Telegram does have end-to-end encrypted one-on-one chats, I suppose this document refers to that.

Telegram group chats are very much available to law enforcement if they can convince Telegram to hand over the data.

It could also be that Telegram (and any other foreign chat company) is more reluctant to (and more difficult to force to) share data with the FBI.

Upvoted. Some more details FWIW:

> Telegram group chats are very much available to law enforcement if they can convince Telegram to hand over the data.

Telegram public channels and groups are open, including for law enforcement. They also say openly that they cooperate with everyone to take down certain illegal material from channels and open groups.

Telegram claimed as late as a few months ago - and nobody has proven otherwise in any form as far as I can see - that not a byte of their users private data (i.e. not on open groups or channels) have been handed over to any government.

I cannot prove this and also I'm getting more careful with Telegram these days (this might come as a surprise for some of you who know my history of defending Telegram) but I still think

1. if it was possibly to prove something else there are enough Telegram haters just on HN to make sure to leak it

2. just to be clear I still think it is a very good alternative for friend-to-friend-communication, group communication etc, I'm just looking for alternatives as I go forward, and also I am worried when I see police using it at work.

Don't get me wrong, I use Telegram every day despite their flaws. Their data security guarantees may be terrible, but their user experience is still outstanding. It's a testament to how good a chat ecosystem can be if you don't rely on Electron.

I have no reason to distrust the Telegram team, but the data model is simply not designed to keep messages secret. It's Telegram's biggest shortcoming, in my opinion. Things like channels don't need encryption, but group chats can use some WhatsApp-style crypto.

WhatsApp's UX (basically: trust all E2E keys, and show a little notification if the keys changed) makes E2E available to the common smartphone user without the hassle of say Matrix's manual verification. For those with a more security-oriented mindset, there's always the ability to show encryption status changes so you could investigate.

I'll probably be using Telegram for a few years despite its shortcomings. It feels a bit iffy to talk about sensitive personal matters through Telegram, but I know it'll be a while before I can convince any large group of friends to move to something more secure.

For now I'm bridging my Telegram accounts through Matrix, so it's not like I'd benefit much from the added security anyway.

> They also say openly that they cooperate with everyone to take down certain illegal material from channels and open groups.

Can you provide a link for that? I could only find that they'd hand over your personal account info if they get a court order claiming that you're a terror suspect (from https://telegram.org/privacy):

> 8.3. Law Enforcement Authorities

> If Telegram receives a court order that confirms you're a terror suspect, we may disclose your IP address and phone number to the relevant authorities. So far, this has never happened. When it does, we will include it in a semiannual transparency report published at: https://t.me/transparency.

> Can you provide a link for that? I could only find that they'd hand over your personal account info if they get a court order claiming that you're a terror suspect (from https://telegram.org/privacy):

Maybe I can:

First a note: "your personal account info" while somewhat correct makes it sound broader than what the paragraph below says: "your IP address and phone number".

That said, here is one that that at least partially confirms this:

From https://money.cnn.com/2015/11/18/technology/telegram-isis-sh... :

> "Our mission is to provide a secure means of communication that works everywhere on the planet. In order to do that...we have to process legitimate requests to take down illegal public content (sticker sets, bots, and channels) within the app."

(emphasis mine)

There seems to be more in the search results here (if you have access to kagi, if not apply now:)

https://kagi.com/search?q=telegram+takes+down+isis+groups+

Edit: here's another link from the first page of results in kagi: https://www.forbes.com/sites/parmyolson/2015/11/19/telegram-...

Another after I added "cooperate" to my query: https://www.europol.europa.eu/media-press/newsroom/news/euro...

As I recall, even one on one chats are not e2e encrypted unless you explicitly start a "secret chat". Please correct me if I'm mistaken.

You're right! Despite their weird custom protocol, their E2E chats are still considered completely safe to use.

In my experience, though, very few people use E2E chats, even in direct chats.

As someone who regularly defend Telegram against all kinds of nonsense: you got it exactly right : )

>if they can convince Telegram to hand over the data.

Or if they hack Telegram's servers. Or ask some other agency like the NSA (that hacks systems all the time) to do that for them.

As for the legal aspects, I'm fairly sure Telegram can be made to comply, no individual user's is worth losing (tens/hundreds of) millions of customers in that particular country. It's not like Telegram can't do that technically*, the server-side database encryption key is by definition in the RAM of the server system.

