Telegram
Creative Arts Solution
FOUNDATION
a non-governmental foundation
Telegram
Sign Up
@olusoladavidayibiowu
Telegram is a non-profit[15][16] cloud-based instant messaging service. Telegram client apps are available for Android, iOS, Windows Phone, Windows NT, macOS and Linux.[14] Users can send messages and exchange photos, videos, stickers, audio and files of any type.
Telegram was founded by the Russian entrepreneur Pavel Durov.[17] Its client-side code is open-source software but the source code for recent versions is not always immediately published,[18] whereas its server-side code is closed-source and proprietary.[19] The service also provides APIs to independent developers. In February 2016, Telegram stated that it had 100 million monthly active users, sending 15 billion messages per day. According to its CEO, as of April 2017, Telegram has more than 50% annual growth rate.[20]
Telegram's security model has received notable criticism by cryptography experts.[who?] They have argued that it is undermined by its use of a custom-designed encryption protocol that has not been proven reliable and secure, by storing all messages on its servers by default and by not enabling end-to-end encryption for messages by default. Pavel Durov has argued that this is because it helps to avoid third-party unsecure backups, and to allow users to access messages and files from any device.[21] Messages in Telegram are server-client encrypted by default,[22] and the service provides end-to-end encryption for voice calls[23] and optional end-to-end encrypted "secret" chats.[24]
History
Development
Telegram was launched in 2013 by the brothers Nikolai and Pavel Durov, who had previously founded the Russian social network VK, but had to leave the company after it was taken over by the Mail.ru Group.[25][26] Nikolai Durov created the MTProto protocol that is the basis for the messenger, while Pavel provided financial support and infrastructure through his Digital Fortress fund.[27]Telegram is registered as both an English LLP[28] and an American LLC.[29] It does not disclose where it rents offices or which legal entities it uses to rent them, citing the need to "shelter the team from unnecessary influence" and protect users from governmental data requests.[30] Pavel Durov has said that the service was headquartered in Berlin, Germany, in 2015[31] and early 2015, but moved to different jurisdictions after failing to obtain residence permits for everyone on the team.[32] Durov left Russia and is said to be moving from country to country with a small group of computer programmers.[25] According to press reports, Telegram had employees in St. Petersburg.[32] The Telegram team is currently based in Dubai.[33]
In December 2017 Cointelegraph reported, that Telegram was planning to launch a blockchain platform and native cryptocurrency[34] that in January 2018 TechCrunch confirmed, referring to multiple sources, [35] To fund the TON launch, Telegram is said to be planning an ICO. The platform is said to be based on an entirely new blockchain and may be called the "Telegram Open Network" (TON), while the TON currency may be called "Gram".[35] Telegram plans to raise $3 billion during ICO.[36]
Usage numbers
Features
Account
Telegram accounts are tied to telephone numbers and are verified by SMS or phone call.[42] Users can add multiple devices to their account and receive messages on each one. Connected devices can be removed individually or all at once. The associated number can be changed at any time and when doing so, the user's contacts will receive the new number automatically.[42][43][44] In addition, a user can set up an alias that allows them to send and receive messages without exposing their phone number.[45] Telegram accounts can be deleted at any time and they are deleted automatically after six months of inactivity by default, which can optionally be changed to 1 month and 12 months. Users can replace exact "last seen" timestamps with broader messages such as "last seen recently".[46]The default method of authentication that Telegram uses for logins is SMS-based single-factor authentication.[47][48] All that is needed in order to log into an account and gain access to that user's cloud-based messages is a one-time passcode that is sent via SMS to the user's phone number.[48][49] These login SMS messages are known to have been intercepted in Iran, Russia and Germany, possibly in coordination with phone companies.[49][50][51] Pavel Durov has said that Telegram users in "troubled countries" should enable two-factor authentication by creating passwords, which Telegram allows, but does not require.[49][50]
Cloud-based messages
