Dear Hong Kong Activists, Please Stop Telling Everyone Telegram is Secure · Global Voices
Written by <PERSON> and <PERSON>. The original version of this post, written in Chinese, was published on inmediahk.net on 4 August 2016. English version is published on Global Voices under a content partnership agreement.
At this year's annual July 1 march in Hong Kong, protest leaders made a big push for mobile chat app Telegram, but for all the wrong reasons. The rally has taken place every year since the UK relinquished power over Hong Kong to China in 1997.
While we marched across Hong Kong Island, voices on a megaphone kept shouting, “download Telegram, it is more secure than WhatsApp!”
A civic group, Citizen Data, urged protesters to download Telegram and activate its geolocation function so that we could “check-in” to the protest.
As we passed the booths of various political and civil society groups on the road, they told us to befriend Telegram bots (automated Telegram accounts that perform simple functions, like image searches or RSS-like updates.) One bot allowed attendees to signal their participation at the march. Another polled voters about their top picks in the upcoming Legislative Council elections.
While we marched across Hong Kong Island, voices on a megaphone kept shouting, “download Telegram, it is more secure than WhatsApp!”
While these new grassroots-organizing tools can seem exciting, they were misleading protesters about one piece of crucial information: Telegram is not more secure than Whatsapp. In many circumstances, it's worse.
Telegram first made waves on the tech scene as a fast, user-friendly “free and secure” messaging app way back in 2013. Data security, specifically its encryption features, were highlighted by tech media as one of its big selling points
Despite its reputation, many conversations on Telegram are not end-to-end encrypted — in other words, not secure. And to make matters worse, the company has developed a reputation for problems with its technology that have led some users to have their information and messages exposed, in some cases to other users.
Over the past year, Global Voices has reported on multiple instances of Telegram users running into serious trouble with the app's security. Telegram users in Russia — some of them journalists and activists — have reported that their accounts were hacked. Another user in Ukraine reported receiving private group messages through her Telegram app for a group that she was not part of. 534
And there has been concern in Iran about the company's compliance with government requests for certain material — bots mainly — to be blocked on the platform.
What's the problem with Telegram?
Telegram's encryption technology is not entirely open source — this means that security experts outside the company can’t see all the details of how it was made. Industry best practices hold that encryption technology should be open source and fully accessible to the public, so that they can be independently tested and verified by other programmers and security researchers. So even though Telegram says their messaging technology is secure, there's no way to know this for sure. You just have to trust them.
In contrast, apps like Signal and ChatSecure have published their code online, so that anyone with technical know-how can review (and critique) it publicly.
Even if you do trust Telegram, its security features are limited.
* Only “New Secret Chats” in Telegram are secure. By default, conversations on Telegram are not protected by end-to-end encryption. This is only guaranteed if you turn on “New Secret Chat” before beginning a conversation. Many people we spoke with were not aware of this discrepancy – they think that all communication within Telegram is “automatically” secure.
* Group chats have no end-to-end encryption support. There is no “secret chat” option for conversations involving more than one person.
* Conversations with bots are not end-to-end encrypted either. There’s no indication that any conversations or interaction with bots is end-to-end encrypted.
Researchers also have confirmed that the app collects users’ metadata — information about who they communicate with, and when — making it relatively easy for Telegram users to monitor each other’s communication habits.
Returning to Hong Kong, it's easy to see how these problems could be exacerbated in a protest situation. If an app is easily hackable, all of the information that promoters were urging protesters to share — including their locations — could potentially be exposed to the wrong person, or to government authorities. Location data is very sensitive as it can be traced back to a particular user and jeopardize personal safety.
Anyone doing political activism in Hong Kong knows that the consequences of this kind of breach can be severe.
Ironically, WhatsApp, which was criticized at the march, automatically applies end-to-end encryption to all of its conversations, including its group chats. 534