I think it's because they want to give both usability (history shared between devices) and security (E2E encryption). Not anybody or any kind of conversation need encryption, so you as the end user can choose what's more appropriate.

TBH I don't know how other secure messaging programs like Signal or Wire handle the multi-device history issue.

With signal each registered device will receive a copy of the chat while that device is registered. If a new device is enabled afaik it doesn't get sent any messages from the past, although technically the other devices could transmit previous messages.

From what I understood, each time a new device joins the conversation, a new key is generated for everyone in the conversation (and each devices), so they are allowed to decrypt others' messages. That being said, they can't access chat history.

Groups on Telegram can have 100k+ members. Enabling Signal like E2E encryption scheme and ensuring you can have that many members in a group is basically impossible. See this video to understand why, https://www.youtube.com/watch?v=Q0_lcKrUdWg

I guess they could enable E2E encryption in private messages but being able to sync conversation across different telegram clients you are logged into is one of the features. Enabling E2E encryption by default will probably break this. I guess they could try and implement it like Signal has done for Private messages but I don't know why they have not done that already.

It's about priorities. Signal's priority is security. If the current state of the art is you can chose security or foozles, then Signal doesn't have foozles. If people really want foozles then they need to do the work to figure out how to deliver foozles securely and then Signal can integrate that work.

All of the other products have some other priorities, and so if security gets in the way, too bad security loses. Even WhatsApp, which uses the Signal protocol, has other priorities so the actual client software isn't focused on security, they were just happy to get a secure protocol out of the box.

The interesting thing is that years of research hasn't found many things that are just plain impossible securely, there are just a lot of unknowns or places where the secure option is harder. For example when you add a popcorn GIF to a chat Signal proxies this twice, masking your request from the GIF provider (Somebody used a popcorn GIF but the GIF provider doesn't learn who) and also from Signal's own servers (ishanjain28 used a GIF but Signal doesn't learn which one). Most outfits wouldn't bother, who cares about security anyway? But the feature now just works, without unnecessarily giving away information to people you might not trust.

It's possibly because secret chats need to be started interactively (you can't send a message until the other party has come online), and later cannot be shared among different devices (open the same channel in desktop|web|mobile), so it degrades UX.

Signal has only e2e and is able to offer synced chat between phone and desktop - the phone just sends the content to the desktop instance and vice versa.

Nice.

I imagine multi-device sync and group chats would be a lot more complex with E2E encryption.

Works with Signal flawlessly.