Telegram's default messages are cloud-based and can be accessed on any of the user's connected devices. Users can share photos, videos, audio messages and other files (up to 1.5 gigabyte in size). Users can send messages to other users individually or to groups of up to 100,000 members.[52] Sent messages can be edited and deleted on both sides within 48 hours after they have been sent. This gives user an ability to correct typos and retract messages that were sent by mistake.[53] The transmission of messages to Telegram Messenger LLP's servers is encrypted with the service's MTProto protocol.[54] According to Telegram's privacy policy, "all data is stored heavily encrypted and the encryption keys in each case are stored in several other DCs in different jurisdictions. This way local engineers or physical intruders cannot get access to user data".[55] This makes the messages' security roughly comparable to that of e-mail. Here, most providers employ client-server encryption as well, however usually with the standardized protocol Transport Layer Security. E-mails may or may not be encrypted on the servers. Telegram cloud messages and media remain on the servers at least until deleted by all participants.Bots
In June 2015, Telegram launched a platform for third-party developers to create bots.[56] Bots are Telegram accounts operated by programs. They can respond to messages or mentions, can be invited into groups and can be integrated into other programs. Dutch website Tweakers reported that an invited bot can potentially read all group messages when the bot controller changes the access settings silently at a later point in time. Telegram pointed out that it considered implementing a feature that would announce such a status change within the relevant group.[57] Also there are inline bots, which can be used from any chat screen. In order to activate an inline bot, user needs to type in the message field a bot's username and query. The bot then will offer its content. User can choose from that content and send it within a chat.[58]Channels
Channels can be created for broadcasting messages to an unlimited number of subscribers.[59] Channels can be publicly available with an alias and a permanent URL so anyone can join. Users who join a channel can see the entire message history. Each message has its own view counter, showing how many users have seen this message. Users can join and leave channels at any time. Furthermore, users can mute a channel, meaning that the user will still receive messages, but won't be notified.Stickers
Stickers are cloud-based, high-definition images intended to provide more expressive emoji. When typing in an emoji, the user is offered to send the respective sticker instead. Stickers come in collections called "sets", and multiple stickers can be offered for one emoji. Telegram comes with one default sticker set,[60] but users can install additional sticker sets provided by third-party contributors. Sticker sets installed from one client become automatically available to all other clients. Sticker images use WebP file format, which is better optimized to be transmitted over internet.Drafts
Drafts are unfinished messages synced across user devices. One can start typing a message on one device and continue on another. The draft will persist in editing area on any device until it is sent or removed.[61]Secret chats
A "secret chat" confirmation notice - screenshot from Android Marshmallow.
Secret chats have to be initiated and accepted by an invitation, upon which the encryption keys for the session are exchanged. Users in a secret chat can verify that no man-in-the-middle attack has occurred by comparing pictures that visualize their public key fingerprints.[65]
According to Telegram, secret chats have supported perfect forward secrecy since December 2014. Encryption keys are periodically changed after a key has been used more than 100 times or has been in use for more than a week.[66] Old encryption keys are destroyed.[43][44][67]
Windows and Linux users are still not able to use secret chats using the official Telegram Desktop app while the official macOS-only client supports them.[68]
Secret chats are not available for groups or channels.
Telegram's local message database is not encrypted by default.[66] Some Telegram clients allow users to encrypt the local message database by setting a passphrase.[69]
Voice calls
In the end of March 2017, Telegram introduced its own voice calls. The calls are built upon the end-to-end encryption of Secret Chats. Connection is established as peer-to-peer whenever possible, otherwise the closest server to the client is used. According to Telegram, there is a neural network working to learn various technical parameters about call to provide better quality of the service for future uses. After a brief initial trial in Western Europe, voice calls are now available for use in most countries.[70]Architecture
Encryption scheme
.png)
A simplified illustration of the MTProto encryption scheme.
