4 ms·

Telegram is pretty bad from a privacy point of view. Only secret chats are end to end encrypted, everything else is sent in plaintext. Even if you do use secret

Telegram is pretty bad from a privacy point of view. Only secret chats are end to end encrypted, everything else is sent in plaintext. Even if you do use secret chats they rolled their own crypto and their algorithm is controversial in the security community. Both Signal and WhatsApp are much better if privacy is a priority for you.

emptysongglass 6y ago
It's ok to espouse your dislike for something but please do it correctly: "everything else" is not sent in plaintext. "Everything else" is encrypted to the server.
- thekyle 6y ago
  I don't think I said anything that was factually incorrect. If you read the Telegram FAQ they say that secret chats are end-to-end encrypted and regular chats are only client to server encrypted. That means the plain text of your messages is accessible to the server by default. Anyone with access to the servers including Telegram employees, governments, and cyber criminals can read your messages. Hacker News for example is also client to server encrypted using TLS (as are most websites) but obviously our comments are still accessible in plain text. https://telegram.org/faq#q-so-how-do-you-encrypt-data https://telegram.org/faq#q-so-how-do-you-encrypt-data
  - emptysongglass 6y ago
    You specifically wrote "sent in plaintext", which is factually incorrect. Telegram messages are never sent in plaintext. But to address your digression: Cloud Chats (as opposed to E2EE Secret Chats) are both encrypted in transit and at rest [1]. The difference between the MTProto implementation between Cloud Chats and Secret Chats are, at a very high level, that part of the encryption key is held by Telegram. To be unequivocally clear, at no point are Cloud Chat messages ever stored in plaintext or sent in plaintext. [1] https://core.telegram.org/mtproto#authorization-and-encryption https://core.telegram.org/mtproto#authorization-and-encrypti...

emptysongglass 6y ago

It's ok to espouse your dislike for something but please do it correctly: "everything else" is not sent in plaintext. "Everything else" is encrypted to the server.

thekyle 6y ago
I don't think I said anything that was factually incorrect. If you read the Telegram FAQ they say that secret chats are end-to-end encrypted and regular chats are only client to server encrypted. That means the plain text of your messages is accessible to the server by default. Anyone with access to the servers including Telegram employees, governments, and cyber criminals can read your messages. Hacker News for example is also client to server encrypted using TLS (as are most websites) but obviously our comments are still accessible in plain text. https://telegram.org/faq#q-so-how-do-you-encrypt-data https://telegram.org/faq#q-so-how-do-you-encrypt-data
- emptysongglass 6y ago
  You specifically wrote "sent in plaintext", which is factually incorrect. Telegram messages are never sent in plaintext. But to address your digression: Cloud Chats (as opposed to E2EE Secret Chats) are both encrypted in transit and at rest [1]. The difference between the MTProto implementation between Cloud Chats and Secret Chats are, at a very high level, that part of the encryption key is held by Telegram. To be unequivocally clear, at no point are Cloud Chat messages ever stored in plaintext or sent in plaintext. [1] https://core.telegram.org/mtproto#authorization-and-encryption https://core.telegram.org/mtproto#authorization-and-encrypti...