> Very much of what Telegram has done security wise is very well thought out and has improved over time

This is not my understanding of the situation at all. There's no end-to-end encryption by default [0], and the end-to-end encryption they do have received significant controversy at launch [1] for being essentially a "roll your own" crypto solution which indeed ended up being found to have some issues [2].

They disable the OS backup and instead they effectively store all their user's contacts, messages, media, etc. directly on their servers except for the conversations that the users directly opt out of by turning on e2e. They've promised since 2014 to open source everything but the backend, which stores all this data, is still closed source.

For small group or individual messaging, whatsapp, signal, or matrix are far better choices. I think it's worth acknowledging that telegram has a much bigger focus on large groups and therefore has to make different security tradeoffs, so I think if we consider telegram a social media service it's pretty good -- but is not the best messenger.

[0]: https://www.howtogeek.com/710344/psa-telegram-chats-arent-en... [1]: https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-you... [2]: https://eprint.iacr.org/2015/1177.pdf

You are very precise in your criticism, have my upvote!

A couple of things:

1. the crypto has been improved significantly after the launch as far as I know. That release was back in the dark ages about half a year after WhatsApp got caught sending data unencrypted (and I'm using that word in its original meaning).

2. Can we agree to stop recommending WhatsApp soon?

Thanks! That's kind to say.

I shared some notes on crypto issues more recently in another post above, but I would concede its generally more battle tested than the first version released at this point. The choice to start with home rolled crypto at all continues to concern me, but more importantly the fact that it's not default is now my biggest sticking point if I'm honest.

I think WhatsApp comes with an asterisk in that I'd certainly recommend signal over it, but most non-technical people have never heard of signal so given the choice between WhatsApp and Telegram I'd personally opt for WhatsApp based on their e2e encryption by default, but I could understand if someone personally gave more weight to a distrust of Meta (even if encrypted) than they do to Telegram and made use of Telegram's secret chats.

Last I heard there is nothing wrong with the E2EE in Telegram at this point in time. OTTOMH, the stuff that people were complaining about wasn't anything that anyone would realistically care about, particularly for something not really that secureable like instant messaging on a smartphone.

The current version has no publicly known issues, but suspicion is the only valid response when an entity rolls their own cryptography for production when such well-studied and secure options already exist.

> suspicion is the only valid response when an entity rolls their own cryptography for production

Strong disagree. I would rather have multiple solutions in production, and Telegram's is also well-studied.

Most established approaches were well studied before they were put in production, while Telegram has had the luxury of beta testing their protocol in real time on their 500 million users, and the work isn't yet done with issues discovered as recently as this year:

> But ultimately they prove that the four key issues “could be done better, more securely and in a more trustworthy manner with a standard approach to cryptography,” said ETH Zurich Professor Kenny Paterson, who was part of the team that uncovered the flaw.

https://www.cyberscoop.com/telegram-app-security-encryption/

I'd suggest you actually read the paper[1] you're referring to, because it's actually a lot less critical of Telegram's approach than you make it out to be.

We are better off that Telegram exists as an alternative. We don't need Signal's protocol (also used in Whatsapp etc) to be a potential SPOF.

To quote: The central result of this work is a proof that the use of symmetric encryption in Telegram’s MTProto 2.0 can achieve the security of a robust bidirectional channel if small modifications are made.

1. https://mtpsym.github.io/paper.pdf

I have read this paper. Not sure where you feel I mischaracterized it. The section you just quoted goes on to discuss caveats, including a recommendation that they swap out their low level cryptographic implementation with one that uses a standard and well-vetted library, and then criticizes them for not having e2e on by default.

> for being essentially a "roll your own" crypto solution

This is technically incorrect. They use well known cryptografic algorithms for encryption and authentication. However, their protocol is unique combination of these cryptografic algorithms to provide specific purpose. It is different thing and different perspective than ”normal” use case for saying ”don’t roll your own crypto.”

"roll your own" has no official definition I'm aware of, so I'm not sure what you mean by "technically" incorrect. This could quickly become a discussion of semantics unfortunately.

To be specific with what I mean, it is "roll your own" in the sense that 1) their protocol combines cryptographic primitives in unrecommended ways with no particular justification and in the sense that 2) they literally have invented and written many of these primitives themselves.

As a concrete example, the IGE mode used by Telegram for AES is not "well known", in fact to the best of my knowledge Telegram is the only popular software in existence that uses this mode. IGE is avoided by all modern cryptographers because the authentication is broken, however Telegram uses this mode but not the authentication. There's no particular justification for this decision over just using an AES mode that everyone uses, but there's a lot of potential pitfalls if not done carefully.

When you ask what type of authenticated encryption scheme Telegram uses, their answer is "none of them". Normally this would be a huge problem. However, they have solved this with their own custom "security checks". These are also not "well known" because Telegram invented them.

