The 4-Year Telegram Lie

I remember back in mid-2021, when I first started getting into online privacy and the digital fight against Big Tech, finding Telegram.

At the time, it seemed fascinating. As if I found an emerald out of nowhere. It seemed like a dream come true.

Made by a person who was the victim of an authoritarian regime, he must understand the importance and depth of individual confidentiality and speech, I thought. Also given he was Russian, and I was learning Russian at the time, it won my heart pretty much instantly.

I was 16 at the time.

I found my then-girlfriend to be pretty much clueless about anything on the Internet, and when I showed her this, we both started using this as our daily goer, because she too adored it.

Fast forward 4 years – we don’t talk anymore.

Heavily encrypted, granular privacy settings, multi-datacenter infrastructure – these are some of the words that brought me to a state of awe and admiration for Telegram, which turned into something bitter later on as the years went by.

Seeing my privacy choices back then and now shows how I’ve matured throughout this journey. I have insights now that I did not back then, and I am constantly learning.

To me, Telegram was the “holy-grail” of modern messaging apps.

It was THE game changer for the world.

The WhatsApp killer. (fuck you Zuckerberg)

P.S. I have been stalling this whole article since September 2021. It is October 2025. It’s embarrassing to admit this, but better late than never. I wrote this within 48 hours btw.

Why It Felt Like Magic

A plethora of ways to customize your experience is just one of the ways Telegram is fun. Themes, custom emojis (yes, just like Discord) and even video profile pictures!

The blazing-fast message deliveries are out of this world. And unlimited free cloud storage for a lifetime? Sign me up, baby. (your ex’s nudes live forever, sorry)

The one thing Telegram has been standing for since its inception from 2013, is being an actual platform of unrestricted communication and freedom of speech amongst all.

Not only that, Durov has been scrutinized multiple times by Russian authorities, and most recently by the French government, so he is definitely in the know.

Telegram also removes your dependence on multiple tools that you might use daily, for example, by using a translator bot. It literally reduces your “points of failure” risks by not spreading out your information in multiple points, and just concentrating it in Telegram.

Or you can even just use their native translation for messages (powered by Google Translate! :D)

This is from a blog post from Pavel:

Instant View is also the most private and secure means of viewing web stories, because your IP address, cookies and metadata are not logged this way by the sites that you visit.

I personally found this to be a game changer, and I love how quickly everything loads up inside the Telegram app in a “safe” way.

Amazing UX.

It has its own caveat however: your IP and cookies are NOT stored by the random websites you visit, but by Telegram.

Every, single, bit of it.

Sites don’t track you, Telegram does instead.

You’ve essentially shifted surveillance from distributed (many sites) to centralized (one company).

Putting all the eggs in one basket.

Is this better? Depends if you trust Telegram more than the general web.

A fun fact: All your favorite features from WhatsApp? Most definitely came to Telegram first.

The Cult-de-sac

I used to delve deep into the support, FAQ and blog posts of Telegram, and they had this way with their words. A lot of fancy talk and pinpoint wording, alongside the usage of more modern and trendy lingo – something I could relate to.

I felt as if they were already a part of me, my community.

Pavel Durov, the CEO, has his own blog in Telegram too. I started following his posts and knowing more about his philosophy, which made me admire not just his product, but also his personality. There’s almost a cult-like following of him nowadays.

Liking the founder + trusting the brand = deadly combo risking blind sightedness

Telegram has, remarkably, a team of only 30 employees. Managing this huge app all by themselves is no easy task; kudos to them man.

Building, maintaining and improving a whole encryption system, which was also up for cracking on the internet for a huge prize is also kind of ridiculous.

No serious internet company should do that, IMHO.

It was a pretty smart way to keep costs low, and also to raise the hype around Telegram this much, so no wonder it’s this behemoth of a service right now.

Their Unique Structure

Telegram has an interestingly unique custom-built multi-datacenter infrastructure spread across the globe, that are under several shell companies in order to avoid direct identification and resist pressure from governments for complying to data requests.

If Russia demands data, it isn’t completely in Russia. If Germany demands data, the entity isn’t “German”.

This makes legal compliance a hassle — which protected users for years — and a brilliant way to avert attention away from their company and the data they hold, no doubt, but we’ll see through later in this article, how that is a broken promise.

Better than Signal?

