This blog is reserved for more serious things, and ordinarily I wouldn’t spend time on questions like the above. But much as I’d like to spend my time writing about exciting topics, som…
Blog post by crypto professor Matthew Green, discussing what Telegram does (I wasn't familiar with it) and criticizing its cryptography. He says Telegram by default is not end-to-end encrypted. It does have an end-to-end "secret chat" feature, but it's a nuisance to activate and only works for two-person chats (not groups) where both people are online when the chat starts.
It still isn't clear to me why Telegram's founder was arrested. Green expresses some concern over that but doesn't give any details that weren't in the headlines.
Telegram’s encryption isn’t open source, so no one can verify it’s soundness or risks.
This is not true, it is available in the open-source Telegram clients.
What you probably mean is that it is using an unusual and not well studied encryption algorithm. This means you need to be a real cryptography expert to spot flaws in it.
Telegram justifies this with a bit of FUD about well known encryption algorithm being NSA sponsored etc, but when cryptography experts did look at Telegram's homegrown algorithm they were less than impressed.
As I recall, Telegram put up bounties for people actually demonstrating exploits in its encryption. Have any of these cryptography experts actually shown exploits?
We really don't need more than #3 for a reason to stay far away from Telegram. Security through obscurity is not security, and neither is rolling your own crypto.
Are there any programs that can do e2e in a group chat? My limited knowledge of e2e and encryption makes me think that'd be extremely difficult and even clunkier
Element (really any Matrix client that supports e2ee) but rooms with hundreds I'd people and having encryption enabled is going to to have lots of messages with key exchange errors.
Group chat is a tricky problem and the modern crypto group (moderncrypto.org) talked about it at great length a few years back. I don't know whether any software exists that incorporates all those ideas, but that's mostly because I haven't really been looking for it.
PGP/GPG encryption. It works with any IM, social network, anything (at least if the platform/program/app/medium allows for sufficiently lengthy messages so to carry the encrypted payload). There are some IMs that bring PGP/GPG natively, as well as extensions for existing IMs that also adds PGP/GPG feature, but PGP/GPG doesn't need to be native to the app to convey encrypted messages, it's a base64 text. It's really an E2EE.
There is a reason the Russian government allow the use of it and even let their military use it - and it is not due to security! They have a backdoor into the chats and UAE it actively for listening in on things and spreading propaganda and disinformation.
Functionality-wise it definitely is, but secure wise no. There's probably same kind of tracking for profit going on in the background like with WhatsApp and signal. SimpleX is a better alternative privacy and security wise, but it's still in heavy development
SaaSub is when you have a server do your computing for you. This is just delivering messages. You technically could make a Telegram server if you were motivated enough. The server is just a relay for the most part.