Trick to securing Telegram is to turn on ‘secret chat’

The arrest of Pavel Durov, jet-setting billionaire and the CEO of messaging app Telegram, has sent shockwaves through the tech world. At the same time many are going, Telegram? Never heard of it. Well, it’s basically like WhatsApp, but not for the uncles. No one will know what you sent?| Telegram is immensely popular among those trying to fly under the radar of copyright-conscious big entertainment, the surveillance state, and the surveillance family of parents and spouses. This niche popularity is because of its very lax content moderation (“anything goes”) and the security of messaging it promises its users (“no one will know what you sent”). Except the last bit is not entirely true. Unless you explicitly enable a feature called “Secret Chat” – and which average user would know to do that? – Telegram could potentially see what you sent. This also means law enforcement can pressure it to divulge users’ data. But seriously, who cares? I am a law-abiding citizen, and, anyway, I use WhatsApp for my health misinformation, fake political news, and totally true neighborhood gossip.Well, you should care, and let me tell you why. We live in an era where Big Tech’s influence on our lives can be as profound as that of govt. If Google removes you from its search engine, you do not exist as a business. If you give an insecure password, your life savings can vanish in a flash. What is a benign thing to say in a communication channel today might be dynamite when govt changes. The confluence of govt and tech affects our lives without us often being aware of it, and it becomes contingent upon us, digital citizens, to know our rights and obligations so that we may be protected. So yes, tech may be boring, but be ignorant of it at your peril. Let’s get technical: What prevents a third person, C, from reading a message between A and B? Encryption. Encryption garbles the message, with only those who possess the encryption key having the power to read it. In end-to-end encryption for messages, only A and B have the key, and hence, only the two parties in the communication can read the messages.In Telegram, marketed otherwise as an ultra-secure messaging platform, end-to-end encryption is not turned on by default; you need to explicitly enable it per conversation (which means most people don’t). If there is no end-to-end encryption, any communication between two parties will be vulnerable to hackers who can break into your service providers’ servers illegally or govts who can serve notice to them legally.Messaging services today should have end-to-end encryption enabled out of the box. Anything else is expecting too much of users. Even good old WhatsApp is nice enough to have end-to-end encryption turned on by default, and this is despite the fact that Baba Zuck has a bad reputation for wanting to peek at your data.This article is more than a lecture on cybersecurity. But if you are really concerned about the privacy of your texts, pictures, and videos, aspire to enable what is known as client-side encryption of your data. This means you and only you have the key to decrypt your data, not your cloud service provider – iCloud or Google Account. In server-side encryption (the opposite of client-side encryption), the provider has the key, which means, again, they can access your data voluntarily or involuntarily.As an example of client-side encryption, WhatsApp, in addition to protecting messages end-to-end by default, can also protect your backup with end-to-end encryption (an option in WhatsApp settings). Once you enable that option, when WhatsApp backs up your messages to iCloud or Google Account, they are encrypted by a key stored on your phone, which in turn is unlocked by a password you set. Be careful not to lose the password: If you need to restore your messages from a backup, like when you get a new phone, and you cannot remember the damn password you set five years ago, you will lose all your past conversations. Invest in a password manager for precisely this reason. Anyway, that has always been the problem with security. It is locked in an eternal cosmic conflict with usability and speed. But as the great Baazigar said, sometimes, to win, you need to lose, and it is up to us to find the balance between the “just works” convenience of modern tech and the overhead of educating yourself on how things work and how they can be made to work against you.The writer is a cybersecurity professional based in Los Angeles