Hacker News new | past | comments | ask | show | jobs | submit login

Unless I’m missing something, your mproto link only covers transport level encryption not storage.

It doesn’t include E2E encryption in the scheme only client to server.

Whether the server stores it as plaintext or not, is moot to the point of having telegram itself be able to see the chats because they hold the encryption keys of the server and therefore can be made to comply with legal requests.

The person you replied to may be incorrect on the aspect of plain text but imho they’re right that it’s not really relevant in this context.

Encrypted storage would be relevant for the case where a server is compromised by a hacker.




I can't open the telegram.com links, blocked at work :/

But the Arxiv paper says:

"We stress that peer clients never communicate directly: messages always go through a server, where they are stored to permit later retrieval by the recipient. Cloud chat messages are kept in clear text, while secret chat messages are encrypted with the peers’ session key, which should be unknown to the server."

So it doesn't appear to be encrypted-at-rest, but without reading the telegram documentation I can't verify that.


Yeah that feels pretty cut and dry. But even if it was encrypted at rest, it sounds like the server has the key to everything anyway so it’s not E2E.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: