked, remember?
That has nothing to do with the data transfer lemmy instances are doing among each other.
I originally posted this with regard to embedding images. But it also shows you something else: Saying that something is simply the way the internet works just doesn’t hold up in court. In that case, the plaintiff could have configured their browser to not connect to google. But they explicitly don’t have to.
That, in fact, isn’t available via the web interface.
Good question. Why should it matter if the data is sent to other people, if those people could scrape the data just as easily. Common sense may be that it doesn’t matter. But you could equally well say: Why does it matter if I share copyrighted media, if people can already get pirated copies with ease?
Under what conditions, scraping is legal is mostly unanswered right now. But the legality of scraping does not directly affect the legality of data sharing for federation.
Neoliberals
Oh, I see. These terms are always a bit fuzzy.
Suppose we regulated food on the same principles. Manufacturers would have to print exactly what ingredients went into the food and what was done with them. Maybe they are also required to assess the impact of some ingredients or steps in the recipe. Then people can form their opinions on whether that is healthy or not; causes cancer or whatever. Nothing is banned outright, it’s just a matter of informed consent whether you eat something or not. To me, this is a neoliberal or libertarian approach.
The GDPR goes a step further by giving you rights over certain data, turning it into something similar to intellectual property. The dogma that we should turn everything into private property and leave it to the individual, and then a miracle happens, is to me libertarian or neoliberal. Suggest a better word if you have one.
Removed by mod
the GDPR regulates businesses,
The GDPR regulates everything and everyone, including individuals and non-profits. See Article 2. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
For example: If you keep a personal journal and write about your friends and acquaintances, that’s out of scope. [ETA: As long as the journal is private. When it’s shared outside the household, it is in scope and probably a violation.] But when the Jehovah’s Witnesses go door to door and make notes who opens etc, that’s in scope. [ETA: And has been ruled a violation by the ECJ.]
Depends if it’s encrypted
Telegram isn’t either. Certainly not by default, and definitely not public channels.
Telegram is encrypted, just not e2e.
Removed by mod
He is being charged with W R O N G T H I N K.
Hell yeah. I always hated Telegram, because of its countless false promises, misleading claims, bad encryption (which isn’t even enabled by default) and shady background.
That bad encryption was not cracked for now. The other one, that is used to process chats between 2 users in end to end mode, can’t be enabled by default because it assumes no history is kept and no support for group chats.
Also, the arrest doesn’t seem to be related to any of the things you mentioned. If anything it shows there are no ways for (certain) governments to affect the messenger, for now.
That bad encryption was not cracked for now
There is no encryption by default if you haven’t noticed. There only the pseudo-E2EE which has been proven to have critical weaknesses: https://eprint.iacr.org/2015/1177.pdf
can’t be enabled by default
Yes it can, every proper E2EE messenger works like that. Signal, Threema, hell even WhatsApp uses E2EE by default.
no support for group chats
Signal has had group chats for many years now. WhatsApp uses the same encryption protocol and it also works just fine. Stop spreading misinformation, and use Signal if you want an actual secure, end-to-end encrypted, open and transparent messenger.
has been proven to have critical weaknesses
Those are not critical, just some aspects being below some arbitrary expectational values. Also it seems there is still no proofs those vector attacks are being used at all.
Yes it can
They chose to target convenience over max security. Shoving strongest options to every user by default is agaiantt that. Reasons include: no history is being saved in this mode, and the desktop client doesn’t support it.
Signal has had group chats for many years now
Just because it was implemented by others doesn’t mean it’s a way to go for everyone. From what I understand, e2e in group chats means that there is going to be a transaction of keys between all members of the chat on adding any new member, and/or on new message, which excessively increases the burden on clients and servers in case of big active chats.
You can ask telegram to implement that, but you can’t blame it for keeping it behind some gates. Telegram got implemented e2e between 2 users before other messengers got it working in any form of group chats.
and use Signal
I’ll think about it if they ditch electron.
Also it seems there is still no proofs those vector attacks are being used at all.
Ah yes, definitely go with a messenger that has known vulnerabilities in its crappy encryption protocol, instead of one with an actual secure E2EE implementation.
no history is being saved in this mode
You can still make encrypted backups of encrypted messages, as can be seen on WhatsApp or Signal
and the desktop client doesn’t support it
I don’t know what you mean, both Signal and WhatsApp have managed to ship desktop clients with full E2EE support for years now. Only Telegram is too incompetent to do that.
