Your question raises two more:
- Have genuine activists, researchers, etc., gone to prison or disappeared (never to be seen in public again—like a mystery)?
- It’s not a matter of “trusting”; it’s: Are they really doing something about it, or is it just a pretext for those purposes…?
I’ll leave it at that. It all depends on the facts.
Unlikely. Even when equipped with Telegram data. The IP they receive is only the last login IP and not necessarily from relevant timestamps. If the phone number linked to the account isn’t a number that can be linked to them from another data source they are pretty much getting nothing useful. They would need strong corroboration to justify a search warrant and seize the device to figure out the alleged involvement.
No the biggest threat is Telegram itself having access to 800M users data. For Signal to leak data to server equally badly, it would have to be backdoored. Any intelligence agency that pwns Teleram’s servers can read the private lives of every Telegram user. Every group chat. Every desktop chat. Every chat by default.
Funny how you claim people are smart enough to assess Telegram’s privacy wrt phone number privacy by using niché SMS verification services, and also how you say most people are also smart to link their Telegram accounts to phone numbers controlled by niché SMS verification companies that never reuse phone numbers allowing e.g. Islamic State to hijack accounts. I’d understand if Telegram at least forced user to set the 2FA cloud password to prevent simple SMS sidejacking attacks over the famously secure SS7 network (/s), but no.
We’re talking about multi-billion dollar companies not some junior sysadmin that just opened his linux server to the internet.
Yeah, even massive corporations’ systems can be pwned, and that includes Telegram that has massive amount of user data sitting on its servers in plaintext. If only there was a better way.
That’s a good thing.
No it’s not. It wears them down and they stop using it altogether. Why do you think practically all other private messaging apps are defaulting to E2EE for everything on all platforms?
Will encourage them not to keep secure convos all over the place.
That journalist was using touch ID on her laptop which is not protected from LEA forcing the finger on the reader. 81% of people use biometrics on their phone. Both can (and should) be password protected. That article did not back your claim that desktops are inherently worse for security, so why link it?
All that E2EE marketing gets unexperienced users too relaxed and it catches them at the worst moment.
So the real private way is to not offer E2EE for the super-duper secure phone by default? And the group chats small enough to enjoy expectation of privacy are also not E2EE on the super-duper secure phone?
If Telegram’s E2EE is so superior, why isn’t it post-quantum, or using double-ratchet? Why is it engineered by a geometrician nepo-bro of the CEO instead of best cryptographer Durov’s billions can buy? Why is its history riddled with ridiculous security issues like the IND-CCA vulnerability, 64-bit MITM attack? Why use SHA-1, or AES-IGE over AES-GCM? Why did Telegram attempt to prove its security with a snake-oil cracking contest, instead of providing an academic paper with proper security proofs? Care to gaslight us on how that shit design is in reality a misunderstood work by a genius?
E2EE marketing
People are using Telegram thinking it’s more private than WhatsApp that uses E2EE for everything. Telegram’s marketing has duped them into oversharing their private lives to Telegram. If they knew Telegram was collecting same amount of data about their chats as Facebook does, they’d be outraged. It’s Telegram that has succeeded in very careful grassroots marketing to convince people it’s private while it leaks everything to the Mark Zuckerberg of Russia.
Most people use a cheap sms verification service like @SMSPool
Yes and I’m sure you have some really reliable statistics to back that claim. SMSPool has less than 50k downloads for Android. Apple’s App Store has total of 17 reviews. Telegram claims to have 800,000,000 users. Most would imply way over 400M users use these services. The best example you can link to us is miles below niché popularity.
If people understood nuances of anonymizing their SIMs from the “super-duper secure” Telegram, they’d understand it’s not really private at all, as explained e.g. by Matt Green here: Is Telegram really an encrypted messaging app? – A Few Thoughts on Cryptographic Engineering
Why are you defending Telegram? What’s your affiliation with them?
