for signal users this means the messages of course do exist on your phone, which will be the first thing these agencies seek to abscond with once youre detained as its infinitely more crackable in their hands.

as a casual reminder: The fifth amendment protects your speech, not your biometrics. do not use face or fingerprint to secure your phone. use a strong passphrase, and if in doubt, power down the phone (android) as this offers the greatest protection against offline bruteforce and sidechannel attacks used currently to exploit running processes in the phone.

My advice if you’re not on the level where three letter agencies are actively interested in your comings and goings:

- Use a strong pass phrase

- Enable biometrics so you don’t need to type that pass phrase 100 times per day

- Learn the shortcut to have your phone disable biometrics and require the pass phrase so you can use it when police is coming for you, you’re entering the immigration line in the airport etc. - on iPhone this is mashing the side button 5 times

> Learn the shortcut to have your phone disable biometrics and require the pass phrase

On my Pixel (Android), it's hold the power button for ~2 seconds then select Lockdown.

In case anyone with an Android is confused because they don't see the option: I believe that you have to explicitly enable the Lockdown option in Android's system settings before it shows up.

There are a couple of apps that will also lock down with a tap instantly. I'm sorry I forget the names though, but handy if you have it in hand and "open". I have been using iphone too long now to remember the names of the apps though. you can put a shortcut on every "page" of your android and tap it, it enforces locking the phone by passcode. so on most phones it would be a swipe and a tap, probably less than a 200 milliseconds if you practiced it.

On recent iPhones, the way to disable biometrics is to hold the side button and either volume button until a prompt appears, then tap cancel. Mashing the side button 5 times does not work.

Not sure how recent you're talking but I have an iPhone 11 Pro and I just tested pressing the side button 5 times and it takes me to the power off screen and prompts me for my password the same way that side button + volume does.

Apple's docs also say that pressing the side button 5 times still works.

> If you use the Emergency SOS shortcut, you need to enter your passcode to re-enable Touch ID, even if you don't complete a call to emergency services.

https://support.apple.com/en-us/HT208076

Pressing it five times starts the emergency SOS countdown (and requires the passcode next time) on my iPhone XS. Maybe you have the auto-calling disabled?

It doesn't on my 2nd Gen iPhone SE (2020). That said, anything that causes the "swipe to power off" screen to appear has the same affect, so essentially holding down the button for 5 seconds does the trick.

The side button 5 times thing is disabled by default, but can be enabled from Settings > Emergency SOS.

I just verified this on iOS 15.1 on an iPhone 12.

Works fine on my 11, my wifes 12, her backup SE gen 2 and my backup SE gen1.

Just tested all of them

I’m on an iPhone 13 and the latest iOS and it does work here. But so does your method…

But I guess yours is the “official” way to do it indeed:

https://www.imore.com/how-quickly-disable-face-id

If you _are_ at the level where TLAs are interested in you they will not give you a chance to mash that button. You will have a loaded gun pointed at your head out of nowhere and you will freeze. From experience.

Is that a story you mind sharing?

He got popped for pedophilia if I remember correctly.

Not sure why this is downvoted; you are right.

I use this app on my phone

https://f-droid.org/en/packages/com.wesaphzt.privatelock/

It locks the phone when a movement threshold is broken, and then requires the password instead of biometrics to unlock the phone.

So the snatch the phone when it is unlocked vector gets harder.

In most cases you are going to want to separately passphrase your messaging stuff so it is locked up when you are not using it. That makes every thing else a lot easier. For example, there is a Signal fork that supports such operation:

* https://github.com/mollyim/mollyim-android

So you're saying I should have to type a secure passcode every single time I want to read or send a message on my phone?

No thanks.

I think that it would stay unlocked for a time, possibly till you locked it. Possibly such an arraignment would be more practical for something offline like encrypted email.

A compromise would be to just save the messages to a passphrase. You could use a public key so that you would only need the passphrase to read the old messages. I haven't heard about anything that actually does this.

