With its unique Channels and Groups, Telegram has become a premiere online gathering place and staging area for political movements outside of the Google/Facebook/Twitter hegemony. Its video and voice chat can make for a more intimate experience, and fun features like interactive emoji and high-quality stickers only add to the attraction. Although Telegram's independence and interest in privacy are commendable, some key decisions by the company mean it doesn't always compare well to privacy-focused messaging apps that have fewer features. Telegram is really a social network that just happens to offer secure messaging in some cases, and for some that will be enough.
Getting Started With Telegram
Telegram is free to set up and use and only requires a phone number. I was surprised to find my mobile number blocked, which is odd because the last thing I used Telegram for was to communicate with Telegram itself to get some comments on a previous version of this review. Surely, that is a coincidence. Fortunately, I was able to set up an account with my Google Voice number. Unlike most secure messengers and social networks, Telegram lets you create and access multiple accounts from the same app.
Although built for mobile, Telegram also offers apps for iOS, Linux, macOS, and Windows, as well as a web portal. These are useful, but you need to create your account with one of its mobile apps.
At signup, Telegram will offer to upload your Contacts in order to find other Telegram users. This is entirely optional. Signal Private Messenger has a similar feature, but in Signal's case uses a hash of the numbers, so the company never knows the contents of your contacts. Telegram should look for ways to store less information or do so in a more anonymous way.
Similar Products
Signal Private Messenger
Facebook Messenger (for Android)
Zoom Meetings
Slack
Notably, your Telegram account automatically deletes itself after six months of inactivity—although you can change this interval. I really like this feature. Too many of us have too many abandoned online personae, each of which is a potential security risk.
The quality of the Telegram app is immediately apparent. Everything is animated, snappy, and fun to use. The app is also highly customizable, offering universal controls for the theme, background, and other features.
Chats, Groups, and Secret Chats
Chats are familiar affairs. If you've sent a text message since 2008, you know how this works. Your messages appear on the right side of the screen in little speech bubbles, and your friends' bubbled messages appear on the left. Unlike traditional SMS chats, deleting a message from your phone deletes it from the recipient's phone as well.
Secret Chats are just like regular chats, except these use end-to-end encryption (E2EE) in such a way that not even Telegram can read the contents. The company also says that there are no logs of Secret Chats, so Telegram doesn't even know when these messages are being exchanged. That's all great, but as I explain below, I wish Telegram saw fit to extend this protection to all the content on its platform. Facebook Messenger uses a similar setup with optional E2EE chats, but Editors' Choice winners Signal and WhatsApp encrypt all messages end-to-end by default.
Along with text you can send a variety of attachments, including files and photos, as well as video and audio recordings from within the app. Telegram has some surprisingly deep photo editing capabilities, letting you quickly punch up images before you send them. You can set an individual self-destruct timer for photos and messages.
If that's not enough, Telegram has a thriving sticker community. You can find a sticker to suit whatever style, from cutesy to risque, and some artists even offer custom stickers. You can also inflect your messages with emoji, animated emoji, and interactive animated emoji. Fun features like these are a powerful draw, and no doubt a reason to stick with Telegram.
You can also use Telegram to send payments through a variety of third-party processors. WhatsApp has a similar feature while Signal has thrown its support to (shudder) cryptocurrency.
Far from a messy SMS or email thread, Groups in Telegram come with fine-grained control to help you keep order. There are public and private Groups with customizable options on how people can find the Group. The Group's creator can designate other Admins or create different roles each with their own set of permissions, as well as set global permissions for members. This makes it easy to manage everything from a chatty group of friends to a massive fan club. Signal also boasts similar admin controls for its Groups.
Welcome to the Social
Telegram has smartly iterated on the basic chat and group function to create experiences that go beyond messaging and feel more like a full-fledged social network. Channels, for instance, are basically one-way chat rooms, more akin to Tweets or Facebook status updates. Channels support an unlimited number of people in voice calls, along with additional participation tools like adding speakers or letting participants raise a virtual hand.
Channels and Groups remind me a bit of Discord, which boasts many interest-based communities and events. While Telegram is definitely easier to understand and to use, Discord has far more options and controls.
The search bar at the top of the screen is the primary means for finding Groups and Channels to join. Share links and QR codes let you discover new social groups in a number of different ways. Channels can optionally publish online with a permanent URL, in a more blog-like format that's accessible to non-Telegram users. You can go local and enable the optional Nearby mode to find users and Groups in your neck of the woods.
Groups and Channels are enormously diverse, and have been a key facet in grassroots movements in the US and abroad. Still, I was disappointed to find that official or high-quality options were hard to discover. I couldn't find an official Star Trek channel, like the one on Instagram, but I did find one that publishes pirated videos of each new Star Trek: Discovery episode. Other Groups I visited were strangely silent, and still others filled with what looked like bot interactions. I strongly suspect that the best way to find high-quality groups is through word of mouth, rather than any discovery tools in Telegram.
Moderation is a problem on every platform, and we've already seen the disastrous role social media can play in organizing hate groups and spreading conspiracy theories. Telegram has mechanisms to report groups and accounts, but it's clear from the company's public statements that it prefers a more hands-off approach. This can have serious consequences beyond my bumping into weird accounts, like the proliferation of non-consensual pornography on the platform.
Say It to My Face
The ongoing COVID-19 pandemic has taken video calls from a niche endeavor to an exhausting ritual we all endure in lieu of actual human interaction. Telegram has responded by doubling down on voice and video chat. Channels and Groups also have a livestream option, which you can record and share afterward.