Signal has servers only in the United States (centralized), whereas Telegram has this fragmented (decentralized) approach, which allows them to make things very efficient in terms of speed, security and cost, and it makes it harder for authorities to crack down on, but can also pose some challenges for the company in times of rapid growth, such as managing server costs and added maintenance.

Meredith Whittaker, the President of Signal, spoke about their recent AWS crash on Twitter. This surprisingly proved the infrastructure fragility Telegram avoids through decentralization.

One might doubt Signal to be VERY unsafe if people care about the jurisdiction of the service they are using, because the US has very problematic procedures, namely the National Security Letters (NSLs), the Foreign Intelligence Surveillance Act (FISA) and the notorious, nondisclosure orders (NDOs), or more commonly, gag orders about which Durov previously talked about.

In comparison to Signal, which uses Google Play Services in Android for reliable notification delivery, Telegram has its native app in F-Droid (Signal doesn’t) which does NOT use the proprietary, privacy-invasive component in their app.

The Play Store version does though.

Shocker.

The Cracks

Controversial take: Telegram is selling us vaporware with their fancy advertising (zero revenue spent on marketing, btw). It might be given a shot, but it is something that cannot be relied on or safely trusted in the first place.

Let’s talk encryption.

What’s Actually Protected

There are multiple ways you can communicate on Telegram:

Default Chats: These are the chats that one starts off with, and is the default way to communicate with anybody. Telegram stores the whole chat in their cloud for you to access from any and every device you want, and they can access it whenever they want since it is just encrypted in their servers, not end-to-end.

Secret Chats: These are separate chats you manually need to turn on, which use a device-to-device encryption using the newly created MTProto 2.0, which is their home-grown crypto protocol. The data in here is NOT stored on Telegram servers.

You cannot easily copy, forward, share or even save content here at times with varying degrees of inconvenience, depending on how tech-savvy you are. Self destruct timers are something that they recommend here to turn on, but you can do without.

This is where their true encryption power comes into full effect. Plus, these chats cannot be continued across multiple devices, unlike WhatsApp and Signal.

Voice and Video Calls: These calls are automatically ALWAYS E2EE, even if you initiate one from a default chat. Durov mentioned engineering this into Telegram. These are more secure by default than their chats, and it’s felt snappier with much clearer call quality than the likes of WhatsApp, and especially Signal to me.

But, one thing that doesn’t sit right to me is, why have they integrated AI here?

Groups: This uses an AES-256 encryption in transit when you send or receive messages, just like Default Chats and Telegram also has the keys to this, as well as your other default chats in their cloud.

This is encrypted, but not private. Kind of like you giving the mailman a taped box doesn’t guarantee him not opening it up and repackaging it again.

Channels: Both private and public channels exist. The private ones have the default encryption (where they can access the data), but the public channels have no encryption, since Telegram states that these are for public distribution and can be searched for in both Telegram and search engines like Ecosia, Google and DuckDuckGo.

More about MTProto 2.0:

Telegram explicitly mentions here that they didn’t go for other protocols and insisted on this one, because it emphasizes on fast deliveries even with poor internet connections and support for sending large files like videos.

Their protocol is NOT an industry-standard, unlike Signal which uses the Signal Protocol that’s heavily peer-reviewed over several years. Many are against the new protocol due to a shortage of public audits and reviews by renowned security companies.

Home-grown crypto in 2025 despite having established and proven methods is something to be concerned about, because it simply hasn’t stood the test of time.

Hoping Telegram proves me wrong someday.

Given that the server side code is NOT open source, which is the part that demonstrates what Telegram actually does with your data, doesn’t change how we should trust it since we don’t know what’s under the hood.

They try to sidetrack it by constantly mentioning that it is “open-source”, but this statement is partially true, as only the client-side of the code is open for the world to see.

That does not equate to full transparency.

Food for thought: I like the self-confidence, but without having independent teams checking out the server-side code for the encryption, and not having the code open-sourced for the world to see, how is the claim made by Telegram just not misleading?

In short:

1. all calls and Secret Chats are E2EE, just you and your partner know,
2. all default chats, private channels and groups are accessible by you and Telegram,
3. while public channels and public groups are open for EVERYONE to see.

The Audits

Telegram has had only ONE commonly attributed audit of its open source code from Aarhus University, but this is only of the v1.0, which Telegram has worked upon.

v2.0 went through a review by peers from ETH Zurich, University of London and King’s College London.

Signal had a recent problem, first reported by Motherboard, where a fix for one bug inadvertently created another that failed to delete a set of messages users had set to disappear.