I just tried this an it does not work for iPhone is it only on a certain iOS? I am a bit behind on updates. Thanks

That's actually the old method for iPhone 7 and before. Now, you can activate emergency SOS by holding the power button and one of the volume buttons. Assuming you don't need to contact any emergency contacts or services, just cancel out of that and your passcode will be required to unlock.

https://support.apple.com/en-us/HT208076

Try: Hold "volume up" and "power" for 2 seconds

You'll feel a vibration, and biometric login will be disabled until you enter your passcode.

That did the trick thanks. But ultimately I’m behind on updates so my phone could probably be broken into trivial with the forensic tools available to most law enforcement. I’m going to update soon.

Don't have any family or friends, either. If you refuse to talk and invoke your rights the government will just threaten to hurt those you love until you break and give up your passwords. From experience.

I liked it in Wrath of Man where one guy is acting tough as fuck until they bring his girl into the room.

Also, if you can, if you are encrypting data, use a hidden volume inside the first - that way you can give the government the outer password and they'll be happy thinking they have everything.

Signal recently added 'disappearing messages' which lets you specify how long a chat you initiate remains before being deleted.

Not "recently". Disappearing messages have been there for at least 5 or 5 years.

Almost _all_ my Signal chats are on 1 week or 1 day disappearing settings. It helps to remind everyone to grab useful info out of the chat (for example, stick dinner plan times/dates/locations into a calendar) rather than hoping everybody on the chat remembers to delete messages intended to be ephemeral.

The "$person set disappearing messages to 5 minutes" has become shorthand for "juicy tidbit that's not to be repeated" amongst quite a few of my circl3es of friends. Even in face to face discussion, someone will occasionally say something like "bigiain has set disappearing messages to five minutes" as a joke/gag way of saying what used to be expressed as "Don't tell anyone, but..."

(I just looked it up, https://signal.org/blog/disappearing-messages/ from Oct 2016.)

Maybe it was only added recently on the desktop client.

Keep in mind that any time a message is on flash storage there might be a hidden copy kept for flash technical reasons. It is hard to get to (particularly if the disk is encrypted) but might still be accessible in some cases.

I think encrypted messengers should have a "completely off the record" mode that can easily be switched on and off. Such a mode would guarantee that your messages are never stored anywhere that might become permanent. When you switch it off then everything is wiped from memory. That might be a good time to ensure any keys associated with a forward secrecy scheme are wiped as well.

And a screenshot, or another camera, or a rooted phone can easily defeat that.

The analog hole ALWAYS exists. Pretending it doesnt is ridiculous.

> And a screenshot, or another camera, or a rooted phone can easily defeat that.

Not if the message has already been deleted. Auto-deleting messages are so the recipient doesn't have to delete them manually, not so the recipient can't possibly keep a copy.

Exactly this. Even more: Auto-deleting messages are also that the sender doesn't have to delete them manually. Most people do not understand this. I even had a discussion with an open source chat app implementer who insisted on not implementing disappearing messages because they couldn't be really enforced.

That's a different threat model, no messaging app is trying to protect the sender from the receiver. Disappearing messages are meant to protect two parties communicating with each other against a 3rd party who would eventually gain access to the device and its data.

Wickr has a "screenshot notification to sender" feature (which of course, can be worked around by taking a pic of the screen without Wickr knowing you've done it).

What made you think I was pretending it doesn't?

Also IOS has a panic button. Hit the main/screen button (on the right) five times really fast and faceid/touchid is disabled and passcode is required

Your statement on the 5th amendment is no longer accurate broadly, but the matter still has some cross-jurisdictional disagreement: https://americanlegalnews.com/biometrics-covered-by-fifth-am...

District courts don't make law. Magistrates working for those district courts even less so. The case this news article cites has no precedential value anywhere - not even within N.D.Cal. - and should not be relied upon.