Servers
Telegram Messenger LLP has servers in a number of countries throughout the world to improve the response time of their service.[71] Telegram's server-side software is closed-source and proprietary. Pavel Durov has said that it would require a major architectural redesign of the server-side software to connect independent servers to the Telegram cloud.[72]Client apps
Telegram has various client apps. This list includes versions developed on official platforms backed by Telegram Messenger LLP and unofficial clients that are developed by the community. The source code of all official Telegram clients (and some of the unofficial clients) is open source and released under the GNU General Public Licence version 2 or 3.| Name | Platform(s) | Official | Source code license | Support for secret chats | Notes |
|---|---|---|---|---|---|
| Telegram | Android 2.3 or later | Yes | GPLv2 or later[73][74] | Yes | Supports tablets[75] and Android Wear smart watches.[76] |
| Telegram Messenger | iOS 6 or later | Yes | GPLv2 or later[73][77] | Yes | Launched in August 2013 for iPhone and iPod Touch and relaunched in July 2014 with support for iPad.[78] |
| Telegram X | iOS 8.0 or later, Android [79] | Yes[80] | Proprietary | Yes | An alternative Telegram client written from scratch, with higher speed, slicker animations, themes and more efficient battery use. iOS version is written with Swift. |
| Telegram Messenger | Windows Phone | Yes | GPLv2 or later[73] | Yes | |
| Telegram | Firefox OS | Yes | GPLv3[81] | No | Based on Webogram. |
| Telegram Desktop | Windows NT, macOS, and Linux | Yes | GPLv3 with OpenSSL exception[82] | No | Qt-based desktop client. The Windows NT client is a traditional desktop app published in three flavors: With installer, portable, Windows Store app |
| Telegram | macOS | Yes | GPLv2[83] | Yes | Native macOS client. |
| Telegram | Google Chrome and Chrome OS | Yes | GPLv3[81] | No | |
| Cutegram[84] | Windows, macOS, and Linux | No | GPLv3[85] | Yes | Based on Qt.[86] |
| Telegram CLI[49][87] | Linux, FreeBSD and macOS | No[73] | GPLv2[87] | Yes | Command-line interface for Telegram. |
| MadelineProto[88] | Linux, FreeBSD, Windows and macOS | No[73] | AGPLv3[88] | Yes | Telegram library with support for secret chats and telegram voice calls |
| Telegram[third-party source needed] | Ubuntu Touch | No | GPLv2[89] | Yes | Based on TelegramQML.[90] |
| Sailorgram[third-party source needed] | Sailfish OS | No | GPLv3[91] | Yes | Based on Cutegram. |
| Telegram-Purple[92] | Windows, macOS, and Linux | No | GPLv2 | Yes | Plugin for Pidgin, Adium, Finch and other Libpurple-based messengers |
| Unigram[93][94] | Windows 10, Windows 10 Mobile | No | GPLv3 | No | A Universal Windows Platform app published on Microsoft Store |
APIs
Telegram has public APIs with which developers can access the same functionality as Telegram's official apps to build their own messaging applications.[95] In February 2015, creators of the unofficial Whatsapp+ client released the Telegram Plus app, later renamed to Plus Messenger, after their original project got a cease-and-desist order from WhatsApp.[96][97] In September 2015, Samsung released a messaging application based on these APIs.[98]Telegram also offers an API that allows developers to create bots, which are accounts controlled by programs.[99][100] In February 2016, Forbes launched an AI-powered news bot that pushes popular stories to subscribers and replies to search queries with relevant articles.[101] TechCrunch launched a similar bot in March 2016.[102]
Reception
Security
Cryptography experts have expressed both doubts and criticisms on Telegram's MTProto encryption scheme, saying that deploying home-brewed and unproven cryptography may render the encryption vulnerable to bugs that potentially undermine its security, due to a lack of scrutiny.[103][104][105] It has also been suggested that Telegram did not employ developers with sufficient expertise or credibility in this field.[106]Critics have also disputed claims by Telegram that it is "more secure than mass market messengers like WhatsApp and Line",[54] because WhatsApp applies end-to-end encryption to all of its traffic by default and uses the Signal Protocol, which has been "reviewed and endorsed by leading security experts", while Telegram does neither and insecurely stores all messages, media and contacts in their cloud.[107][103][108] Since July 2016, Line has also applied end-to-end encryption to all of its messages by default.[109]