* That hasn't prevented them from actively misleading customers with their split-key-and store-parts-under-multiple-jurisdictions -scheme.

> Or if they hack Telegram's servers

Or they join the group chat

Sure, that works for public groups but generally the private group chats with sensitive private information about peoples' personal/business life are not public.

I’m curious how you think the US law enforcement agencies would compel Telegram to comply.

Why are group chats more exposed?

Encrypting messages for one person to read is relatively simple. Encrypting a message so that it can be read by multiple parties requires either sending multiple messages or agreeing a stable shared secret for the group chat. If you want to add/drop people from group seamlessly, while keeping everything encrypted, your app or your users will have to jump through lots of hoops. Most don't make the effort.

It's also the case doing that securely required pushing the boundaries of modern cryptographic protocols. Telegram's protocol graphs are novices' doodles compared to Signal's group encryption stuff formally described here: https://signal.org/blog/pdfs/signal_private_group_system.pdf

On the other hand Signal has made a lot of questionable choices (such as adding a crypto payment that was just a money grab) that it has made me lost trust in the team and their motives. I no longer trust their build images and even if you build your own you have no idea what software the person you're talking to is running.

Sure, you do you. Personally I haven't seen anyone in e.g. the major infosec expert bubble abandon Signal for introducing mobilecoin. It's an opt-in feature, it doesn't make the message side security code harder to audit, and it's not like Moxie isn't painstakingly engineering everything to be secure from the get-go. I haven't once been disappointed in a new feature. OTOH consider Telegram that adds group video calls that nobody asked for: is it E2EE? Nope. Another security disparity to make explaining and understanding its security even more nightmarish.

Doesn't matter if signal is secure if nobody uses it. None of my friends are willing to use it because of the lack of features and horrible ui/ux.

The surface area for trust is expanded significantly.

Here in Puerto Rico we made our governor quit over exposed chat logs from a Telegram group. Encryption wouldn’t have saved it: someone took screenshots and leaked them to press.

In the new update, group admins can prevent forwarding and screenshotting. Unless the devices are "rooted"

There’s always going to be a degree of trust. Just take a picture of the chat with another phone.

The document is about what can be easily requested from companies, not what can be hacked. Because telegram hosts no servers in the US they can't trivially request it. They can get it other ways and of course by hacking. But the document isn't about what they can successfully hack or request through back channels. This is why people say that you have to trust Telegram, as opposed to fully E2EE systems (like Signal) which require (almost) zero trust.

It is because you and others got your facts wrong.

Telegram is not unencrypted. This is a lie spread by certain WhatsApp and Signal fanboys (not all, count me in with the Signal fans - I just happen to be a reasonable one that to some degree know what I'm talking about) with the excuse that "of course we mean end-to-end-encrypted when we say encrypted".

What we see now is the resulting confusion: why don't law enforcement have access to it if it virtually unencrypted? Well, the answer is despite all claims of how lousy the encryption is for some weird reason[1] it doesn't seem to leak data.

Now that we have seen the confusion that stems from saying "encrypted means end-to-end-encrypted when we say it does", can we stop repeating that nonsense?

Also, can we think twice before mindlessly repeating such stuff in the future even if it was originally said by some extremely smart people that are well respected for good reasons?

Because those very smart people were the same who recommended WhatsApp for a long time until it became painfully clear to everyone that:

- WhatsApp leaks metadata to Facebook which cooperates happily with basically any government as far as I understand

- WhatsApp has uploaded unencrypted backups to Google Cloud (yes, probably over https, but Google got all you messages and it was known that they would datamine it.)

- and more¨

PS: Some time around half a year before Telegram launched WhatsApp actually sent data unencrypted, i.e. as plaintext. And they sent it over port 443..!

PPS: Stay safe folks, opsec is probably more important than the exact messenger you use. My bets today are Signal in the short run and Matrix as soon as possible, but personally I send photos to my parents using Telegram and receive a lot more info back from various groups.

[1]: Meaning either this is a bigger honeypot than An0m and everyone Three Letter Agency including both FSB and NSA are in on it or Telegram actually got something right. Or they have just been extremely lucky for 9 years in a row or something.

Telegram, as a capability, does not do “end-to-end encryption” for one-on-one chat.

And Telegram most certainly cannot encrypt group chat.

