Thanks for the blog post, now I finally have a good resource I can point people to next time they claim Telegramm is secure.
> I am not specifically calling out Telegram for this, since the same problem [with metadata] exists with virtually every other social media network and private messenger.
Notably, Signal offers a feature called Sealed Sender[0]. While it doesn't solve the metadata problem entirely, it does at least reduce it a bit.
Interesting, I feared Sealed Sender might be susceptible to statistical analysis (hence my phrasing "reduce it a bit") but it's worse than I expected ("Signal could link sealed sender users in as few as 5 message"). Thanks for the link!
As for TOR, that wouldn't really help much, would it, given that the described attack is at the application level of Signal. Or are you talking about not using Signal altogether?
This is part of what I love about Mastodon: if you PM someone, very often you're talking between two random servers and odds are good that the admin is a friend of a friend. No dragnet statistical analysis stuff, just friends running some software that normal people can also use. Distributed systems at their best
> I am not specifically calling out Telegram for this, since the same problem [with metadata] exists with virtually every other social media network and private messenger.
Notably, Signal offers a feature called Sealed Sender[0]. While it doesn't solve the metadata problem entirely, it does at least reduce it a bit.
[0]: https://signal.org/blog/sealed-sender/