On 26 February 2014, the German consumer organization Stiftung Warentest evaluated several data-protection aspects of Telegram, along with other popular instant-messaging clients. Among the aspects considered were: the security of the data transmission, the service's terms of use, the accessibility of the source code and the distribution of the app. Telegram was rated 'critical' (kritisch) overall. The organization was favorable to Telegram's secure chats and partially open source code, but criticized the mandatory transfer of contact data to Telegram's servers and the lack of an imprint or address on the service's website. It noted that while the message data is encrypted on the device, it could not analyse the transmission due to a lack of source code.[110]
The Electronic Frontier Foundation (EFF) listed Telegram on its "Secure Messaging Scorecard" in February 2015. Telegram's default chat function received a score of 4 out of 7 points on the scorecard. It received points for having communications encrypted in transit, having its code open to independent review, having the security design properly documented, and having completed a recent independent security audit. Telegram's default chat function missed points because the communications were not encrypted with keys the provider didn't have access to, users could not verify contacts' identities, and past messages were not secure if the encryption keys were stolen. Telegram's optional secret chat function, which provides end-to-end encryption, received a score of 7 out of 7 points on the scorecard.[111] The EFF said that the results "should not be read as endorsements of individual tools or guarantees of their security", and that they were merely indications that the projects were "on the right track".[111]
In December 2015, two researchers from Aarhus University published a report in which they demonstrated that MTProto does not achieve indistinguishability under chosen-ciphertext attack (IND-CCA) or authenticated encryption.[112] The researchers stressed that the attack was of a theoretical nature and they "did not see any way of turning the attack into a full plaintext-recovery attack". Nevertheless, they said they saw "no reason why [Telegram] should use a less secure encryption scheme when more secure (and at least as efficient) solutions exist".[113] The Telegram team responded that the flaw does not affect message security[114] and that "a future patch would address the concern".[115] Telegram 4.6, released in December 2017, supports MTProto 2.0, which Telegram claims now satisfied the conditions for IND-CCA.[116]
In April 2016, accounts of several Russian opposition members were hijacked by intercepting the SMS messages used for login authorization.[49] In response, Telegram recommended using the optional two-factor authentication feature.[49] In May 2016, the Committee to Protect Journalists and Nate Cardozo, senior staff attorney at Electronic Frontier Foundation, recommended against using Telegram because of "its lack of end-to-end encryption [by default] and its use of non-standard MTProto encryption protocol, which has been publicly criticized by cryptography researchers, including Matthew Green".[103]
In June 2017, Pavel Durov claimed publicly that U.S. intelligence agencies tried to bribe the company's developers to weaken Telegram's encryption or install a backdoor during their visit to the U.S. in 2016.[117][118]
Cryptography contests
Telegram has organized two cryptography contests to challenge its own security. Third parties were asked to break the service's cryptography and disclose the information contained within a secret chat between two computer-controlled users. A reward of respectively US$200,000 and US$300,000 was offered. Both of these contests expired with no winners.[119][120] Security researcher Moxie Marlinspike and commenters on Hacker News criticized the first contest for being rigged or framed in Telegram's favor and said that Telegram's statements on the value of these contests as proof of the cryptography's quality are misleading.[121][122][123]Censorship
Completely blocked
Blocked partially (some ISPs or audio traffic)
In July 2015, it was reported that China blocked access to Telegram Messenger. According to state-owned People's Daily, Chinese human rights lawyers used Telegram to criticize the Chinese Government and the Communist Party of China.[129]