I does have, it is well known and it has existed for years.

The remaining criticism now is that the default for one-on-one chats is still the more convenient normal point-to-point-encrypted chat type instead of E2E-encrypted (which, in Telegrams implementation is less convenient since it doesn't sync between clients, which again is reasonably for those messages where one really cares about secrecy in the context of day-to-day messaging apps).

As usual: I only observe this from the outside. For what I know maybe Putin reads my messages before he goes to bed every night to fall asleep because I mostly use ordinary point-to-point encrypted messages which can be intercepted if Telegram is a secret FSB front or if Telegram isn't careful. Note however that for all we know maybe Biden reads my mail too to fall asleep since that too isn't end-to-end encrypted.

I only comment on observable facts or statements that haven't been debunked. The last means I haven't verified the crypto of any app, I take it for granted that if it is broken someone will figure out just like when WhatsApp sent plaintext messages over port 443, and even faster with Telegram since there are so many who wants to find flaws in it.

I take it that you don’t do much Radare2, much less IDA-Pro.

Thats correct.

If you have and you have real proofs, bring them and I'll probably repent.

If one were to have real proof, then would they not hold them out for a paying customer?

In light of that hypothetical but far-fetched pathway, there is probably no need for you to repent there.

I think we are talking past each other.

With WhatsApp the claim was that if someone snuck a backdoor into it there are enough people watching it to make sure that it would be found out soon.

My point is that even more people are sceptical to Telegram and even dislike it strongly so there should be even better chances of someone discovering if something was broken.

The colored highlighting of the code regions in Telegram executable by IDA-Pro has left me skeptical.

If you are still here, what do these regions and the fact that they are colored mean?

I'm honestly interested.

I only intend to defend Telegram against lies (most of the time the claim that "it is not encrypted"), not to cover up any actual problems so if you comment on it or write a post about it I will read it and probably will upvote it.

It's encrypted but not e2e encrypted. Why would you say that it is virtually public? Do you think you or the FBI can easily access Telegram messages?

Because telegram can access the messages. If the vendor can access the message data (eg: not end to end encrypted), anyone can. That is the bar. E2E||GTFO.

Just join a group chat. Every message that was ever sent in that chat will be immediately visible. So yeah, it's virtually public.

Even your private messages only require you to enter an SMS code to view, so anyone that can intercept an SMS sent to you, can read your messages.

>So yeah, it's virtually public.

Let's stop saying that as it implies users are somehow aware the service provider has access to the content, and that they make an informed decisions wrt their privacy.

>Even your private messages only require you to enter an SMS code to view, so anyone that can intercept an SMS sent to you, can read your messages.

The 2FA password is something everyone should enable. It's still an incremental security improvement if you have to use Telegram and your threatmodel is a banana dictatorship doing SMS interception but not server-side hacking.

The right thing to do is get yourself and your loved ones the hell out of Telegram as soon as possible; Signal is your best bet here. Cwtch/Briar if you need to also protect metadata.

> The right thing to do is get yourself and your loved ones the hell out of Telegram as soon as possible; Signal is your best bet here. Cwtch/Briar if you need to also protect metadata.

No, this is not the right move. It's engaging with the ecosystem of messaging products balancing ease of use, ethics of the business and people behind it, and your own threat profile. Most will never be under threat of a state actor that necessitates getting their friends and family "the hell out of Telegram as soon as possible".

I also use Matrix but personally speaking I find Moxie Marlinspike a deeply unethical person who will gleefully slander the competition including up to suing them in his quest for supremacy. So I don't touch Signal because on my tripod of interests to balance, I don't want to go anywhere near his ethics.

Use Signal or Session or Element or Telegram but stop telling people not to use a thing because you believe E2EE is the next Jesus Christ. Only sith deal in absolutes.

E2E||GTFO. Anything else is tyranny. I don’t think you understand your adversary. Moxie is the most ethical individual in this space. Get the hell out of telegram, and get your other friends to do so asap.

> E2E||GTFO

Please don't do that here. It's both personally insulting and a motto used by fanatics, not an argument for anything.

Who is "my adversary" exactly and what do they want with me?

No, I don't think Moxie's past and current behavior is indicative of a person who subscribes to ethics. I think he's vain, eager to be in the spotlight and eager to profit off a cryptocurrency invented by a company he has a very complicated history with [1].