IAAL but IANYL

Agreed. That decision is unlikely to be repeated by any appellate court. IMO, all the rulings on biometrics not being testimonial are constitutionally correct, even if that sucks. A lot of constitutional rulings suck.

The real solution is for a federal statute to require warrants.

> do not use face or fingerprint to secure your phone

but can't they force you to put your password in that case, instead of your finger?

In general, no.

The contents of your mind are protected because you must take an active part of disclose them. Of course, they can still order you to give them the password and stick you in jail for Contempt of Court charges if you don't.

Check out Habeas Data. It's a fascinating/horrifying book detailing much of this.

To err on the side of caution, it's best to make all your passcodes themselves an admission to a crime.

"Your honor, the state agrees to not prosecute on any information inferrable from the text of the password."

"Understood. The defendant's Fifth Amendment right to protection from self-incrimination is secured. As per the prior ruling, the defendant will remain in custody for contempt of court until such time as they divulge the necessary password to comply with the warrant."

I don't know why you're being downvoted. For a start, if it was a third party that had the passcode and refused to divulge it they can be held in jail until they release it, e.g. if your wife knows it. (There are many cases where people have been sentenced to years or decades in prison for not testifying)

If it is you not divulging your own passcode, then legally the judge can't give you contempt, but in reality they could give you contempt until you fought it through the appellate court. Contempt is a special type of thing - certainly here in Illinois you have no right to a jury trial on contempt charges. You're just fucked.

I believe judges can, in fact, hold a defendant for refusing to give up their own passwords, and that the contempt could be indefinite. This is a point of law that is not settled at the federal level yet, and at the state level it varies from jurisdiction to jurisdiction.

In one case, the appellate court at the federal level simply refused to hear the case that had been decided at the sate supreme court level.

https://www.reuters.com/business/legal/us-supreme-court-nixe...

They don't actually need your passphrase to unlock your phone - they just need somebody with the passphrase to unlock in for them. And if there's any doubt about who that is, then having that passphrase counts as testimonial; but if there's not - it might not count as testimonial.

Although there are apparently a whole bunch of legal details that matter here; courts have in some cases held that defendants can be forced to decrypt a device when the mere act of being able to decrypt it is itself a foregone conclusion.

(If you want to google a few of these cases, the all writs act is a decent keyword to include in the search).

The defendant never needs to divulge the passphrase - they simply need to provide a decrypted laptop.

We really should up our game on encryption, perhaps some kind of time-based crypto rotation that inherently self-destructs rendering the data unusable if you don't authenticate with it every so often. If you are physically unable to unlock a device you can't be compelled to do so.

My passwords are so obscene it's a crime to write them down.

great, so they'll just be able to hit you with lewd charges on top of everything else they are filing.

I think a fingerprint is easier to get if you’re not willing to cooperate. However, I think if they really, I mean really want your password, they will probably find a way to get it out of you. I think it also depends if it’s the local sheriff asking for your password or someone from the FBI while you’re tied up in a bunker somewhere in Nevada.

Apple should allow for 2 PWs, one the real PW, the other triggers a "self-destruct" mode.

Knowing that is possible law enforcement would then hesitate to ask.

using such a self-destruct mode would be a certain way getting yourself charged with destroying evidence/contempt of court/... though.

This would be difficult to prove. They would have to know for certain the evidence was on there to begin with. I don't see the prosecutor easily meeting their burden of proof on this charge.

This is how the statute is worded here in Illinois:

"A person obstructs justice when, with intent to prevent the apprehension or obstruct the prosecution or defense of any person, he or she knowingly commits any of the following acts: (1) Destroys, alters, conceals or disguises physical evidence."

Ugh. It's a vague law. I don't even know how they would prosecute that for virtual evidence held on a device that they didn't already have a view inside of.

i was under such duress that i was shaking so badly that i made typos in my 30 character password 10 times. the loss of evidence is not my fault as it is the people putting me under that duress. don't think it'll hold up though

No 5th Amendment protection? If you spoke the command / "password", would it matter?

