Secret chat

[vahid9]

I would be wonderful to create and send secret chats on telegram desktop.

[Choochmeque]

@DaFri-Nochiterov, Yep, Unfortunately this is true.

[rhyven]

It disturbs me that an admin is available to delete comments about competing clients, but there has been no response to the questions from @ksmirenko or @JacobCZ about accepting a PR.

Combined with the team's vitriolic responses to negative responses from security professionals, I'm starting to have serious doubts about the Telegram team's genuineness.

Could it be that we've all been tricked into adopting a platform that was never intended to be as secure as we thought?

[BernardGoldberger]

@rhyven agreed

Also noticed the comments disappear.

[JacobCZ]

@rhyven That sounds a little paranoic to me :wink: But I agree that telegram is starting to be less and less legit in my eyes...

[rhyven]

@JacobCZ - it did to me too, at first... but then, I started wondering about that in mid-2015. I've been watching Telegram's responses to negative feedback and it's seriously aggressive, and rarely addresses the actual concerns.

And having someone around to delete negative comments, without responding to legitimate offers for help... It doesn't smell right.

[telegramdesktop]

@rhyven I apologize for the deleted comments, I hope this won't happen again. Here they were:

But I hope you'll stay close to the topic, discussing other apps can be done in any other place, here is simply not very right place for that.

Regarding the issue: I can only repeat the answer about secret chats that was given in #363. I have too many tasks with much higher priority right now. Currently only mobile apps are about secret chats while desktop apps are about cloud synced chats, groups, supergroups, channels and bots.

Regarding the question about pull request: I'm afraid I won't able to merge a pull request with secret chats support, because to be done well this feature requires such a huge amount of code added that I simply can't imagine checking it (and adding it by someone in the first place), so it could be only like a forked alternative client app.

[JacobCZ]

@telegramdesktop How are bots higher priority than a core feature (secret chats) of telegram? This is ridiculous...

[franzalex]

@telegramdesktop:

I have been watching this thread silently but I figure this is where I must add my two cents.

It is acceptable if you do not have enough time to write the code for secret chats. However, nothing stops you from accepting a pull request from someone who has worked hard to implement this. It just doesn't add up! Here is someone implementing a feature for you practically for free and you're rejecting it?

Now I do not know the specific pull request it is that implemented secret chats so my argument may be misplaced. However, I do believe that by actually taking this stance, you are indeed offering the opportunity for a non-official fork to supersede and supplant the role of the official app. This is indeed unacceptable.

I would have written my fork to circumvent all this feet dragging if the application was written in C# or VB.NET. As it stands though, I have to wait until @telegramdesktop finishes doing all the other things before working on secret chats on Telegram Desktop.

[rhyven]

@telegramdesktop - thanks for your response.

This thread is good evidence that the priorities are just wrong.

And I understand that desktop secret chat is HARD. But honestly it looks like you don't want this to happen.

[diazbastian]

@telegramdesktop Sorry, it was a response to a related topic. We were not talking about how to develop or add features.

For me @ksmirenko just wants to help. What's wrong with that?. Perhaps he can adapt to the style of work of Telegram team. Secret chat is a highly demanded feature for the desktop app. Telegram for OS X supports secret chats, send videos, etc. We would like to have something similar in the official app.

With the above I wonder. ¿Github only works to report errors? I'm not a software developer, but if a developer offers his help, it would be good to see how he can help improve the development of this service that we all use.

Cheers

[Dark-Mind]

Telegram is a mobile messaging app in the first place. Secret chats are hold only on one client device and can't be synced between them and they stay more secure remaining on the mobile. In my opinion different secret chats on different platforms will confuse users.

I respect your way of thinking and your concern about the security of the app, except the problem with only using the desktop app is you don't get to know that someone is talking to you or requesting a secret chat. I got one of my friends mad at me for not replying for days. Only to know that he was using secret chat with me and I had no idea, because I rarely open telegram on my phone.

IMO secret chat is a really needed feature now and it should be moved above all others on the priority list.

[telegramdesktop]

@Dark-Mind Well, he would be the same mad at you, because he would have a secret chat with your phone (like right now) and desktop won't know anything about the messages that are sent to this secret chat — no matter does it support secret chats or not.