The app quickly resolved the issue, but the situation serves as a reminder that all systems have flaws, so does Telegram.

These audits just give a general idea of how the protocol might act out like.

The Metadata Problem

This is more of an individual decision to make, because different people have different threat levels and circumstances.

Rysiek, a digital human rights activist I follow, recently discussed about Telegram’s encryption methods and it was truly an eye-opener.

He delves deep into the intricacies here, but long story short, you can track down effectively which two people are talking as a man in the middle, by just using their User IDs and IP addresses.

Not a great thing for maximum privacy.

Telegram logs, even in secret chats: who you talk to, when you talk, where you talk from and even what device you are using.

For journalists, this means source exposure, and for activists, this means their organizing networks revealed.

This is metadata, and it reveals your social graph, habits, and location – even if your message content is encrypted.

The metadata situation in iMessage isn’t great either.

A research article I read about Signal and Telegram didn’t do Signal justice by mentioning this line:

“The fact that Telegram does not publish server-side code while Signal does has no impact in the security assessment of these services.”

I’ll leave you to judge that claim yourself.

The Shift

“We have not disclosed one byte of your data”.

Telegram touted itself on this one thing… or it used to.

That’s something that no company has been able to say for this long, and Telegram just turned 12 this August.

Telegram still shamelessly mentions in their FAQ that they have “disclosed 0 bytes of user messages to third parties, including governments”, but ironically have ramped up their level of being “accommodative” with governments.

Telegram specifically is was notorious for not complying to government requests, a trait borrowed from their previous venture’s practices, VK.

If it were that easy to get information out of them, many governments would be getting free access to Telegram, albeit in hiding. (right?)

But they are rather unsuccessful in blocking them completely in their respective jurisdictions… or so it seems.

Ever heard of Toncoin? An initiative by Pavel, but soon orphaned thanks to the SEC, and later fathered by the TON Community and hyped beyond imagination.

Whenever I see cryptocurrencies get integrated deeply in any project (just like AI right now), I instantly start to get skeptical.

Bitcoin never meant privacy. Neither does Telegram integrating it within their platform mean that.

The increasing trade in Toncoin over the years has been problematic to say the least.

From Toncoin scammers (crypto scandals are commonplace there) to the platform going down for hours on end, and struggling despite reaching 100 million wallets, it’s a huge mess.

From Zero Bytes to 30 Million Bans

Pavel was arrested in France last year, August 2024.

Regrettably, Pavel himself announced about a week after the arrest that they indeed have complied to requests from several governments including France, where they complied to 220 requests, and their biggest market, India where they gave the data of 15,590 users, all within the first three quarters of 2024.

That isn’t the best move they could have made, but this is no surprise, according to the CEO himself.

Just in 2025 alone, Telegram has banned 31.6 million groups and channels (and counting) by analyzing their content due to receiving requests from government personnel so far.

Still no private chat keys “handed over”… yet?

Telegram has official transparency stats of what they have took down so far, and an official bot, but it only shows about the country that you are based in. Check this for a fuller picture.

What Telegram is trying to achieve here is create a balance, between safeguarding user privacy AND exposing all the wrongdoers (terrorists, CSAM enthusiasts, whatnot), but what they are missing out on is user privacy and government compliance are fundamentally incompatible.

Any company that deals with personal user data must choose one over the other.

We haven’t yet found out a way that does both in a way that does not compromise the other in the process. And really, if authorities can sniff people out with just the collection of wide-ranging social media identifiers and extensive profiled data, why can they NOT find these perpetrators without targeting comms platforms?

Local CDNs (Content Delivery Networks) that Telegram uses across its jurisdictions have also been under fire from the general public, because they also have these in authoritative regimes like Iran. Many speculated that these CDNs are a free gateway for snooping on people’s personal data by governments while people are unaware. According to Durov, this isn’t a problem.

But do you know what is a problem?

Telegram vouching for privacy while having data centers based in the US.

They have in total 5 data centers, which you should check out here, and you can find out here where you have been registered under. I have mentioned earlier above why it might be a problem for a privacy company to be based in the US, but for Telegram to exist there is complete hypocrisy.

The data that Signal servers store (users’ phone numbers and devices) or have access to (encrypted messages to be delivered) is encrypted. Thus, this is not a particularly strong point, as Signal could only hand over encrypted, undecipherable data to the US Government.

