HN Explorer

Tell HN: Telegram is most likely doing client side scanning; I quit Telegram

63 points by stereoradonc ↗ HN
For years I have ignored warnings around Telegram being "unencrypted". Though, for unknown reasons, they first banned my account and then recently, "restricted" my account. Yesterday, I had a private chat with someone and based on specific keywords, Telegram suddenly "restricted" my account. While not explicitly "censorship" (or even remotely illegal), Telegram is likely doing scanning in private chats. This was a red line and I quit the platform.

30 comments

[ 2.1 ms ] story [ 97.7 ms ] thread
int_19h
Telegram is encrypted if you tell it to be. Did you?
itake
OP hints that the keyword checks are on-device, which would not be protected by e2ee.
nu11ptr
Is the client not open source?
itake
they are.. OP could check the code to confirm though.
Gigachad
Kinda, not really. It’s different per version of the client. The source on GitHub is usually super out of date and it’s unlikely the distributed version is built off the GitHub source unmodified.
quyleanh
They just did delay pushing the latest version of source code, didn't they? I remember there is a help page which instructs you to compare the source of both GitHub and clients version.
nixosbestos
> For years I have ignored warnings around Telegram being "unencrypted"

Guess what the people reading this thread, using Telegram, are going to do.

Diti
Telegram user here. I’ll keep using the app with no end-to-end encryption, like usual. It’s widely known by now (I think) that Telegram doesn’t have default E2E encryption. Personally, I stay on it because of the network effect (staying on the same network as my friends).
hu3
Plus the user experience is, imo, the best in class.

The client is open source in C++ which explains why it runs laps around Electron apps: https://github.com/telegramdesktop/tdesktop

It's so quick and intuitive.

Plus writing interactive bots for it is trivial.

oskarkk
I love many small features of Telegram.

Telegram had replies to messages before Messenger, WhatsApp, and probably other similar apps (they said they were "the first" or something). Replies in Telegram are very nice to use. In the chat view, you have this standard floating down-arrow which scrolls to the bottom of the chat when you click. When you see a message which is a reply, and you click the preview of the message that was replied to, you jump to it, and then the floating arrow won't take you to the bottom of the chat, but to the reply from which you've jumped. And it works for more than one jump, so you can kinda navigate chains of replies.

Also, jumping to even very old messages is much much faster than in the other chat apps. On the desktop client, when you scroll up there is a floating date at the top, when you click it, a calendar appears, there you can jump to any day in the chat, and again the jump feels instant, like no loading. On the Android app, clicking on the floating date jumps to the beginning of the day, but you also can access the calendar by a button that is shown when you are in search mode. By the way, searching also feels instant.

This year, they added a new mode of replying by quoting only a part of the message, so you can select some words from the message and reply to them (you can do it on mobile too). Another new mode is replying to messages from other chats, so for example you can quote and link to the message from group chat in some private chat.

I could go on and on about features like these.

hu3
> On the desktop client, when you scroll up there is a floating date at the top, when you click it, a calendar appears.

My mind just blew, again. TIL. Thank you!

> you can select some words from the message and reply to them

TIL also! neat.

jkmartindale
I'm a bit fuzzy on the details, but late July/early August 2023 there were rumors in certain circles regarding a potential Telegram session takeover exploit or some other scary weirdness. It ended up being a keyword (or probably URL) that was on Telegram's blocklist. Sending it to someone in a private chat resulted in account restrictions or session terminations, iirc.

Seems like instead of having a functioning moderation team, Telegram uses extremely lazy automation and hopes nobody will care.

myself248
Can you share some words that might trigger it, without doxing yourself? I have a Telegram account IDGAF about and it'd be entertaining to see if it gets zorched.
quyleanh
Talking to "unencrypted", may I ask, by default, for normal chat, all the text, image, video, sticker is uploaded to Telegram server without encryption? Or they are encrypted/hashed/salted but the decryption key is on Telegram side?
Tiberium
It's the latter, there is encryption for everything but of course Telegram has the keys. But I don't think there's information if Telegram stores data encrypted or not.
tmottabr
no it is not..

There is E2E encryption for private ono on one conversations, but it is off by default and the option to enable it is buried behind a few screens ans several clicks..

And it is completely unavailable for group chats..

If you want more details, Matthew Green, the famous cryptographer from Johns Hopkins University have reviewed it recently

https://blog.cryptographyengineering.com/2024/08/25/telegram...

Tiberium
What do you mean "it's not"? We're not talking about E2E encryption specifically, just any encryption. MTProto uses encryption.
tmottabr
MTProto is the protocol used for secure chats, that is the name of their E2E encryption..

If you do not enable E2E it will not use MTProto and not have E2E encryption.

And all of this is only available for private chats, none is available for groups chats..

Tiberium
I'm sorry, but MTProto isn't just used for E2E chats. It's the actual main protocol that Telegram uses for everything. And yes, for non-secure chats there will be no E2E, but the question was about encryption, not end to end encryption.
tmottabr
communication between client and server is always encrypted and they don't even need MTProto for that, a simple TLS connection would be more then enough, and likely better. Also, that is likely true for all modern messaging apps..

The question proposed is that Telegram was monitoring private chats on the client side, but they do not need to do that unless E2E is enabled..

If you do not have E2E enabled then everything you send is in the open while in their servers..

So, if you do not have private chat enabled then Telegram does not need to make any type of client side monitoring, they can just monitor what is going trough their servers because it is all in the open..

ac130kz
I have to flag the post:

1) It is encrypted, if you initiate an encrypted chat, which is not the default.

2) The clients are open source, you can even write your own TUI around the API.

Buxato
Encrypted chats are not available in all clients of Telegram, like Linux desktop one.
Tiberium
Private chats aren't E2E. But anyhow, why do you think you were restricted based on specific keywords? And how does that restriction look like? Can you please check your access with @SpamBot ? Because in Telegram, if you PM someone, they have a big red button that'll block you and report you for spam - and Telegram often temporarily restricts accounts for reported unsolicited PMs.

Oh, and the title is misleading, there's no such thing done on the client side for sure.