The question of all questions: does Telegram divulge push tokens when they receive a subpoena for a specific account, and vice-versa, do they allow identifying accounts if they receive a subpoena solely with push token as identifier?
It’s noble of them not to bend the knee over surrendering message content. I think journalists and activists would be keen to know whether they can safely use push notifications on Telegram. I don’t see anything support one way or another, but maybe someone here came across something.
No journalist should use Telegram.
You’re responding to points I didn’t make. I never claimed Telegram’s encryption is superior, never said most people use niche SMS services like SMSPool for anonymity (you can still be profiled from SMSPool if not using it correctly), and never argued that people are “smart enough” to properly anonymize Telegram accounts. Those are not my positions in this thread. What my original post and the court document actually show is narrow and concrete:
That’s the limited scope of what was being discussed. Server-side disclosure under legal process and residual data after app deletion. Not a general endorsement of Telegram as a privacy tool, not a defense of its default cloud chats, and not a claim about its cryptography.
WhatsApp is default E2EE yet accepts pen register requests aka near real-time surveillance.
Multi-device E2EE sync improves convenience but expands the attack surface as we’ve seen with the reporter. A poorly secured secondary device can completely undermine the E2EE of the primary device.
The same could be said about Signal. On Signal the oversharing stays on the devices, but those devices are still vulnerable to seizure, malware, or user error just like Telegram. If anything people believing they’re safe in a E2EE groupchat has fooled people the most.
Legal documents as recent as 3 weeks ago shows them not giving it though. Facebook messenger uses Signal protocol but with all the other data they actively give to law enforcement + device seizure I doubt it would matter.
Let’s not forget about Telegrams data deletion advantage. You can wake up a year later and easily clear entire chat histories off both parties devices and configure self destruct account as low as 1 month. Deleting the app itself gets rid of the device seizure issue as shown in this case.
I need the ability to erase my messages from their phone later if things go bad. Yes, screenshots exists but screenshots aren’t forensically sound so at least in the USA I have an argument. If they use a unofficial client to somehow retain the messages after deletion that makes my legal argument even stronger.
Apple didn’t fix the incoming notification leak that exposed a Signal user until April 2026. This case is from 2024 and they got nothing useful.
While I can agree that Telegram is not more “secure” than Signal I think it’s still better for a unexperienced user because:
By making Secret Chats a deliberate choice with that green lock and different interface, Telegram forces people to actually decide: “Okay, this conversation is different. I’m accepting the limitations (no cloud, no multi-device, no groups) for extra protection.”
That visual and functional difference can act as a reminder to be more careful: shorter messages, less oversharing, treating the chat as higher-stakes.
In apps where everything is E2EE by default, the protection is invisible. People get used to it, start treating every chat the same, leave long histories and media sitting around, and stop thinking about sensitivity because “it’s encrypted anyway.” There’s no clear signal that says “handle this one with more caution.”
Telegram is used more like a social media network than a private messenger so this shouldn’t even be a argument.
Yes this was my only point in the thread. We see a major company refusing to give something they technically have access to and sticking to their privacy policy.
Do you have any information based on your research whether Telegram allows law enforcement to de-anonymize users based on push tokens? All cases I can find, law enforcement usually has an username or phone number.
I have not seen a case of them identifying someone based off a push token. I’m still digging up a lot of cases where telegram/signal was involved so I’ll let you know.
True, but you did imply their idea of not deploying cross-platform E2EE is superior. I showed they are amateurs in general, and that their approach is more dangerous.
You still said most people use it, and you’re skating around that most means over half which means >400M, but you did not back that with any claim.
Yes and they also have the messages ready to be handed over as soon as the prosecution realizes “we cannot comply” is not because it’s genuinely impossible, but based on “we won’t bother adding a write chat to logfile” function. Telegram is in possession of the message and can provide it upon request. Doing the bare minimum any company does to comply with subpoenas for data they possess to provide evidence, makes arguing “it’s compelled speech” quite weak defense.