Currently you _atleast know, that secret chat means your mobile app (almost always only one device), while you can be logged in on desktop at your home PC + at your laptop + at your workplace, and all they will have different secret chats, not related to one another in any way, and your contact won't be able to imagine where did he send you his secret message and when will you read it among all of possible desktop devices.

Your phone is the most "private" device and the probability that you'll see the messages there is the highest.

[JacobCZ]

@telegramdesktop Couldn't you at least add some kind of notification mirroring function that would notify you (in the desktop client), that you have a new private chat incoming on your phone?

[aphirst]

@JacobCZ I think the telegram developers are generally aware of the limitations of their current Secret Chat system, at least the mechanism of how they're initiated; and also of how much of a hassle it'd be to reimplement it. I think we just have to hope they work out a good way to do multiple-device Secret Chats. In the mean time I expect they probably don't want to bring the implementation to the official desktop client precisely because it will cause unpredictable behaviour necessitating the user to "understand" why it's "weird".

[JacobCZ]

@aphirst I understand that implementing the whole secret chat thingy into the desktop app will take a LONG time and possibly require a rewrite of majority of the code, but I doubt it would be that hardcore to add a simple notification...

[aphirst]

@JacobCZ I had wondered myself at one point whether it could be a temporary fix to implement in both clients some mechanism to "(temporarily) ignore" a Secret Chat initiation event, so that another of your devices can pick it up.

[diazbastian]

@telegramdesktop

Your phone is the most "private" device and the probability that you'll see the messages there is the highest.

In the first instance you are right, but in practice it is not. I know many people who have more than one mobile phone and use the same account in both, including the dynamics of secret chats. How important is where it starts or continues a secret chat when the self-destruct message is activated?

The secret chats do not work only in smartphones, but is connected to a platform and operating system. Thus a user can use secret chat in: smartphone + tablet + pc/pc-like (android/remix os, ARC chrome, iPad pro, etc).

A user who actively use secret chats has the same dependence on the smartphone using WhatsApp web.

[ribeirobreno]

Your phone is the most "private" device and the probability that you'll see the messages there is the highest.

I understand this may be the case for a lot of people but it does not apply to my phones. Secret chats are almost useless in them because i have no problem borrowing a phone for someone else to test my software, place a few calls or to manage a vault in fallout shelter.

Meanwhile it would be great to have secret chats at my notebook where telegram desktop is installed and where i have some security measures to ensure i'm the only one using it.

[JacobCZ]

@ribeirobreno I agree. Mobile phone security (be it even Blackberry etc) just cannot beat a business-grade laptop with hardware-level drive encryption secured by fingerprint sensor (a bit overkill, but you get the idea)

[codecat]

Mobile phone security (be it even Blackberry etc) just cannot beat a business-grade laptop with hardware-level drive encryption secured by fingerprint sensor (a bit overkill, but you get the idea)

To be fair, the iPhone 6 encrypts all your data, and there's a fingerprint sensor on it to protect this data.

[JacobCZ]

@AngeloG Do you honestly believe that your data is safe on iPhone?

[diazbastian]

@AngeloG @JacobCZ Please stay on topic (Telegram secret chats). Recently the devs deleted off topic posts.

[JacobCZ]

@diazbastian Sure. I am just pointing out the fact, that mobile phone is in no way more private or secure than a desktop...

[benbenolson]

This bickering is pointless; please delete all of these off-topic comments, and stop making them. The purpose of this thread is to discuss Telegram secret chats, and whether or not they should be implemented.

Clearly I think that they should, but after the comments by the developers, they seem like something that would be better suited to a fork of the official client, which would be perfectly acceptable for me. I would do it, but I'm certainly not very experienced in cryptography, and fear that I would botch the security of the application. Is there anyone here that feels that they could contribute?

[ksmirenko]

@benbenolson I would like to help, however I'm a beginner both in C++ and in cryptography. Also, @JacobCZ earlier wrote he was willing to contribute. We could create, say, a Telegram group chat in order to discuss the fork plans and not to flood this thread.

[JacobCZ]

@ksmirenko @benbenolson Let's talk about it... https://telegram.me/secretchatdev

[JacobCZ]

@benbenolson Could you add me on Tg so I can invite you to the group? Username's @jac0bas

[0xferit]

It's insane to don't plan to implement secret chat in a Telegram client. What's the purpose of the Telegram then?

[JacobCZ]

@ferittuncer You can join our new, unofficial dev team. We are going to implement it ourselves in a fork of this client. Just add me on telegram @jac0bas and I'll tell you more...