We cannot say the same for Telegram, ultimately removing our trust from them.

FOLLOW THE MONEY

Coming as someone who used to be a Telegram fanboy and so-called “Brand Ambassador” by the number of people I have recommended it to before, I have learnt over time that you should always take everything with a grain of salt, no matter how good it seems. (stay skeptical gng 🥀💔)

Signal is funded by donations from their generous donors and grants from the Open Technology Fund (OTF), which many speculate that the US government WILL have access to, because that’s something they fund. This is not proven from official documentation or software workings, but is indeed a valid jurisdictional concern.

The encryption in WhatsApp was funded by the US government, also through the OTF. Got this baby out of the Wayback Machine since the original link was taken down.

But where does Telegram get its funding from?

Initially self-funded completely by Durov, Telegram now has its revenue come from:

1. Telegram Premium, which is subscription based that provides you with extra features, increased upload limits and added benefits like granular privacy settings,

2. purchases made using the Toncoin of crypto wallets and collectibles like usernames, custom phone numbers and NFTs,

3. advertisements that they put in their channels and bots.

One might be tempted to think that Telegram Premium solves the privacy problem. It doesn’t provide you privacy from them, or from where their servers are.

They still scan everything.

Given that Telegram gives out users’ data in the case of valid legal requests, authorities can link wallet addresses shared in Telegram channels to user IPs or even your Telegram username.

The integration of your Telegram account with your Toncoin wallet gives a very bad rep for the likes of decentralization (whereas Telegram has a centralized way of moderating things) as well as the so-called privacy that they boast about.

Your wallet activity could be possibly tracked and associated with your Telegram account, exposing your whole identity especially if legal disclosures occur.

Telegram sells you pseudonymity, but the curtains quickly fall off when you know that transactions in Toncoin are publicly accessible.

That quickly turns their pseudonymous transactions in the blockchain into a goldmine of information for crypto regulators around the world AND hackers.

This creates a permanent, public link between your transactions and your identity.

This makes it easier for governments to just freeze your wallets by directing Telegram to your @username. Amazing, innit?

Signal had its own crypto scandal a few years back when they tried to integrate MobileCoin as an anonymous payment method for supporting their operations.

WHERE NOW?

If you’re thinking, “Kaifi, where do we go now to safeguard our privacy?”

You’re at the right spot.

Step 1: Find out your threat level.

Is the government looking for you, or are you just trying to keep the grubby hands of data collectors like Facebook away from your private messages?

The best overall option would be also the most recommended, Signal.

Do you care about being completely anonymous and not even sign up with an actual phone number or anything that might be used to identify you?

You could try Session (based on the Signal Protocol), Element or even SimpleX.

Don’t care if everybody sees your messages anyway? Try WhatsApp. (spoiler: don’t.)

Step 2: Bring your friends and family to switch.

This is the toughest step of them all. It took me about a year to convince just my parents to sign up for Signal to communicate safely.

Step 3: Don’t turn back to non-private options.

You’ll thank me later, and so will the ones who join you.

EXODUS

Maybe such a platform is needed for the world. With at least the hint of caring about users’ privacy, but still scanning through everything they have on their platform.

Maybe Big Brother needs to be an essential part of our society for us to have safer communities and “freedom of speech”.

I guess we ought to sacrifice our personal liberties and sell the integrity of our data to save the children and defeat the terrorists.

It doesn’t have to be a tough choice.

With an app being this popular, comes a lot of spam. I’ve been getting spam messages for over a year now, ranging from people giving me their “last savings before they die” and “freelance job offers” to outright nudes from multiple women asking for money for sending me more pictures or to subscribe to their OnlyFans.

I should have seen this coming over the last 4 years. Telegram has 950 million users signed up and funnily enough, I see this getting even worse the more users sign up.

If only their actions did not lag behind their commitments, I would have left with much more respect for them within me. It’s just a honeypot (for everyone that likes data) with a Premium subscription.

I’ve observed long enough to see both the good and the bad of the platform, and in the process, I have learnt a bunch of things and with this article, said a bunch of things too.

My time here has come to an end.

I started using Telegram at 16 with someone I thought I’d know forever.

Four years later, we don’t talk.

The messages remain.

The relationship ended.

The data didn’t.

Maybe that’s the real lesson here — not about encryption or metadata or government compliance. It’s that Telegram’s “forever” was never meant for you.

It was meant for them.