WhatsApp is default E2EE yet accepts pen register requests aka near real-time surveillance.
Yes WhatsApp can access E2EE message’s metadata, like ALL centralized E2EE messengers, in principle, can. Funny how you just casually omit the metadata part of that bullet point. This isn’t news. If you want full metadata protection from vendor, your ~only option is to use Tor-based messengers like Ricochet Refresh, Briar, Cwtch, OnionShare Chats, TFC.
But what about the limited content? FBI can gain ‘limited’ access to private WhatsApp and Apple iMessage conversations, document claims | The Independent It’s just the iCloud backups if user opts in to backup their messages to iCloud. Now imagine if Telegram’s system uploaded ALL messages by default to the cloud? Or uploaded all group messages, and all desktop messages to the cloud with no chance to opt out?
And yet again you ignore the teeny-tiny attack surface that is 800,000,000 users data on Telegram servers.
Again missing the point that the UX is so horrible overwhelming majority of people won’t use secret chats, leading to same cross-platform device attack surface plus the telegram server which is the juicy part. Going after individual users’ devices is a targeted attack, and users who have such threat model need OPSEC training from their employer. Nobody’s forcing you to use multiple devices if you think that’s going to weaken your security either.
The seizure is protected by the password you’re supposed to use. Against adversaries that compromise endpoints with malware or exploits, networked TCB is poor architecture. If only there was someone who had actually worked on this particular problem.
If you’re referring to old men adding journalists into their groups, it’s hardly the fault of Signal. Small groups still enjoy expectation of privacy even though Telegram doesn’t provide it.
Yeah they can give the same metadata all E2EE centralized platforms can: metadata.
Also:
Secret Conversations is a distinct conversation mode inside
Facebook Messenger.
Secret Conversations relies upon the Signal Protocol. Messen-
ger uses Signal Protocol’s implementation as available in the open-
source libsignal-protocol-java and libsignal-protocol-c libraries for Android
and iOS respectively.
It’s opt-in and phone only. Just like Telegram. Signal protocol is superior to Telegram’s encryption, so we could argue Telegram is about as secure as Messenger. I will grant that TG is open source so it’s easier to verify the crappy implementation.
Let’s not forget about Telegrams data deletion advantage. You can wake up a year later and easily clear entire chat histories off both parties devices
This is just a setting that makes the message no longer requestable from the server. If the server is your adversary, or if your adversary pwns the server, its not helping you at all.
Only if user has enabled 2FA password. LEA can still intercept the account registration SMS if they reassign the phone number to new SIM:
The first concerns legally authorized real-time interception of what we call “data in motion,” such as phone calls, e-mail, text messages and chat sessions in transit.
With E2EE messaging apps, deleting the app means the data is gone for good. It’s called the puddle test.
Not a fault in Signal.
Cute, but now you’re leaking to Telegram metadata about the intent to hide content from Telegram as the vendor, and that metadata is very revealing in of itself. With Signal, when everything is E2EE by default, secret conversations disappear amidst cookie recipes you exchange with grandma.
No they won’t 
If you have something really private going on you’re obviously going to enable disappearing messages which solves device seizure and long term data leak issues. The topic discussed sets the security requirements for the chat. And you definitely don’t want to leak the metadata about having really really secure chats with a journalist.
No that’s what Telegram tries so hard to imply. They call both client server encryption and E2EE MTProto, so they can say the E2EE protocol is called MTProto, and all chats are MTProto.
Yes that’s why it looks like a secure messaging app, is advertised as “heavily” encrypted, and has a ton of people online arguing it’s super safe messaging app.
TG has huge communities around it. Which normalizes it, and when large communities splinter into groups of friends, those new smaller group chats have higher expectation of privacy. And those groups of friends way too rarely move to something like Signal to keep the private discussion private. That makes Telegram’s great UX and no security scary. It’s easy to stay there to enjoy all the cool sticker memes that you built together and the GIFs and shared channels and other groups. It’s a shiny, shiny roach motel with more microphones than the Viru Hotel in Tallinn had.
