Telegram (for iPhone)

Telegram (for iPhone)

Editor Rating: Excellent (4.5)
Telegram (for iPhone) - Telegram (for iPhone)
  • Pros

    • Makes encrypted messaging a snap.
    • Attractive design.
    • Available on multiple platforms.
    • Cloud-based messaging makes secure messages available everywhere.
    • Cloudless option for extra security.
    • Powerful group tools.
  • Cons

    • Custom encryption protocol.
    • No secure voice service.
  • Bottom Line

    Telegram is the secure messaging app we've been waiting for; simple enough to use, yet secure from top to bottom.

Put away your one-time pads, your book cyphers, and your old scytales, because secure and encrypted communications have finally grown up. Telegram Messenger is the latest in a string of instant messaging apps that seek to combine the ease of texting with smart, secure encryption. The difference between Telegram and others is that it puts user experience first, making it easily one of the best iPhone apps available today. It would be a solid chat client even if it were insecure, but its dedication to security takes it to the next level.

Telegram is available for free from the Apple App Store. I had no trouble installing it on my iPhone 6, and am thrilled at all the other platforms Telegram currently supports, including Android, PC, Mac, and even Windows Phone. There's also a Web client, making it easy to log in and check your messages wherever you are.

Before you can begin with Telegram, you have to enter your phone number. This is the main identifier that Telegram uses. After you enter your number, Telegram sends a confirmation code via SMS. If you choose to link your Telegram account to the desktop or Web client, the service will confirm your identity by sending a special message to the Telegram app on your phone. It's wonderfully seamless, though the downside is that you can only have one phone associated with a Telegram account. If you want to install Telegram on a second phone, you have to create a separate account.

Telegram (for iPhone)Using a phone number also raises some legitimate privacy concerns, as does Telegram's requirement that it view your contacts to connect you with other users. Any Telegram user who has your phone number in their Contacts list will see you in their Telegram contacts. It's easy, but I still prefer adding contacts in apps the old-fashioned way. Fortunately, you can add users without knowing a phone number thanks to Telegram Usernames, which you create from the Settings panel. If your account has a Username, anyone can search and find you through the app with that name and not your phone number. Telegram also generates a public link that users can click to send you messages. The only drawback is that you can only add someone in your phone's Contacts list to your Telegram contacts; Usernames aren't enough.

The first thing you notice when you log in to Telegram is that the app is beautiful—legitimately, wonderfully, beautiful. It's extremely responsive, makes sense, and has all the high design we've come to expect from a polished iPhone app. This is in stark contrast to most other security apps, such as Cryptocat, which are usable at best. I can't emphasize this enough: Using Telegram does not feel like using a security app. It feels like using a popular chat client.

The threaded conversations and uploaded images in Telegram look excellent, and have a distinctly WhatsApp-like vibe. And as with WhatsApp, you can choose one of your photos or one of the 33 tasteful images included with Telegram as the background for your chats. It should also be noted that WhatsApp also encrypts its messages using the same technology as the excellent and Snowden-endorsed secure messaging app, Signal.

Secrets and Super-Secrets
There are two types of messages in Telegram. By default, messages between two users are called Cloud Messages. These are encrypted at rest and while in transit, and are accessible to all of your devices running Telegram. This is possible because your Cloud Messages, as well as the cryptographic keys to read them, are stored and managed by Telegram. It is possible that a hacker could steal, or law enforcement subpoena, messages and keys from Telegram's servers. Depending on how that information is stored on Telegram's end of things, it is also possible that these messages could be decrypted. Telegram makes these limitations clear in the app's documentation.

What good are Cloud Messages then? Consider that when the FBI wants to read an encrypted message, they use investigations of the physical device (see the FBI's fight with Apple) and subpoenas to obtain information from wireless carriers and companies like Telegram. The NSA, on the other hand, looks at signals as they travel. If the NSA or a hacker took a peek at your Web traffic when you were chatting over Telegram, they'd see nothing but meaningless gibberish. Using a good VPN service is another way to keep your traffic safe from prying eyes, one that can further protect you by hiding your IP address.

Telegram (for iPhone)The other type of messages are known as Secret Chats, and these trade the accessibility of Cloud Messages for better security. When you start a Secret Chat, the encryption keys for the messages are managed on the sender and recipient's devices. These are the only devices that can read the Secret Chats. This means your Secret Chats aren't held on Telegram's cloud, and by extension aren't available on any of your other devices. This sounds like a downside, but really it's the best method for sending a message you want secured in the best possible way.

Many secure messaging apps aim for what's called perfect forward secrecy, meaning that breaking one message won't allow an attacker to read all your old messages and all your future messages. Telegram comes close by destroying the encryption keys for your Secret Chats after every 100 messages or every seven days, whichever happens first. Editors' Choice Wickr, on the other hand, creates new keys for each message, and Signal has its own scheme for ensuring a broken key won't imperil your communications.