FaceID can already prevent a device from unlocking if someone is sleeping. In theory devices could detect if they were being unlocked "under duress" by using biometrics to look at facial expressions, heartbeat, etc, and then wipe themselves. I don't know how practical in reality but perhaps it could be a feature you turn on in a sensitive environment.

How? They can physically overpower you and place the sensor against your finger, or in front of your eye and pry it open without your consent and gain access with 0 input from you. How do they similarly force you to type something that requires deliberate, repeated concrete actions on your part?

In my case they threatened to harm my wife if I didn't stop refusing. After my case is over I'll happily release the video tapes so you can see how this shit works.

Please do. Very few people realize just how bad things can get with law enforcement.

no. The 5th amendment has been read weirdly by the supreme court.

The fifth amendment doesn't protect either speech or biometrics. Nor does it protect passwords.

You are wrong. It protects passwords as speech, as they are testimonial, per many court rulings. It does not protect biometrics based on law that basically says the police can force you to give up your fingerprints for their records, so they can sure as fuck force your finger onto a reader.

(Oh and by the way, as I mentioned in the comment you replied to, the fifth amendment DOES NOT PROTECT SPEECH. That's the FIRST amendment. The FIFTH amendment protects AGAINST SELF-INCRIMINATION.)

> It protects passwords as speech, as they are testimonial, per many court rulings.

Not true.

https://www.reuters.com/business/legal/us-supreme-court-nixe... for example.

Can they force someone to LOOK at the phone? FaceID with attention check will need you to look before it opens.

Arguably, yes. That's why it's important to know the shortcut on iOS to render faceid inoperable until you give it the password - mash the power button five times fast!

Telegram is encrypted OVER THE WIRE and AT REST by default with strong encryption no matter what you do. It's E2EE if you select private chat with someone.

Lots of FUD out there there about Telegram not being encrypted that's just not true. There's nothing either side can to do send a message in clear text / unencrypted.

"Encrypted OVER THE WIRE and AT REST" means that telegram has easy and unfettered access to chat logs. So they can give it up to authorities. (I don't argue that they DO, just that they very much CAN).

This is proven by an extremely simple experiment: you log in on your new phone, enter password and instantly see all chats.

Another simple experiment points that chats are unlikely to be even encrypted at rest is that Telegram has an extremely fast server side message search. You log into a web client, half a second later you can type a search query and uncover chats from years ago.

It kinda depends on if images and videos are encrypted separately and only indexed at first.

How much data there are on your chats? 1 megabyte is around one thick book in plaintext.

AES-CBC as example method decrypts more than 2 gigabits per second with hardware opcodes (2012 processor), for example if we look this data https://www.bearssl.org/speed.html

It is impossible to say based on delay when searching plaintext on this level whether there is encryption.

Encryption over the wire and at rest is a basic expectancy of any web service today. They would meet that criteria just by using SSL and disk encryption on their servers. E2EE is a much stronger criteria.

> It's E2EE if you select private chat with someone. And its not E2EE if you fail to select private chat.

What this means is that any conversations where you do select E2EE are the ones the "authorities" will take interest in, even if only to the extent of metadata.

That's the fundamental problem with E2EE-by-exception, rather than by default. It calls attention to specific data, even if its not cleartext, rather than obscuring everything.

(how) does the telegram server prevent unencrypted content?

also curious - how does telegram support encryption for chatrooms without the parties being known in advance? or are those chats not encrypted?

Telegram only uses end to end encryption for secret chats. All other chats are only encrypted on the wire with Telegram's keys. Your comment was encrypted on the wire to HN but that's not going to do anything to keep it away from the FBI. The majority of all Telegram messages are only secured by Telegram's unwillingness to cave to outside pressure. It's in plaintext as far as they're concerned.

For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee? Does the former mean that telegram itself can read non-private-chat messages if it so chooses?