Since you seem to be avoiding the question I’ll ask again: What is your affiliation with Telegram?
Real ones know that Telegram had always been goated. They never complied with any law enforcement requests until Pavel Durov’s arrest, which I do not blame him for.
I’ve noticed that most people who criticize Telegram have never even used Telegram. These are usually individuals from the U.S. or the West in general. They have never really used Telegram or don’t know anyone who uses Telegram, and because of that, they just assume it’s like every other app.
Telegram is a very unique app in the sense that it almost feels too good to be true. They genuinely do not care what you do on there. There is no AI scanning your messages, not to even talk about their generous file upload limits. I’m even sure that Pavel Durov himself made Telegram support pretty much non-existent for this purpose. It is very, very difficult to talk to a human at Telegram.
They did not comply with law enforcement requests, and it is just an amazing app. So it always pains me as a Telegram user when I see people hating on Telegram because I genuinely believe that Pavel Durov himself is practicing what he believes in, free speech.
Hi Pavel 
There’s a good saying about this…
Funny how real cryptographers say the complete opposite.
Yeah that’s why the CEO was arrested. He facilitated child porn groups there for over a decade.
Except they are scanning your chats, and rightfully so. They can, so they should:
The technical issues of Telegram have very little to do with nationality of the person presenting the critique.
Yeah amazing how the big brother let’s you upload almost any size file from your private file collection to him.
Yes lack of customer service is always how you can tell a great company
Funny how two journalists went to crash their office and eventually found out that the company in the next door office had never seen anyone enter or leave Telegram’s office https://www.youtube.com/watch?v=Pg8mWJUM7x4
For once, I’d like to see some evidence that refutes the theory that Telegram is an FSB op that’s developed from Moscow and only registered in Dubai.
Like, ubiquitous end-to-end encryption for everything, open source clients with good documentation and docstrings, and reproducible builds and post-quantum key exchanges and double ratchet. You know, the usual private messenger stuff.
He built his wealth by spying on VKontakte users just like Facebook did. He then built an unencrypted messenger that collects the daily discussions of 800 million users, and sells it as heavily encrypted.
A password is not needed if your device is in a AFU state and LE has Cellebrite/Graykey in their possesion. This is a threat to any app installed on a device that uses ProtectedUntilFirstUserAuthentication data protection class (iOS) aka almost every app for user convience.
This article is misleading, Telegram has been hash scanning for known CSAM since 2018 in public group chats and channels where there is no expectation of privacy. They expanded the databases after CEO arrest. They do not automate reports to NCMEC otherwise the guy in this case would have 100 tips on him.
Yes, the fact no one knows a single Telegram staff member makes your snowden era paranoia claims even more less likely. The threat actors you keep mentioning are using Telegram themselves to broadcast their attacks on other companies lol.
lol idk how to reply to specific sections but here we go
soo
I mean, some of what you said is right on paper, but isn’t all of this technically useless at the moment if Telegram, at the end of the day, does not comply? Because right now, a lot of it is still just you theorising..eg how you said that all the messages are being scanned and that things like that are happening. There is no actual proof of that.
Also, The way you are wording your points, some of the articles you are referencing don’t actually validate your claims. For example, when I said Telegram does not do AI scanning, your reply implied that they do, and then you referenced an article. But the article did not actually prove that. It only said that Telegram removed something from their page, which does not automatically prove that they are doing AI scanning.
Look, I don’t know. The Telegram hate is just crazy to me. Technically, you are right that privacy should be based on a zero-trust model. I wouldn’t really recommend Telegram if someone is looking for maximum privacy because, at the end of the day, it is still based on a “trust me bro” approach. You are trusting that nothing bad will happen in the future, which is not necessarily the strongest privacy model.