With Telegram, any one-on-one Chat can be made into a video or voice call. Groups now also support video calls with up to 1,000 participants, but only the first 30 participants can share their video. Everyone else is restricted to voice only, so this won't be a go-to for replacing Zoom.
In my testing, I made voice and video calls as well as holding a Channel livestream for an audience of one: my colleague, Michael Muchmore. Audio quality was pristine on my end, but he complained of an echoey "bathroom" quality. Video quality was inconsistent, but it never dropped entirely. I was especially impressed with the luxurious interface, particularly the livestreams, where I could easily allow others to speak or simply hold court.
One security feature I appreciate: Telegram makes it easy to confirm that you're securely connected to the other caller, without anyone intercepting the message. You and the recipient see a cluster of emoji at the top of the screen. If they match, you're secure.
Can You Trust Telegram?
Much of Telegram's appeal comes from its light moderation and assumption of privacy by its users. Unlike Facebook and Twitter, which exercise broad (if uneven) control over content, Telegram is a little uneven with privacy. It's telling that the EFF issued guidance on how to use Telegram safely for people in Russia and Ukraine, underlining its importance for organizing but also its shortcomings.
Every message you send on Telegram is encrypted, but not all messages are encrypted the same way. Chats, Groups, and Channels are stored on Telegram's servers and the company holds the keys to these messages. It is my understanding that in these systems it is at least technically possible for the company that manages the keys to decrypt and view messages. Secret Chats are end-to-end encrypted, meaning that only you and the recipient of your message can read it. No one, not even Telegram, can decrypt it.
The company has its reasons for doing this, but Signal is able to deliver much of the same features as Telegram without bifurcating encryption. I believe that Telegram's approach gives a false sense of security, and could put people at risk.
One endorsement of Telegram's approach comes, ironically enough, from the FBI. An internal document outlining the "lawful access" the agency can gain on messaging platforms emerged in late 2021. In it, it says that Telegram cannot be compelled to provide message content, but that it might provide the IP address and phone number for confirmed terrorists. Signal, however, discloses even less information.
Perhaps Telegram's most controversial decision is how it encrypts messages: with the company's custom-made protocol dubbed MTProto. Cryptography is complex and the people who understand it best generally prefer adherence to tried and tested standards. Opting to roll your own is considered foolhardy.
That same complexity also makes it difficult for non-cryptographers like me to evaluate the veracity of the arguments for and against MTProto. Although Telegram has been criticized for using MTProto, no one has yet come forward with definitive proof that the current version of MTProto is dangerously broken. There have been recent validations of MTProto, but also several validations of Signal's protocol. Moreover, the Signal protocol has been evaluated and adopted by competitors including Facebook Messenger and WhatsApp (also owned by Facebook).
Also, Telegram has released most of its source code for public inspection, but withheld its server code for hand wavey reasons involving intellectual property theft by nation-states. Other security services and apps, including Signal, have made all their code available—even server code.
Beyond encryption, Telegram has an up-and-down relationship with privacy. It encrypts user data but also stores user IP addresses and other metadata for 12 months. Like Signal, Telegram eschews monetization schemes that intrude on customer privacy. But Signal is a certified non-profit, while Telegram still hasn't settled on a monetization scheme.
Telegram is clearly proud of its technology, and should meet these criticisms with more public research and audits. But that pride sometimes seems like hubris and has created an interesting situation in which...
Telegram's Cofounder Will Soon Owe Me $1 Million US Dollars
In the interest of disclosure, I am kinda-sorta in a financial relationship with Telegram's co-founder Pavel Durov to the tune of $1 million.
On June 8, 2017, Durov Tweeted that because Signal had accepted money from the Open Technology Fund, it was "government funded" and was no longer safe. The OTF describes itself as an independent non-profit that receives grants and funding from the US Congress and the US Agency for Global Media. This kind of guilt-by-association argument really irked me. It's hard enough to get people to care about privacy and security without the people and companies who are supposed to help publicly attacking each other.
I said as much to Durov, and he responded by betting me $1 million that a backdoor, presumably controlled by the US Government, would be discovered in Signal within the next five years. This will be the easiest bet I ever win, because it's utterly baseless. I offered to discuss terms for the bet, but I never heard back. I have taken his silence as total agreement. I look forward to June 11, 2022, at which time I will ask that Durov take the $1M he bet me and donate it to the charity of my choice.
It's Surprisingly Easy to Be More Secure Online
More Social Network Than Secret Messenger
Telegram has a massive independent streak that has brought it great success. It has refused to be constrained by convention, and built a strange social hybrid that has been at the center of world events for years. It's also just fun to use. Its stickers alone are a reason to try it.
That independent streak hasn't always worked in Telegram's favor, however. The company bucked convention and created its own encryption system, making it difficult to fully endorse. It also opted to split off true e2ee messaging, muddying how secure messages really are. While it has greatly expanded its social features it continues to do very little moderation, making it a haven for extremists as well as the people who fight against authoritarianism.
We need more apps like Telegram that emphasize user privacy but are also fun and compelling. But more than that, we need apps and services that are better than Telegram. Ones that are community-powered, like Mastodon and the fediverse. Ones that don't have a profit motive at all, like the non-profit Mozilla. And most importantly, ones that fully embrace end-to-end encryption as the standard rather than an option. For that, Signal Private Messenger remains our top pick.
Telegram spun text messaging into a platform that has been at the center of many social movements. It's fun and it's powerful, but competitors have built better (but less social) secure messengers.
Like What You're Reading?
Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.
This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of Use and Privacy Policy. You may unsubscribe from the newsletters at any time.
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!
Sign up for other newsletters