> For somebody who isn’t super cyprtography-savvy, what’s the difference between over the wire and e2ee?

E2EE: As long as it is correctly set up and no significant breakthroughs happens in math, nobody except the sender, the receiver can read the messages.

> Does the former mean that telegram itself can read non-private-chat messages if it so chooses?

Correct. They say they store messages encrypted and store keys and messages in different jurisdictions, effectively preventing themselves from abusing it or being coerced into giving it away, but this cannot be proven.

If your life depends on it, use Signal, otherwise use the one you prefer and can get your friends to use (preferably not WhatsApp though as it leaks all your connections to Facebook and uploads your data unencrypted to Google for indexing(!) if you enable backups.

Edited to remove ridiculously wrong statement, thanks kind SquishyPanda23 who pointed it out.

> nobody except the sender, the receiver and the service provider can read the messages

E2EE means the service provider cannot read the messages.

Only the sender and receiver can.

Thanks! I edited a whole lot and that came out ridiculously wrong! :-)

Haha, no problem. I do that a lot too :)

Forgot to upvote you yesterday, done now ;-)

Yeah, if you connect to https://facebook.com and use messenger, it's encrypted over the wire because you're using HTTPS (TLS). But it's not E2EE.

Pretty much. End to end uses the encryption keys of both _users_ to send. Over the wire has both sides use the platforms keys so the platform decrypts, stores in plain text, and sends it encrypted again to the other side. Over the wire is basically just HTTPS.

over the wire is when its encrypted during transmission between the User and Telegram's servers. HTTPS or SSL/TLS, etc. At Rest is when its encrypted in their DBs or hard drives, etc. Theoretically, Telegram can still read the contents if they wished to do so if they setup the appropriate code, or tools inbetween these steps.

E2EE means that the users exchange encryption keys, and they encrypt the data at the client, so that only the other client can decrypt it. Meaning Telegram can never inspect the data if they wanted to.

I very much doubt that Telegram really does encrypt messages "at rest": their server side full text search works extremely fast.

That's a fair assessment, I didn't make the original claim, just answered the definitions of the encryption states.

I haven't dug enough to know what telegram does or claims to do.

yes. worth remembering also that even with e2ee, a ad-tech-driven company could have endpoints determine marketing segments based on content of conversations ad report those to the company to better target ad spend.

Also, as is the case with WhatsApp, they siphon off your metdata and even have the gall to make an agreement with Google to download message content unencrypted to Google when one enable backups.

are you trolling? telegram (are therefore the fbi) has full access to all content of every message. unless you use private chat, which nobody does, and isn't even available on desktop. i use it. but it's about as private as discord. which is to say not at all

> the FBI's ability to legally access secure content

Maybe there are laws preventing legal access to message content? Maybe related to wherever Telegram is incorporated.

> Maybe there are laws preventing legal access to message content?

Well sure. A lot of laws require a court order. In the U.S. that's usually not too difficult.

It helps Telegram is HQ'd in the UK and the operational center is in Dubai.

Does it? UK and Dubai are USA partners in Intelligence gathering and work together several times.

Biggest example as of late: https://www.bbc.com/news/world-middle-east-58558690

I don't know whether Telegram is E2EE by default (probably not.) When you do a call on telegram you are given a series of emoji and they are supposed to match what the person on the other side has, and that's supposed to indicate E2EE for that call.

Verification in band seems pretty meaningless, approaching security theatre.

For voice? It's hard to fake the voice of someone you know.

you don't have to fake the voice, just mitm and record cleartext

But they have to fake the voice, if I call the other person and say "my emoji sequence is this, this and that" for the other person to verify and vice-versa.

Person A calls you. I intercept the call, so person A is calling me, and then I call you (spoofing so I look like Person A). When you pick up, I pick up, then I transmit what you're saying to Person A (and vice versa).

How do you know I'm intercepting the transmission? Does the emoji sequence verify the call, perhaps?

