Here you go:
I think you might confuse what the mud puddle test aims to demonstrate. It's to be able to confirm E2E encryption, which if you do that test with Telegram + Secret Chats (which is the E2E encryption feature in Telegram), you'll see you cannot recover those messages.
It depends on what you mean by "as a whole". I mean that Telegram by default can read all your private chats, unless you manually enabled e2ee and suffer from related bad UX. On Linux desktop (and phones) it doesn't even allow to enable e2ee at all.
Yes, this is the expectation. You use someone else's platform that doesn't have E2E, you assume they can read your messages and will help law enforcement to do the same. No surprise there.
Doesn't mean their E2E feature isn't secure, or that the platform as a whole isn't secure. Facebook surely shares their Facebook + Whatsapp data with US law enforcement, we wouldn't call Facebook/Whatsapp insecure just because of that.
I and many others certainly would.
There's "New secret chat" option on my Android client. Or what do you mean by "phones" here?
I mean, if nothing else, that's a bad default. This makes it worse than, say, WhatsApp or the apple messaging thing, nevermind the likes of Matrix or Signal.
The weakness is that e2e encryption is disabled by default, and is a giant pain to enable.
E2E is only for Secret Chats, yes. And yeah, I don't think people use Secret Chats by default.
> and is a giant pain to enable.
Starting a Secret Chat takes one more tap than starting a normal chat.
Hmm, the article says this:
>As John Hopkins security researcher Matthew Green pointed out in his blog on the subject, it’s also a pain in the ass to activate. “The button that activates Telegram’s encryption feature is not visible from the main conversation pane, or from the home screen. To find it in the iOS app, I had to click at least four times—once to access the user’s profile, once to make a hidden menu pop up showing me the options, and a final time to ‘confirm’ that I wanted to use encryption. And even after this, I was not able to actually have an encrypted conversation, since Secret Chats only works if your conversation partner happens to be online when you do this,” Green said.
Telegram doesn't even claim to have end-to-end encryption by default (you have to enable it explicitly on a per-chat basis), and doesn't have it at all for group chats. Like, unless they are lying and secretly _do_ have e2e by default, it is clearly worse than many alternatives from this pov.
It's kind of weird that it has come to be known as a secure messenger, but it certainly isn't.
But until someone actually published any hard evidence demonstrating weaknesses (ideally with a PoC), do we have anything else to go by?
I wouldn't say I know for sure Telegram is 100% secure against government interception, but I also wouldn't claim the opposite, because neither ends/claims have been demonstrated and proven in a verifiably way.