[1] https://www.coindesk.com/tech/2021/04/09/signal-founder-may-...

"Who is "my adversary" exactly and what do they want with me?"

He will extort money from you based on your private message history, when they eventually leak from Telegram's effectively plaintext database.

>I think he's vain, eager to be in the spotlight and eager to profit off a cryptocurrency

That says more about you than about Moxie. You've shown your character, now strongly consider showing yourself out.

> That says more about you than about Moxie. You've shown your character, now strongly consider showing yourself out.

I'm sorry, what? Do you want to explain how giving evidence of Moxie acting poorly is a reflection of me? Or why you're now personally attacking me?

I didn't do any such thing to you, please kindly treat me with respect.

Your adversary wants the clear text of your messages. The clear text exists on server, or they exist on a client device. Client device is the only acceptable solution. Make it hard for them, they must hack your client, rather than send an email. It IS an argument against snake oil, server side “encryption”.

Sorry, this is a hacker board. I, and others hackers, agree with me. E2E||GTFO.

> Most will never be under threat of a state actor that necessitates getting their friends and family "the hell out of Telegram as soon as possible".

I think you should qualify that as "most people - in the western hemisphere/democracies - will never be under threat of a state actor that necessitates getting their friends and family "the hell out of Telegram as soon as possible"

>Most will never be under threat of a state actor that necessitates getting their friends and family "the hell out of Telegram as soon as possible".

This isn't just about nation states. Companies get hacked by common criminals all the time. Consider the case of the Finnish psychotherapy center Vastaamo https://www.wired.com/story/vastaamo-psychotherapy-patients-...

Now imagine all the private messages you've shared to your SO or dearest friends. I bet there's gazillion times more stuff to extort you with for the rest of your life, than the notes about few sessions with your therapist, have.

So yeah, get the hell out of all "private" messaging platforms that aren't E2EE by default. You deserve the peace of mind of never having to feel like the TENS OF THOUSANDS of Vastaamo case victims.

>but stop telling people not to use a thing because you believe E2EE is the next Jesus Christ

Stop telling people to ignore best practices wrt security just because they cause your privileged life -- where you don't have to worry about actual oppression -- slight inconvenience. There's a good reason majority of top vendors for secure comms like Signal, Jitsi, Wire, Element, iMessage, Threema, Briar, Cwtch all default to E2EE.

Telegram is free to not E2EE, but they should be UPFRONT about it. Not say things like "heavily encrypted" when in reality it uses the messaging industry's bare minimum, that is client-server encryption.

Telegram devs also actively mislead by presenting two facts next to each other "Telegram uses E2EE called MTProto" and "All Telegram chats use MTProto". What a novice can't understand is "Telegram also makes the idiotic choice to call its non-E2EE cloud messaging protocol ALSO MTProto."

So it's not wonder why a LOT of my contacts have been flabbergasted to learn Telegram isn't actually using E2EE for everything like WhatsApp. Telegram's marketing had succeeded in telling them it was more secure than WhatsApp, and thus E2EE.

Whether or not this misconception was intentional, it's now Telegram's job to either make a public statement and correct the record, or preferably, make it E2EE:

There is no reason for Telegram to deploy E2EE for everything except supergroups. If all the other vendors can pull that off, so can they. Pavel Durov has so much money but the only cryptographer he ever hired was his brother Nikolai who isn't even a cryptographer but a geometrician. Durov has the money to hire Moxie for a year to deploy Signal protocol, yet he won't. You should be terrified of both why he won't, and what his foolishness in the context of Vastaamo can, and eventually will do.

I assume they are referring to telegram "secret chats"? Also their own website notes all chats are "encrypted" by default. It's simply that by default they are not "end-to-end" encrypted unless you use secret chats for instance.

Telegram is not based in any jurisdiction collaborating with the FBI. I'm assuming the KGB has free access

That is the thousand dollar question. How would we know Telegram isn't an FSB front

* The CEO isn't a developer

* We know practically nothing about their developers, they're all anonymous

* The server has access to overwhelming majority of messages (among fellow CS students only ~10% said they use secret chats, and most likely even they don't do that for every 1:1 chat. Furthermore, groups can not be E2EE at all, and neither can Win/Linux desktop chats)

* Journalists that went to see Telegram's offices at Dubai found an empty office, and their office neighbors said they've never seen Telegram developers let alone anyone enter the offices https://www.youtube.com/watch?v=Pg8mWJUM7x4 They did speculate Telegram might be using Dubai for tax evasion.

