Have you switched to Telegram? You should be aware of its encryption.

WhatsApp may have put its intention to update its privacy policies on hold, but that hasn't stopped competing messaging applications from capitalising on the confusion it has generated. Millions of individuals have abandoned WhatsApp in favour of its competitors, the most notable of which being Signal and Telegram. However, not all texting applications are created equal.

According to Pavel Durov, the founder of Dubai-based Telegram, the app gained 25 million new users in only 72 hours at the beginning of the year. For the first time, it surpassed 500 million registered users.

"We may be witnessing the biggest digital migration in human history," he stated in a Telegram message to over 20,000 individuals. Telegram, which bills itself as a pro-privacy software, has aided demonstrators and pro-democracy campaigners while also hosting terrorists and sexual abuse content.

It remains to be seen whether individuals abandon WhatsApp for good, but there are some basic differences between how Telegram and WhatsApp work, notably in terms of the degrees of protection they apply by default to conversations.

Why we use telegram?

Telegram is a popular instant messaging and social media app that is known for its speed, security, and flexibility. Some of the main reasons people use Telegram include:

Speed: Telegram claims to be the fastest messaging app on the market, allowing for quick and responsive communication.

Security: Telegram offers end-to-end encryption for private conversations, as well as the option to create secret chats with self-destruct timers.

Flexibility: Telegram allows users to create large group chats (up to 200,000 members), as well as channels for broadcasting messages to a wider audience.

Customizable: Telegram is open source and has a large number of third-party apps, stickers, games and bot.

Multi-Platform Availability: Telegram is available on multiple platforms such as Android, iOS, Windows, Mac and Linux making it easier to use across devices.

Cloud-based: Telegram messages are stored on cloud servers, so you can access them from any device.

End-to-end encryption is used by default on all WhatsApp and Signal conversations and calls, which means that only the sender and recipient can access message content. Telegram is not one of them. End-to-end encryption is only available in a few places: Secret Chats, as well as audio and video conversations.

Since WhatsApp enabled end-to-end encryption by default for over a billion users in 2016, there has been an upsurge in the technology's use to safeguard people's privacy. On messaging platforms, end-to-end encryption is becoming the standard. Following a privacy backlash in October 2020, Facebook is in the midst of updating its infrastructure so that all discussions on Instagram and Facebook Messenger use end-to-end encryption, and Zoom made it accessible for video calls.

If you recently made the switch to Telegram, here’s what you need to know about its encryption.

How do Telegram chats operate?

To understand why Telegram isn't end-to-end encrypted by default, consider how the app operates. There are several sorts of texting methods available in Telegram. These can involve thousands of people at once and differ from the one-on-one chats and group conversations that its competitors primarily use.

Telegram's "one-to-many" broadcast channels are a key component. Administrators distribute messages to everyone who has subscribed to channels, which can be public or private and have an infinite number of subscribers. The messages are visible to everyone, and the channel effectively functions as a feed of postings from administrators (comments can be enabled, but they are mostly used for broadcasting messages). Bloomberg's official channel (with almost 84,000 members) broadcasts the most recent news, whilst an unauthorised xkcd channel broadcasts comics as soon as they are released.

Telegram also supports group conversations, which may have up to 200,000 people and function similarly to group chats on other messaging systems. Individual chats are, of course, possible, and the programme also supports video calls and group voice talks. (According to the firm, voice and video calls are end-to-end encrypted by default). However, end-to-end encryption is only enabled for messages within Secret Chats.

So, how does Telegram's encryption appear?

Telegram claims to utilise two forms of encryption for anything transferred over its platform: cloud-based and end-to-end encryption. Only Secret Conversations between two users employ end-to-end encryption, whereas groups, channels, and one-to-one chats use its'cloud' encryption.

Telegram's cloud architecture allows the firm to display and sync your messages across desktop and smartphone apps in real time. This also implies that the messages you transmit are saved on the firm's servers; the company claims that conversations in cloud chats are "possibly" searchable.

"Cloud Chat data is kept in numerous data centres across the world that are owned by different legal entities distributed across different jurisdictions," according to the company's encryption guide. It goes on to say that it has "disclosed 0 bytes of user data to third parties, including governments," and that handing over data would require repeated legal demands. This hasn't prevented law enforcement from devising new techniques to listen in. In August 2019, Telegram resolved an issue that might have allowed persons to be identified through messages exchanged during Hong Kong demonstrations.

According to Telegram, data from UK users and those in the European Economic Area is held in the Netherlands. It leases data centre space but controls the computers and networks within the data centres; it claims that "local Telegram engineers or physical intruders cannot access" encrypted data on these systems.

However, this 'cloud' encryption is not as secure as end-to-end encryption. End-to-end encryption is the process of encrypting and decrypting messages between individual users. It is client-client encryption, as opposed to client-server/server-client encryption used in cloud chats. This technical configuration has been validated through analysis.

Telegram does provide some limited end-to-end encryption for two-person talks. They're known as Secret Chats. These only operate on one of your devices; for example, if you start a Secret Chat on your phone, it is only viewable on your phone and is not saved in the cloud.

To enable a Secret Chat, create a new message (even if you have previously messaged a contact in a non-encrypted way). Secret Chat must be selected when initiating a conversation, and the person you are messaging must be online. End-to-end encrypted communications are shown by a padlock icon in a list of discussions. The Secret Chat feature also prevents messages from being forwarded and includes settings for self-destructing communications.

Is this correct?

So, why isn't end-to-end encryption enabled by default in Telegram? Durov said this is due to Telegram's "feature-rich" nature. "Signal represents one function of Telegram, which is Secret Chats," Durov explained on Telegram when asked why the programme didn't employ end-to-end encryption by default. "If you believe you need a separate software for that function exclusively [end-to-end encryption], downloading it may be worthwhile."

Durov also believes that most people prefer more features to the higher levels of privacy offered by end-to-end encryption. "The minority that does not want any of that and prefers maximum security over usability is welcome to use Secret Chats on Telegram - or instal any of the apps that only have Secret Chats and nothing on top," he wrote. He also stated that he would not "cripple" Telegram by making end-to-end encryption the default setting and deleting other functions such as communities.

This blend of multiple communication styles may be difficult to grasp. University College London researchers recruited a small sample of users (only 22 in all; half had already used the app) to test Telegram's chat capabilities and then explain how its encryption works. They discovered that "rather than fostering choice" the numerous alternatives provided "have the potential to generate confusion for consumers". They compared people's replies and the overall setting to seven privacy-by-design criteria, including the requirement that apps utilise the most secure option by default. A request for comment from Telegram was not returned.

“Many participants felt that both modes offered the same security qualities, save for the self-destruct timer which was seen as the most apparent component of the Secret Chat mode (and as such an indicative of that mode’s level of security),” the UCL researchers said. “Having two visibly distinguishable chat modes, and more so, the less private one as the default, might lead to confusion and error.”

This article has been amended to tell  Telegram has end-to-end encrypted calls and video calls by standard.