But at the same time, Telegram has had one of the best track records so far. A lot of people who love Telegram love it because of things like the huge file size limits and the overall experience.
I also still stand by my point that a lot of people who criticize Telegram are from the U.S. or Western countries and have never actually used Telegram. And when I say that, I don’t mean someone’s nationality determines whether their criticism is valid. I mean that a lot of the criticism comes from people who have never personally used the platform thrmselves.
Even looking through this thread, it feels like a lot of people have never used Telegram because they are surprised by what i would consider basic. To me, you have to actually use something yourself before making a definitive conclusion about it. There are just so many small things Telegram has done over the years that have built up that trust among its users.
For example, I don’t think I’ve ever seen Telegram run ads. It has mostly grown through word of mouth. Pavel Durov made money from VKontakte and then built Telegram. He has also talked about how the Russian government contacted him about VKontakte and pressured him over access, and that he refused, which eventually led to him losing control of the company.
I don’t know, it’s just the way you word some of your replies that feels off. It’s not that the points themselves are completely wrong, but the way they are presented sometimes makes it seem like you are assuming the worst without enough evidence.
Like, you said that he “facilitated CSAM for over a decade,” but the way you phrased it makes it sound like he personally did that or was directly responsible for it.
It’s not even necessarily the point you’re trying to make; it’s the way you’re framing it. The wording gives a much stronger implication than what you have actually proven. You also don’t have concrete proof yourself, and I would even go as far as saying that this is spreading misinformation in a way.
That’s not how security proofs work in this field. Real privacy isn’t based on policy “we won’t look at the chats until someone reports illegal content”, it’s based on capability “we couldn’t look at the chats even if we tried”.
I’m glad we agree. I’d love to recommend Telegram, but I can’t. They haven’t done the work all other private messaging app providers have done when they have deployed E2EE for everything.
That you know of. When NSA TAO or Russian Fancy Bear hacks the server to read your private life, they won’t tell the world. And neither will Telegram. They have no solution to offer to that problem outside not telling you, if they can even detect the attack themselves.
The problem is you’re just stating that. You’re not even addressing the technical critique. When I say Telegram’s secret chats are UX nightmare, I say that because I tried using them but gave up.
They have made exactly zero progress to making everything E2EE by default since they started, 13 years ago. They have the money to get it done. They just lack the know-how and will to hire someone who will. And that’s how you young people say, sus af.
Isn’t it suspicious to you almost one billion people can upload terabytes of data to the servers every day and it just keeps afloat over few subscriptions we have not stats about.
Yeah he made the surveillance platform. He spied on his users habits, built profiles, and displayed targeted ads. That’s who he is. Tech oligarchs don’t grow conscience overnight. If he wants to prove it, he should deploy the E2EE for everything to prove he stands behind his words for user privacy and freedom of speech.
The buck stops at the top. It’s his job to know what’s going on on his platform he can monitor.
I never said he built it for them. I said he knew about it and ignored the problem even though he could’ve done something about it. That’s enough.
No you’re just twisting my words.
Telegram Premium
Sponsored Messages
Telegram Stars
In-App Purchases
TON Ecosystem & Fragment
Deduplication
Heavy compression
Actually deleting account data for good and not retaining copies
What is your affiliation with Telegram?
Not directly relevant, but since the OP mentioned that TG allows users to delete their messages regardless of how old they are, certain TG clients that break the ToS allows users to retain those deleted messages. Examples are NagramX and Ayugram. Some other might exist, but those two are the ones I’m sure of, and have been using.
It generally isn’t a good idea that trying to force delete messages on both parties is technically reliable and feasible. Even Signal is susceptible. I’ve seen other people personally modifying the Signal client so that deleted messages(both from the user or the admin) can still be seen, just marking them as deleted instead of actually deleting them. The best is not to send the data in the first place, and it’s the only way.
I covered this part too. This feature has probably saved so many people from becoming co-conspirators.