When you ask what type of PKCS they use for padding, the answer is "we came up with our own padding algorithm". This was not "well known" because Telegram invented it. The padding issue they fixed in v2, since it turned out to introduce a vulnerability, but I assume you get what I mean by this point.

Contrast this with Signal, which is also ultimately a unique protocol but is one that was implemented using robust, tested primitives in recommended combinations with boring standard choices for all of the details.

An advantage of Telegram is that they attract less attention from the authorities. Also Telegram seems to have a more, shall we say, lax attitude about criminal activity.

> For small group or individual messaging, whatsapp ... [is] far better choice.

The whatsapp that leaks your data to the FBI in real time [1], or do you mean some other whatsapp?

[1]: https://news.ycombinator.com/item?id=29381917

as the first response to that post says the only thing that the FBI got was metadata if icloud backups were enabled, it's impossible for whatsapp to leak your actual messages because they're on device encrypted.

These comments on whatsapp, which appear with regularity by the way, are misleading and just inflammatory.

> it's impossible for whatsapp to leak your actual messages because they're on device encrypted

Have you seen the source code to claim there are no backdoors? Wait, you haven't because it's a proprietary piece of crap produced by the worst corp in existence - Facebook aka Meta. The same entity that's shamelessly involved into Putin's Russia level political censorship and yet we are to trust it according to the parent comment. Right...

This is entirely false, stop spreading disinformation.

Facebook shills are strong here, I see. Here you are: https://propertyofthepeople.org/document-detail/?doc-id=2111...

Excerpt from the FBI report:

> Pen Register: Sent every 15 minutes, provides source and destination of every message. [without a warrant of any kind]

(And who knows what other three letter agencies can get.)

BuT ThAt'S jUsT mEtAdAta, wE hAvE nOtHinG tO hIdE. Then keep using it, but don't spread your bullshit to others.

Telegram is great if you like shiny native features like stickers and having lightweight native clients, but at everything else Telegram is at risk of losing in the long-term.

The big reason for this is that Telegram decided to roll everything mostly on their own (including e.g. MTProto), Telegram is not compatible with Matrix unless you use a bridge, it is not e2e encrypted (unless you use mobile 1-to-1 secret chats. The server side code is proprietary, and the builds of the clients that are published to the app stores could be anything.

While I love using Telegram right now for talking to some groups of friends, I would look at supporting https://matrix.org , since it will likely become the de-facto standard of building messaging platforms.

>Telegram is great if you like shiny native features like stickers and having lightweight native clients, but at everything else Telegram is at risk of losing in the long-term.

Whatever ends up winning is going to need:

  - Native clients on all major platforms
  - Full support for all the fun little extra's like emoji's, reactions, gifs, file transfers etc.
  - True multi-device support that doesn't require any sort of forwarding from another device
  - Group chats
  - Searchable history
  - Your full history to automatically load when you log in on a new device (manually transferring isn't going to be an acceptable solution)
  - No concept of selecting a server or anything. Users need to be able to just log in with a username/password and carry on. 
  - E2E encryption that doesn't sacrifice the user experience

Anything missing from this list? Also, does Matrix support all of that? Last time I checked Matrix out it seemed clunky and confusing (especially for non-technical users) and it was missing a ton of the 'basics' that people expect out of a chat app.

I think I can speak to how Matrix deviates from your list:

- There are technically native clients on every platform, so best kind of correct? However, the "official/main/most popular" client is Electron on Desktop. Partial credit?

- Yup

- Yup, even when using E2E, which is a hell of an accomplishment. You transfer keys from other devices, but not entire messages.

- Yup. E2E or not, your choice.

- Searchable history plus E2E is... hard, to say the least. Some clients will index your conversations while they happen, but that's obviously not the perfect solution. That said, the APIs are so open that I've written python scripts before that download and search entire rooms. It would be possible for a client to do the same, though I don't think any do. Non-encrypted rooms are trivial to search, or course.

- This as well. As before, keys transfer from other devices, messages load from the server.

- This seems like it was engineered to exclude Matrix. The default in every client is matrix.org, and there's no reason you ever need to change it if you're not concerned with it. In fact, most clients make it a couple clicks to change it (https://app.element.io/#/login).

- Not totally sure this is possible, but Matrix comes very close. On par with Signal, though with different tradeoffs (stored history, for example).

- The native clients for Matrix suck. Even the mobile clients for Matrix are full of bugs.

- No custom emojis; every chat application known to man has regular emojis supported in UTF-8, so the author must be talking about custom ones. Which Matrix still does not have: https://github.com/matrix-org/matrix-doc/pull/1951

- I don't think doing what PGP does is really impressive, but okay, fine, one point.

