Telegram is NOT Secure
Jun 21, 2020Telegram is an excellent instant messenger service, and has plenty of innovative features. It’s also very open, with its open protocol and API, developers can build almost anything around it, and so do the designers.
Secret Chat Mode
There is a secret chat mode in Telegram, it utilizes an in house crypto protocol by Telegram team. And in almost ten years, there are no real hacks reported in this end-to-end encrypted mode yet. Secure enough.
However, the secret mode is not enabled by default and that mode requires both party online, otherwise nobody was able to send messages at all. And this mode doesn’t support group chat neither. Another drawback is that secret chat won’t sync to other devices, that make an average Telegram user feel frustrated.
All these inconveniences lead to very low usage of secret mode (I have no data on this, only my assumptions from people around). That say, most people will use the default chat mode. It’s still OK if people are properly educated by the service itself, they will know potential risks.
Dangerous Security Assumptions
Before asynchronous end-to-end encrypted messengers widely usable, Telegram was once a more secure choice compared to others. Many privacy pioneers including EFF recommend Telegram as the most secure messenger service.
People preferred Telegram for its encryption and privacy, but it has already fall behind a lot in this area, the MTProto has remains unchanged for years and no other usability improvements over the Telegram secret chat mode.
However many people still don’t have their attitudes toward Telegram changed, there are historical reasons, but the continuously promotion on the encryption feature of Telegram is the main reason that make people send sensitive messages and files through the service, without knowing the risks that anyone with Telegram server access could view their messages.
Secure Messengers
Encryption technology has improved enormously, and we have much better choices. Signal is the most widely used end-to-end encryption protocol, with billions of devices running Facebook Messenger and WhatsApp. Yes Facebook has a bad reputation in privacy, but math is always more important than reputation when comes to encryption and security.
The most secure messenger with Signal protocol is no arguably Signal Messenger, besides end-to-end encrypted messages, almost all metadata are also encrypted. whistleblowers, privacy advocates, journalists, and security technologists all recommend Signal as the most secure messenger.
[References list]