The emoji sequence is a hash of the secret key values generated as part of a modified/extended version of the Diffie-Hellman key exchange. The emoji sequence is generated and displayed independently on both devices before the final necessary key exchange message is transmitted over the wire, so a man-in-the-middle has no way of modifying messages in flight to ensure that both parties end up generating the same emoji sequence.

I'm not a cryptographer, but that's what I glean from their explanation: https://core.telegram.org/api/end-to-end/video-calls#key-ver...

The emoji sequence represents the secret key exchange between you and the other party. If you intercept the call, you are making one key exchange with person A, and another key exchange with person B. Due to the mathematics involved, there is no way for you to force both key exchanges to yield the same result.

For a "standard" DH key exchange it would be possible to brute force the emoji sequence to be the same (since it's too short to be resistant to brute forcing), but the protocol that Telegram uses specifically defends against that by having both sides commit to their share of the key ahead of time, so they cannot try different numbers.

https://core.telegram.org/api/end-to-end/video-calls#key-ver...

So person A and person B are going to see different emojis no matter what you do. To fake a phone verification while performing a main-in-the-middle attack you'd also have to fake their voices to each other. That's hard.

Both connections would show different emojis on both sides then. So you would need to somehow deep fake the voice of the one telling their emojis to the other one.

If i'm talking to a person I know in person, I'd recognise their voice.

Real privacy is too burdensome for most users, so they feel just fine if the service owner promises in a stern voice that their chats are really secure.

It is not necessary to provide real security, do fingerprint verification, etc if the users are already happy with the level of security they are promised.

The emoji comparison thing is mathematically solid. Assuming the clients aren't backdoored (and the Telegram client is open source, so that's not that easy), there is no way for an attacker to make both sides show the same emoji. If they want to convince two users that they have en E2EE connection while performing a man in the middle attack, they'd have to fake their voices to each other to change what emoji sequence they each read out. That's hard, and therefore this is real, meaningful privacy.

Telegram can potentially perform mitm at any time and generate matching emoji images for both sides of conversation, since you can't really trust the app code to be the same they put on GitHub. If you've built it yourself, that'd reduce the risk, but nobody does that because blind trust is much more easy.

This is true, and IMHO somewhere that App-Stores could potentially assist in building trust for OSS Apps being distributed.

What I'm envisioning is a 'build hash' that is reproducible based on the public source code with a given set of compiler settings (i.e. same used for publish.) The systems app-management widget could then display this build hash in the app-check menu.

This would likely require more care in packaging, as well as some form of secure config API that allows companies to provide certain bits of configuration (i.e. remote servers to contact) without impacting the build output. This would mean that yes, people would still need to audit the code, but at least it's easy for anyone to canary out to the internet that the hashes are mismatching, same for when someone does find something on an audit.

OTOH, I'm sure Telegram's competitors in the chat space would love a reason to de-legitimize them, so it wouldn't surprise me if -someone- out there was already doing some sort of compare on published builds.

It is not, by default, and none of the group chats are.

This chart is showing what messaging providers are willing to give to law enforcement, not a reflection of the technical capabilities of the messaging provider.

I assume what they're showing for Telegram (basically no data except IP/phone data if Telegram decides it's for a legit counter-terrorism activity) is a matter of Telegram business policy.

Signal gives the limited information they do because I assume they are subject to warrants from U.S. courts. Telegram is run, to my understanding, from jurisdictions where enforcing a U.S. court order would be difficult-to-impossible, and they keep the private keys to decrypt their stored message content split between servers in relatively non-overlapping legal jurisdictions, so even a successful seizure of data in one wouldn't be enough to decrypt message content.

That's all well and good -- and I appreciate Telegram for setting things up that way -- but that means at any time Telegram could make a policy decision to cooperate with law enforcement and provide much more than what is shown on this chart. Signal, on the other hand, could choose to cooperate as much as they want but not have the technical capability to provide more information. (Barring them updating their client to intentionally build in a backdoor, etc., but I'm basing this on what the current implementation is.)