- Matrix group chats are broken and this is why Synapse eats resources like a bear.

- No searchable history on all but one Electron client on one platform when using E2E is terrible, and further supports the argument that all clients suck.

- Point; this is pretty convenient.

- XMPP sucks. Matrix is modern XMPP. People don't like getting confused with servers and similar nonsense, and when your homeserver goes down, you're out of luck. Federation sucks. The question wasn't made to exclude Matrix, it was made to point out that federation sucks. Matrix didn't invent federation; it chose it long after it failed.

- E2E degrades experience greatly. To list my two biggest complaints: It ruins search for all but one client, and the UX around keys is terrible. I frequently have conversations with incredibly technical people and they'll still get absolutely stumped by the UX around keys, because it's awful.

Two out of eight isn't bad.

I use Matrix every day. I have for years; long before the recent rebrand, and multiple presidents have vacated office since I started using Matrix. I love Matrix. But there's no reason to act like it's some golden goose when there are problems from 2015 that are no closer to being fixed than they were at the time. It's a comfortable protocol for usage by people who have powerful computers. For everyone else, it still isn't great.

> - I don't think doing what PGP does is really impressive, but okay, fine, one point.

it's more than PGP, it includes variable PFS, automatic key exchanges

> - Matrix group chats are broken and this is why Synapse eats resources like a bear.

I have heard it's because Synapse is a proof of concept that went into production

> Federation sucks. The question wasn't made to exclude Matrix, it was made to point out that federation sucks. Matrix didn't invent federation; it chose it long after it failed.

I disagree. Federation is a burden, but it enables interoperability between independent parties.

> But there's no reason to act like it's some golden goose when there are problems from 2015 that are no closer to being fixed than they were at the time.

There's also no reason to do the same thing into the other direction.

I also heard that Matrix will run off with your wife and kick your dog. It's a re-implementation of BoziBuddy, and will fail for the same reasons.

Signal seems to have everything you listed except for the full history transferring to a new device (works on Android but not as well with iOS). Though like you implied, it is done manually. I'm still not convinced that this can be done without making major sacrifices to security because I really do want a trustless system where my messages aren't stored on a company's servers (I am okay with optional backups though, so there's a middleground).

> No concept of selecting a server or anything.

This has been one of the big concepts that has bugged me with Matrix. It also is why I'm confused with why people pit Matrix vs Signal. Honestly I see Signal/WhatsApp/iMessage/WeChat as competitors whereas Matrix/Slack/Teams/IRC is a different ecosystem. But I can't get my parents or grandma to use something like Matrix (or even Slack) but they are able to use things in the former category. In fact, this has been one of the great successes of WhatsApp (looking at India with all the aunties and uncles using WA or China with WeChat).

> Anything missing from this list?

- Pinned messaging

- Other class of extras/plugins: on-device translation, calendar reminders, etc

Pinning messages is important for search, but seems to be overlooked frequently (I use this a lot in slack). I often know something is important and need to find it again in a day or two (e.g. traveling) but will also be talking with the other person and that message gets pushed. Pinning lightens the load of searching. It also lightens the load of backups as most people truly want a very small subset of their messages saved but are only aware of an all or nothing approach.

Plugins will be important as well. To complement pinning calendar reminders are great. Google does stuff like this frequently like when you get an email about a flight and then your phone's home screen will have all the information on it. It's also naive to think that you can think of all the things people would want. That's why smartphones have been so successful, because they provide the ecosystem. This isn't too dissimilar from creating a super app. But there's none where the ecosystem is fully secure.

> Signal/WhatsApp/iMessage/WeChat as competitors whereas Matrix/Slack/Teams/IRC is a different ecosystem. But I can't get my parents or grandma to use something like Matrix

I can't get why people need to put Matrix in either Box. It's a communication protocol. Client UX is completely independent, like you can have K9Mail and Thunderbird

Signal desktop clients are not native. They use Electron and are much slower than Telegram.

That's true. Something I wish they would fix but I think now it is tech debt.

- An option to not have a password at all and log in just by having a phone.

It's a 100% must have feature for a phone IM, most people will forget a password the very moment they are forced to create it.

I agree that it's a great option, but unfortunately it's also not secure at all. You're what, one SIM swap away from having your whole chat history owned?

> Your full history to automatically load when you log in on a new device

Most people don't actually need full history in most situations, just recent history.

If you can do recent history, you can probably do the full history.

I personally search my deep history regularly. I might be looking for a recipe, link, someones contact information, an address... There are many reasons having the full history available is important, and "losing" it by getting a new device is a terrible user experience.

Telegram the app, is the best among all messenger apps.

Telegram the company, maybe not.

It is best because they don't bother encrypting user data, loading it directly from its own servers.

I meant feature-wise, the app is spectacular, but security-wise, it's not that trustworthy.

