Dear Telegram, stop calling Cloud Chats encrypted, let alone heavily encrypted

Telegram is a robust cloud messenger with a top-secret end-to-end encrypted chat option exclusive to one-to-one chats available on limited platforms only.

What is and what isn't Telegram Cloud Chats?

All the private (one-to-one) and group chats that you do on Telegram is Cloud Chats. Cloud Chats use Server-client encryption using Telegram's custom MTProto 2.0 Part I.

Secret chats, voice and video calls are not included in the Cloud Chats. They are encrypted with end-to-end encryption using Telegram's custom MTProto 2.0 Part II.

MTProto supports two layers, client-server encryption that is used in Telegram Cloud chats and end-to-end encryption that is used in Telegram Secret Chats, voice and video calls. Furthermore, MTProto supports Perfect Forward Secrecy in both cloud chats and secret chats.

Telegram has also explained why they use a custom protocol in favour of faster speed and reliable connections over mobile networks esp. when dealing with large files. Also why Telegram isn't using end-to-end encryption by default for everything.

Things Telegram does not want to explain or talk about

Use of catchy words on their homepage like Telegram messages are heavily encrypted

All the messages you send and receive on Telegram by default are Cloud Chats. Telegram uses server-client/client-server encryption to encrypt your Cloud Chats. I am not an encryption expert but as far as I know, this MTProto 2.0 (Part I) layer is nothing but a custom implementation of transport layer security to satisfy the requirements of Telegram.

Mr Moxie Marlinspike, founder of Signal, called MTProto a janky equivalent to TLS.

So by default all messages you send and receive on Telegram use in-transit encryption and encryption of data at rest.

How heavy is this encryption, Telegram? How is this different from one-to-one messages on an IRC network like OFTC/Libera or chat between two users on a reputed Jabber server any different in terms of how heavy-duty their in-transit encryption is?

How is this different from an unpublished comment on this post in terms of encrypting the 'message', which in this case is a comment? An unpublished comment on this post would also be transported using the TLS 1.3 protocol with a robust cipher suite offering Perfect Forward Secrecy (PFS), Authenticated Encryption with Associated Data (AEAD) and modern algorithms.

Regardless of the technical jargon I used, as the admin of a service, I can directly access the content of an unpublished comment in plain text. Simple as that!

Of course, as a much bigger entity, Telegram could use a set of policy-based operational security things to prevent its admins from accessing these messages in plain text. But technically, a rebel or malicious or sold out admin can have everything, right?

I am sure that the NSA also deployed operational security intelligently, and yet Edward Snowden was able to do what he did single-handedly as an independent contractor and system administrator.

Telegram client does not even educate you about end-to-end encryption during a one-to-one Cloud chat

The very primitive expectation from a secure, private, open messaging application with focus on security and privacy is that it should at least inform you about availability of Secret Chats during one-to-one private chats. When you join Telegram Groups and take your conversation from Group to private chats, or when you search an username to initiate a one-to-one Cloud chat, it would never inform you that the chat isn't end-to-end encrypted [even on supported platforms like Android or iOS].

On top of this, Telegram apps do not make the Secret Chats easily accessible.

To create a Secret Chat on Android, you need to open the user profile of the user you are chatting with, tap the three-dot button from top-right, and select Start Secret Chat therein.

I am sure Telegram would write a post on why Secret Chats should not be a tap away from within a private one-to-one Cloud Chat. Unless they plan to enlighten us with the theory, please don't make Secret Chats a secret for an average user.

Test of the theory Telegram proposes to protect your Cloud Chats and relevant metadata

They follow a distributed infrastructure model to protect all your cloud chats. They store your data in different data centers around the world. These are controlled by different legal entities with their own separate jurisdictions.

The relevant decryption keys are split into parts and are never kept in the same place as the data they protect.

Because of this structure and the way Cloud Chats data is distributed world-wide, it takes multiple court orders from different jurisdictions to compel them to hand over data.

To this day, we have disclosed 0 bytes of user data to third parties, including governments.

It sounds like a plan, but it doesn't work in the real world.

Not too long ago, Telegram was ordered by a High Court in India, in a copyright infringement case brought by the Plaintiffs, to disclose the data relating to the infringing channels and the details of the devices/servers/networks on which they were created, their creators, operators, including any phone numbers, IP addresses, email addresses.

An order dated 24 November 2022 in the above said case states that Telegram has handed over the data in a sealed envelope as directed by the High Court. The order clarifies that some of the data related to some channels were not available at Telegram. The order says that the data, which is in the form of a chart, has been perused by the Court. It shows that the names of admins, the phone numbers and IP addresses of some of the channels as are available with Telegram have been filed. Court also issued a clear direction that neither the Plaintiffs nor their counsel shall disclose the said data to any third party, except for the purposes of the present proceedings. To this end, disclosure to the governmental authorities/police is permissible.

Telegram's plan to protect your Cloud chats data with a unique multi-jurisdictional structure that can withstand the scrutiny of multiple legal systems is obviously just words that cannot be argued in court.

In the above copyright infringement case from India, Telegram tried to use its multi-jurisdictional structure argument in Court. Since the said data was stored in Singapore.

To improve the security of your account, as well as to prevent spam, abuse, and other violations of our Terms of Service, we may collect metadata such as your IP address, devices and Telegram apps you've used, history of username changes, etc. If collected, this metadata can be kept for 12 months maximum. - Telegram Privacy Policy

Telegram is a fast, cloud-based messaging app with optional client-side encryption exclusive to private (one-to-one) chats on limited platforms. Voice and video calls are always end-to-end encrypted though.

Don't take it for a serious encrypted messaging app.

Should you quit Telegram?

Absolutely not! If you use it as a robust Cloud-based messenger. Go ahead! It is fast, functional and feature-rich. You can now sign up for a Telegram account using blockchain-based anonymous numbers available on the Fragment platform.

Also, if you're worried about your phone number (in case a virtual number isn't available), I suggest you change its access to "Nobody" in Telegram's in-app privacy and security settings. Also, use a username to communicate with people you don't know.

Comparison with Signal application

Signal is an established player in end-to-end encrypted messaging. It uses an open source protocol called the Signal protocol to encrypt everything, including calls and messages.

Regardless of the quality and quantity of praise they get from security researchers and experts worldwide.

I am not at all happy with their home page.

One thing where Signal completely fails is words. I see no heavy words. I expected a minimum of military grade or alien technology or super duper heavily encrypted on their homepage to lure a layman. Pun intended.

Rest, it is one of the best. I wish it had usernames like in Telegram or Threema like IDs to communicate with others without having to share your phone number with them. Also, it is not a fast or feature-rich messenger like Telegram.

Has Signal withstood the pressure of government data requests and the scrutiny of multiple legal systems?

Yes, on multiple occasions. Regardless of where the order or request comes from, the only data Signal has provided is the time of account creation and the date of the account's last connection to Signal's servers. That is all.

If I were an FBI agent looking at the amount of data Signal produces, I would be furious. It literally defeats the purpose of the data request.

What do you think? Let me know in the comments below.