Telegram got implemented e2e between 2 users before other messengers got it working in any form of group chats
Just stop lying. Telegram Secret Chats have been introduced in 2017, both Signal and WhatsApp have had E2EE (including for group chats!) for much longer. Signal has had (encrypted) group chats in 2014, back when it was called TextSecure: https://signal.org/blog/the-new-textsecure/ And WhatsApp followed in 2016.
I’ll think about it if they ditch electron.
Are you mad that Signal is focusing on privacy and security by improving their encryption protocol, instead of wasting time on some UI garbage? This shows your priorities really well. Keep using unencrypted Telegram, for the cool stickers and convenient cloud backup, and keep in mind that Telegram can read all of your messages, as well as hand them over to governments.
Ah yes, definitely go with a messenger that has known vulnerabilities in its crappy encryption protocol, instead of one with an actual secure E2EE implementation.
Feel free to go any way you want. I’m not asking you to use telegram.
You can still make encrypted backups
Spend time for that, and keep them where? Maybe also need a feature to sync them between mobile and desktop?
Only Telegram is too incompetent to do that.
Not an implementation issue but a trust issue.
Just stop lying. Telegram Secret Chats have been introduced in 2017
https://telegram.org/evolution see October 2013.
both Signal and WhatsApp have had E2EE (including for group chats!) for much longer.
Whatsapp had them inctorudec in 2016.
Are you mad that Signal is focusing on privacy and security by improving their encryption protocol, instead of wasting time on some UI garbage?
I’m perfectly fine with that. More apps using electron means less chance for my pc to run garbage applications on a regular basis.
keep in mind that Telegram can read all of your messages, as well as hand them over to governments.
Keep in mind that any person in your secret chats can read your message, copy or screenshot it and hand it to anyone else. Those people know much better if you’re doing anything sketchy (or something actually good but against their beliefs), than an app developer.
That bad encryption was not cracked for now.
There’s no need if you control the server.
End to end encryption was created specifically so that the server could not access the data.
So how many people use E2EE with Telegram?
And their ToS forbids alternative clients doing that. Say, using Pidgin with PGP or OTR. Since Pidgin plugins for TG and these exist, it’s not a limitation for me, but most people, again, don’t use Pidgin to chat in TG.
Alternate clients are blocked from using that functionality because they may include ability to capture data somewhere, for example taking a screenshot of a protected chat.
I meant normal E2EE, not TG’s “encrypted chats”.
And it’s not “that functionality”, it’s literally encoding messages into another layer over TG being forbidden.
There is no normal e2ee because there is no standard for implementation, especially when it comes to group chats with >2 people.
Stop pretending that Telegram cares about the security of their users, because they clearly aren’t, as can be seen in their shitty encryption protocol, and the fact that by default all messages are stored on their servers in plain text
So if an app doesn’t support e2ee all data is being saved in plain text suddenly. You prefer calling telegram shitty because you don’t care to actually learn what it uses. So it should be fair for me to call any other client shitty for other nonsense.
That’s right, but it’s not properly implemented in Telegram. https://eprint.iacr.org/2015/1177.pdf
You haven’t read the article or the summary from the comments, have you?
I don’t really know much about this topic even after reading the article. It does bother me however that there’s so many channels/server on Telegram full of spammers that seem to offer drugs and prostitution. It’s almost like those were the only things that exist in this world. Which is such a huge waste of a chat program.
Also who the hell listens to any of the nonsense influencers/politicians write in their heavily biased channels, seriously, I can’t find a sane reason to join those, yet strangely that seems to be the only reason the masses use this tool. It’s all just confusing.
deleted by creator
No.
I’ve been using it for 10 years. Back then, it just started out as a chat app with group support - just like Wahstapp, but free (yes, WA used to cost money) and way better than SMS.
My entire social circle switched to it, and has been using it ever since. Why? Because to this day, it’s easily the best chat app, feature wise. Literally every time WhatsApp or Signal or Threema add a shiny new feature, Telegram has already had it for a while.
Since Covid however, there is a huge stigma attached to it, and I do get why. It’s sad, really. I wish there was a 1:1 clone of Telegram’s chat features, minus the Channels (or whatever they are called).
With your analytical skills you should probably solve world problems and find cures for incurable diseases, don’t waste your time on us!
deleted by creator
deleted by creator