Exactly. Features are way easier with everything plain text.

Matrix still has ways to go but Elemental is now actually usable.

On the Telegram security side of things my group of friends uses it as a more modern IRC. So no NSA proof security is truly even expected. We even bridge some IRC channels to Telegram with bots.

> and the builds of the clients that are published to the app stores could be anything.

Isn't Telegram one of very few that provides verifiable builds, (including on iOS if you root it)?

I might be wrong but I think not.

Edit, see : https://core.telegram.org/reproducible-builds

So it seems even on this point Telegram shines.

Telegram doesn’t even post their source code to match their releases on macOS and iOS. Sometimes they’ll do a code dump somewhere around that time, but it’s not a guarantee.

In the same boat as Signal there.

WhatsApp doesn't post source code at all.

> Very much of what Telegram has done security wise is very well thought out and has improved over time

Though I'm certainly not a cryptography expert, I used to work on Tails OS and some Tor-related projects, and I feel I know where/how to listen to the experts.

Having said that, I am a hard disagree on the quoted statement.

My understanding is that there has been very few improvements that they weren't dragged into. imho telegram is a reckless tool from a cryptographic point of view, and still highly suspect

> My understanding is that there has been very few improvements that they weren't dragged into. imho telegram is a reckless tool from a cryptographic point of view, and still highly suspect

Again, I cannot speak about the crypto but I can speak about

- bugs: last time Telegram had a know bug where data could realistically leak except inside Telegrams infrastructure (which of course is a big deal) was around the time it launched as far as I know. Looking at Signal (which I recommend for anything super secret) they've had a couple of really nasty bugs in the much shorter life time: RCE in desktop client and spuriously sending images to persons except the intended recipient is just two.

- things they haven't been dragged into: anti-hijacking, deletion on account inactivity, working backup, not syncing secret chats between clients and more.

> without any proxying (did I get that right and has the author studied it carefully enough?).

Most likely, since the user-agent rotation code is in the app itself. If it were a Telegram proxy, the proxy would do its own UA and IP hopping and the clients would use their default UAs.

At a certain point, I wonder why Google's abuse team don't simply look for 3+ occurrences of User Agent strings because UA rotation is rarely used for legitimate purposes.

> UA rotation is rarely used for legitimate purposes

It’s not uncommon for hundreds of users to share a single public IPv4 IP address through an ISP-provided NAT. The same applies to corporate LANs with a single uplink channel.

These users gonna have random UA corresponding to market share of web browsers and operating systems, all coming to the same web server from a single IP address.

I mean on the play store side, where they scan app submissions for TOS violations before they even hit the store. UA rotation on the client side is rarely used for good.

HTML requests are just text, how would you even go about scanning for that?

As from the blog post, the source is public[0] and the Android review process is almost entirely automated static/dynamic analysis of apps submitted, so it wouldn't be super hard to find UA-like strings and have some elevated manual review if there are a lot of them (if they decided to implement this sort of abuse policy).

0: https://github.com/DrKLO/Telegram/blob/c1c2ebaf4690fd91c116d...

Google very likely only scans the input application, I'm not sure why you would bother with an automated system to detect a code repo for it when the majority of applications on the Play Store are closed-source and there's a low confidence if the builds are not repeatable.

Anyway, regardless of that it sounds like it would be easily defeated with the following C format string:

"%s-%s: %s/%s (%s) %s/%s %s/%s"

with argument list:

"User", "Agent", "Mozilla", "5.0", "X11; Ubuntu; Linux x86_64", "Gecko", "2010000", "Firefox", "90.0"

For bonus points you can make those floating points, too, and split it up a bit further. Now nobody can scan for this without a lot of false positives (The strings are going to display in anything that embeds a web browser or references it, lol) and you get ultimate flexibility.

Why would they? This is the Google Play Store, not the Apple App Store with all its inane rules.

I think that’s only possible if they ban TCP/IP for play store apps, enforce that in the OS kernel (SELinux can probably do), and instead expose the one and only high-level HTTP API for apps.

These days Google isn't up to much on a technical level ;-)

They cannot even fix the old verbatim feature that they broke a few years ago, so how should should they be able to stop this without breaking something else?

Yep, this is somewhat hyperbolic but I'll write it anyway. I want my old Google back.

Tools -> All Results -> Verbatim is confirmed broken? I thought something was fishy...

Hasn't worked consistently for me for years.

To be precise: I think it work sometimes, but I know it doesn't work most of the time unless verbatim means something completely different from what I think ;-)

You can verify this quickly by searching for something slight unusual or very specific, apply verbatim and verify that most of the results still doesn't contain your words.

it's my understanding that Telegram won't automatically translate messages unless the user chooses to click the translate button, and the option to enable the translate button does disclose that translated message content is sent to google.