In June 2016, it was found that some ISPs in Bahrain had started to block Telegram.[130] In June 2017 the service faced serious pressure from Russian regulator Roscomnadzor, who tried to force Telegram to register in the official telecommunication services registry, which implies serious liability for a registered party. After week-long negotiations and seeming imminent blockage of the service, the conflict ceased after high officials pulled some strings with the regulator. On 14 July 2017, eleven domain name servers related to Telegram were banned by the Indonesian Communication and Information Ministry with the possibility of closing all Telegram applications in Indonesia if Telegram did not make a standard operating procedure to maintain content that was considered unlawful in the apps.[131] In August 2017, Indonesian Government has opened full access of Telegram, after Telegram has made self censorship about negative contents mainly radicalism and terrorism. Telegram said that about 10 channels/groups have been deleted from Telegram everyday due to are categorized as negative contents.[132]
In October 2017, Telegram was inaccessible to users in Pakistan,[133] and as of 17 November 2017, it has been completely blocked as per instructions from PTA, Pakistan's largest ISP, PTCL mentioned this in a tweet to a user.[134]
On December 30, 2017, during anti-government demonstrations across Iran, Telegram has shut down a channel of the Iranian opposition that published calls to use Molotov cocktails against the police, after receiving a complaint from the Iranian government. Pavel Durov explained that the reason for the blocking was a "no calls to violence" policy and confirmed that criticizing local authorities, challenging the status quo and engaging in political debate were seen as "OK" by the platform, while "promoting violence" was not.[135] The opposition group promised to comply with Telegram rules and created a new channel which amassed 700,000 subscribers in less than 24 hours.[136] On December, 31, the Iranian government announced that Telegram has been "temporarily restricted" in order to "ensure calm and security" after the company said it refused to shut down peaceful protesting channels.[137] On January, 13, the app was unblocked by an order of the president Hassan Rouhani, who said that "more than 100,000 jobs had been lost” in Iran as a result of the ban on Telegram. Channels of the opposition remain operational.[138]
Use by terrorists
In September 2015, in response to a question about the use of Telegram by Islamic State of Iraq and the Levant (ISIS), Pavel Durov stated: "I think that privacy, ultimately, and our right for privacy is more important than our fear of bad things happening, like terrorism."[139] ISIS has recommended Telegram to its supporters and members[140][141][142] and in October 2015 they were able to double the number of followers of their official channel to 9,000.[143] In November 2015, Telegram announced that it had blocked 78 public channels operated by ISIS, which were used for spreading propaganda and mass communication.[144][145][146] Telegram stated that it would block public channels and bots that are related to terrorism, but it would not honor "politically-motivated censorship" based on "local restrictions on freedom of speech" and that it allowed "peaceful expression of alternative opinions."[147] Telegram's usage for ISIS's propaganda has reignited the encryption debate and encrypted messaging applications have faced new scrutiny.[148][149] It has also led to tabloids labeling Telegram as a "jihadi messaging app".[150]In August 2016, French anti-terrorism investigators asserted that the two ISIS-directed Jihadists who fatally cut the throat of a priest in Saint-Étienne-du-Rouvray in Normandy, France, and videoed the murder, had communicated via Telegram and "used the app to coordinate their plans for the attack". ISIS's media wing subsequently posted a video on Telegram, showing the pair pledging allegiance. A CNN news report stated that Telegram "has become known as a preferred means of communication for the terror group ISIS and was used by the ISIS cell that plotted the Paris terror attacks in November".[140]
In June 2017, the Russian communications regulator, Roscomnadzor, hinted at the possibility of blocking Telegram in Russia due to its usage by terrorists.[151]
In July 2017, Director General of Application and Informatics of the Indonesian Ministry of Communication and Informatics, Semuel Abrijani Pangerapan, said eleven DNS servers of Telegram were blocked (see § Censorship) because there are many canals that contain propaganda of radicalism and terrorism, how to assemble bombs, "disturbing images", and other things that are against the Indonesian law.[152] In August 2017, however, Indonesia lifted the block after countermeasures against negative contents were deployed in association with Telegram LLP.[153]
Comments
Post a Comment