The other important thing about this chart: this is the unclassified version. Is there another classified document out there which says "we have a secret relationship with Telegram/whomever and they give us all the message content we want" but they don't advertise to the law enforcement community at large? They secretly use it to aid in parallel construction so they don't ever have to reveal that a messaging vendor is giving them message content in court? We have no idea.

tl;dr: Telegram looks great on this chart because of policy, not technology. I love Telegram, but I'm under no illusions that it's appropriate for talking about things I wouldn't want law enforcement to have access to. Luckily, I haven't found myself needing to talk to my friends about illegal activity.

>Telegram looks great on this chart because of policy, not technology.

This is what puzzles me about Apple, they absolutely have the capability to mitm iMessage pretty discreetly. Because Apple just completely hand waves away key distribution and they can silently add and remove keys at their leisure it's largely only policy that underpins their security. They're not Telegram, they aren't structured to be in a position to be able to ignore demands from the justice system to assist with some agent's latest fishing expidition. How are they getting away with not providing stuff that they obviously have access to? The PDF lists "Pen Register: no capability"

TLDR: Telegram depends on trusting Telegram. Signal is trustless.

Telegram isn’t E2EE by default.

My bet is on the fact that they are based in Russia, so they don’t give a shit about a US warrant or subpoena.

Telegram isn't based in Russia (anymore). The company is incorporated in Dubai since 2017 [0]. They opposed Russian warrants in the past, resulting in the blocking of the app in the territory for some time [1].

[0] https://www.bloomberg.com/news/articles/2017-12-12/cryptic-r... [1] https://en.wikipedia.org/wiki/Blocking_Telegram_in_Russia

That is correct. By default all messages sent over Telegram are stored permanently in their servers unencrypted.

Not exactly. Non-secret chats are stored encrypted on Telegram's servers, and separately from keys. The goal seems to be to require multiple jurisdictions to issue a court order before data can be decrypted.

https://telegram.org/privacy#3-3-1-cloud-chats https://telegram.org/faq#q-do-you-process-data-requests

"Not exactly" means "completely incorrect" now?

Telegram doesn't store your messages forever and they are encrypted and seizing the servers won't allow you to decrypt them unless you also seize the correct servers from another country

Of course they store your messages forever... They've kept all of my messages for over 7 years now.

If you really think that kind of shit will float...

Source for Telegram storing the information unencrypted at rest?

It is widely known and confirmed by Telegram themselves that your messages are encrypted at rest by keys they possess.

This is a similar process to what Dropbox, iCloud, Google Drive, and Facebook Messenger do. Your files with cloud services aren’t stored unencrypted on a hard drive - they’re encrypted, with the keys kept somewhere else by the cloud provider. This way somebody can’t walk out with a rack and access user data.

How do they provide near-instant full text search on server side if the chats are "encrypted at rest"?

Encrypted at rest means the data is encrypted as stored on disk, not that they do not have access to the keys. That would be end-to-end encryption.

What Telegram claims to have done is set this up in a way that makes it very hard for a single party/state to get these keys. It's not possible to make this completely impossible (if you have a server processing user data, it will have the keys loaded at some point, and there is always some way to physically attack it), but it is possible to make it very hard (physical tamper detection on the servers, secure boot tied to machine identity credentials required to access key material, etc - it's hard, but not impossible, to make this too difficult for any nation state to bypass). We don't know how good their set-up is, but it's certainly possible to do a good job at doing what they claim to be doing.

It doesn't matter at all, if you consider the risks of FBI (or FSB) accessing your chat logs. Telegram can produce your unencrypted chats to them, wether they are encrypted at rest or not.

I just don't see why they would make life harder for themselves developing stuff, given how often Durov lies. He claimed that all Telegram developers are outside of Russia, but then it turned out that they were working next floor from his old VK company office, right in Saint Petersburg.