In a Secret Chat, you can view the key being used to send and read messages. If you and your messages' recipients are in the same place, you can view each other's keys to confirm identity. Confirming that the person at the end of the line is who they say they are has always been a problem for secure messaging. After all, if someone borrows or steals your phone, they can impersonate you. You can prevent this by enabling the option to require a password to open the Telegram app on any device (and, of course, setting a passcode on your iPhone's lock screen). Signal addresses the identity problem with a scannable QR code to confirm identity, and also displays keywords that can be spoken aloud to prevent a man-in-the-middle attack. Unfortunately, Telegram does not include Signal's secure voice features.

Not all features are available for all types of Telegram messages. For example, Secret Chats can have a timer set that deletes the message from both your phone and the recipient's phone after the set amount of time. You also see a notice when the person you're sharing a Secret Chat with takes a screenshot within the app. These features aren't available for Cloud Messages, but Cloud Messages (including Group messages, but more on those later) can be forwarded to other users while Secret Chats cannot.

A quick word on self-destructing messages: they aren't just a fun gimmick as they are for Snapchat. Deleting a message is the best way to make sure that it doesn't get intercepted or decrypted. Wickr was one of the first apps to introduce self-destructing secure messages, and it's a feature I always like to see in a secure messaging app.

The split between Secret Chats and Cloud Messages might seem like a bad thing, but I think it's a smart compromise between usability and total security. Most users can't accept the idea of not having access to their messages at all times, which keeps them from embracing secure messaging platforms. To me, Secret Chats are like taking someone aside to whisper a secret. It might not make sense all the time, but there are some things best discussed in private.

Groups, Stickers, and More
Both Secret Chats and Cloud Messages do more than simply send text. You can send photos, audio clips, and emojis, just as you would from your SMS client of choice. You can also send files, and Telegram claims there is no limit on how large these files can be. Sending large files might test your patience and your data bill, so send them wisely. Telegram also supports attached videos, contact information, and current (or nearby) location.

Telegram (for iPhone)If you love Facebook Messenger's stickers (and I do), you're in luck because Telegram has the best and strangest collection of stickers I've seen. Users are encouraged to make and submit their own creations, meaning that there are, at last count, more sticker sets on Telegram than atoms in the universe (confirmation pending). The downside is that there is no centralized store for stickers; to find them, you have to save a set sent to you by another user or search out special Telegram bots via public links.

Note that stickers and attachments by definition have to live in Telegram's servers. But for attachments to Secret Chats, Telegram has a special scheme for dealing with this problem. Telegram's excellent and exhaustive documentation explains that attachments are encrypted with a separate key that is itself encrypted, along with the location of your attachment. These encrypted attachments appear as random data on Telegram's servers, and are periodically deleted.

For times when one-on-one messaging simply isn't enough, Telegram offers Groups and Channels. These are very similar to WhatsApp groups; pick a name, add some users, and your missives will be delivered to everyone. Groups can have a specific admin, or share those privileges with everyone, and any of the participants can mute their own notifications or leave a group. That's great. Channels are like bigger, more public groups and are a kind of social feature I've never seen in a security app before. Telegram Channels feel a lot like the anonymous, encrypted chat rooms used by Cryptocat, but Cryptocat allows any user to use any username at any time. Telegram is a little less flexible, and, for me, a little more trustworthy.

What's In a Protocol?
Rather than use an established encryption protocol, Telegram decided to roll its own. It's called MTProto, and it has all sorts of words associated with it that you're probably familiar with from the security world: 256-bit symmetric AES encryption, RSA 2048 encryption, and Diffie–Hellman key exchange.

The difference is that Telegram built MTProto itself, which is an unusual move and one not usually accepted by the security community. Encryption, after all, is extremely complicated and building your own instead of using a tried-and-true solution is frequently viewed as a bad thing. To Telegram's credit, the company has opened some, but not all, of its source code for review. Hopefully, Telegram will continue to open their code and allow the world to pick it over for errors and help improve it.

Security researchers have had some success attacking Telegram, but not its encryption protocol. Last year, Zimperium reported that it had successfully found a way to access Telegram Secret Chat information held in device memory on an Android 4.4 device. This is an extremely complex attack, and it requires a very motivated attacker who is targeting your specific device—the kind of attack that is rarely seen in the wild. We've reached out to Telegram to see if this is still an issue.

Dash, Don't Dot, to Telegram
Telegram feels like the app that finally bridges the gap between usability and security. Its large (and, frankly, beautifully bizarre) sticker community is enough to set it apart from other chat competitors. When I think about a world in which encryption is common and accessible, Telegram Messenger is the kind of app I imagine. The focus on security that is actually user friendly is truly outstanding. That Telegram uses its own proprietary encryption protocol is a worthy concern, but one that is lessened by its use of self-destructing messages.

With a simple, beautiful design, excellent cross-platform support, and multiple features to protect the integrity and security of your messages, Telegram Messenger is an excellent iPhone app. It's also an Editors' Choice winner for iPhone secure messaging.

This article originally appeared on