* That being said, we know absolutely nothing about Telegram's financials, nothing official has ever been reported by the company. Yet the system manages to stay afloat year after year with 600M+ users.

I'd love to be able to give good reasons why Telegram can't possibly be an op, but hand-waved opt-in E2EE for some clients, is the only one I can find, and that encryption has been most effective in online debates defending Telegram's bad security model.

> How would we know Telegram isn't an FSB front

As a Canadian talking to Canadians in Canada, I hope it’s an FSB front. They seem like my most secure option.

If you think like that, you might as well use Chinese messengers. You know the state has access, but they probably don't care about you, and you can be pretty sure that western agencies don't have built-in access.

> If you think like that, you might as well use Chinese messengers.

True, but I don't really "get" Chinese style UI.

As a Canadian, I think the Chinese have more interest in me than Russia.

It isn't "the KGB" anymore. In Russia it is now "the FSB". There are other KGBs in other countries such as Belarus but these aren't the KGB. (KGB is Russian for "Committee for State Security".)

https://en.wikipedia.org/wiki/State_Security_Committee_of_th...

"Along with its counterparts in Transnistria and South Ossetia,[1] it is one of the few intelligence agencies that kept the Russian name "KGB" after the dissolution of the Soviet Union, albeit it is lost in translation when written in Belarusian (becoming KDB rather than KGB)."

Thanks for the correction. The point stands.

Telegram moved out of Russia precisely so they wouldn't be under their influence, so that's wild speculation. If the argument is that the KGB (or is it FSB now?) might go and just put a gun to their head: they could do that to literally anyone anywhere, so it doesn't matter.

Telegram was in Berlin for a while but moved out of Germany for privacy/legal reasons as well (good call, considering that Germany is discussing trying to outlaw them) and moved to Dubai iirc.

>Telegram moved out of Russia precisely so they wouldn't be under their influence

Yes, because if you're an FSB operation, the rule #1 is to operate from Russia, that way nobody suspects you.

>moved to Dubai

Yet journalists who went there only found an empty office https://www.youtube.com/watch?v=Pg8mWJUM7x4

Telegram is influenced by FB of Russian VK (something like that). And VK has KGB tights. This is from Ukraine activists point of view just FYI. So your choices is Signal or Wire. Signal sever is in US, and Wire may or may not be in US. So there you go.

The grandparent comment was already hearsay but yours really scrapes the bottom of the barrel. Durov was forced out of VK on threat of violence: there are no ties to VK.

No, there are ties, even though Durov was forced out. Durov sold his VK stake to a Russian oligarch with extensive government ties, such that they now control the majority of the company.

https://www.reuters.com/article/russia-vkontakte-idUSL5N0KY3...

You're probably right. Still, that doesn't make up for the fact Durov made his fortune with VKontakte that has the exact same toxic business model as Facebook. He began by exploiting tens of millions of VKontatke users. Now he's suddenly turned on his heels and "he's using his money for the good" by deploying tool he knows activists use, but that doesn't provide E2EE even for the small activist groups.

I gave Durov a benefit of the doubt in 2013, but as I saw their E2EE stayed as a bolted-on gimmick, as opposed to forming a solid foundation, that image of a philanthropist fighting against surveillance capitalism disappeared real quick. Telegram's security model is indistinguishable from Facebook: Parent company gets everything except opt-in E2EE messages, and neither company encourages their use.

I repeat, for clarity, there are no ties between Telegram and VK.

Okay, I agree with that.

It's by default encrypted, actually.

Server-client encryption by default, not end-to-end encrypted by default. https://telegram.org/faq#q-so-how-do-you-encrypt-data

Yeah, with client-server encryption. Which doesn't matter at all. Encryption where the service provider has the key, which is the case for

* all Telegram chats by default

* all Telegram group chats

* all Telegram Win/Linux desktop chats

is indistinguishable from end-to-end encryption where the service provider has a backdoor (ANOM[1])

In both cases the service provider, and anyone who hacks them, can read your messages.

[1] https://www.pcmag.com/news/fbi-sold-criminals-fake-encrypted...

i don't think its e2e by default. I hope you are not talking about https.