[paoletto]

I think it's crazy to refuse implementing this feature, and even to prevent telegram desktop to accept an incoming secret chat, especially after the sponsor at MWC sold this feature as the main feature of this platform. If this (lack of secret chats on desktop and web) the real intention of the sponsor, well then that's plain hypocrisy. If not, well then the developers have just not worked out the proper use cases (as the many requests here show). The argument that nowadays "usually only one mobile device" is madness. I don't use any telegram supporting device as my main mobile (sadly), yet i own and use (at some points during the day/week) at least 3 other devices running it. Preventing me to accept or sending secret chats while, for example, i'm at work and have only the desktop or web, with the excuse that "only one device should receive that chat" is ridiculous. At best, if privacy is concerned, telegram should have server side support to let the user choose whether to broadcast secret chat requests, or to multicast it (excluding specific devices), or to unicast it (having a single allowed device seeing incoming secret chats). All of the clients, though, should allow sending secret chats requests.

[Geobert]

I add my vote for this, crazy that the official desktop client does not support one of the main feature of Telegram… :(

[auchri]

Use the new reactions of GitHub on the first entry of this issue instead of creating unnecessary +1 comments.

[nestor-santana]

I use OSX (desktop) telegram and it has secret chat, but Windows does not have the encryption function, which I was über surprised about. Hope this gets attention. Telegram for Windows 10 should have encryption.

[diazbastian]

@nestor-santana you are talking about Telegram for OS X (native) ... this thread is about to add the function to Telegram Desktop. Both are independent software.

See: Telegram Desktop: https://desktop.telegram.org/

Cheers

[nestor-santana]

This is a distraction from the point, but Telegram Desktop includes OSX, Windows, and Linux 32/64. There isn't a Telegram Desktop that is separate from Telegram Desktop for OSX. Perhaps I'm missing something, but the link (with ssl!) https://desktop.telegram.org tells us the same thing.

On Wed, Mar 16, 2016 at 6:15 PM, Bastián Díaz notifications@github.com wrote:

@nestor-santana https://github.com/nestor-santana you are talking about Telegram for OS X (native) ... this thread is about to add the function to Telegram Desktop. Both are independent software.

See: Telegram Desktop: https://desktop.telegram.org/

Cheers

— You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub https://github.com/telegramdesktop/tdesktop/issues/871#issuecomment-197404473

NESTOR J. SANTANA, APPLIED TECHNOLOGIES DIRECTOR

GSM (USA) +1 415 205 4031 GSM (ESTONIA) +372 519 19 185 T (HK) +852 8192 5897 MIDWEST ALPHA LTD.// 中西營銷諮詢有限公司

Lockhart Road, Causeway Bay, Hong Kong

中威商業大廈銅鑼灣駱克道447-449號香港

所在地: 59.4371997N 24.7452441E

WWW.MIDWEST-AGENCY.COM

WWW.SIX-MAGAZINE.COM

[diazbastian]

@nestor-santana

Telegram Desktop (Linux, Windows and OS X) : https://desktop.telegram.org/ Telegram for OSX (Only OS X) : https://itunes.apple.com/es/app/telegram/id747648890?mt=12

[nestor-santana]

Most unexpected that these versions for Desktop and Appstore for the same platform (OSX) are distinct. I suppose the Desktop version is for server and those who shun the App Store. Ridiculous that the encryption feature is pulled, either way.

On Wed, Mar 16, 2016 at 8:50 PM, Bastián Díaz notifications@github.com wrote:

@nestor-santana https://github.com/nestor-santana

Telegram Desktop (Linux, Windows and OS X) : https://desktop.telegram.org/ Telegram for OSX (Only OS X) : https://itunes.apple.com/es/app/telegram/id747648890?mt=12

— You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub https://github.com/telegramdesktop/tdesktop/issues/871#issuecomment-197484262

NESTOR J. SANTANA, APPLIED TECHNOLOGIES DIRECTOR

GSM (USA) +1 415 205 4031 GSM (ESTONIA) +372 519 19 185 T (HK) +852 8192 5897 MIDWEST ALPHA LTD.// 中西營銷諮詢有限公司

Lockhart Road, Causeway Bay, Hong Kong

中威商業大廈銅鑼灣駱克道447-449號香港

所在地: 59.4371997N 24.7452441E

WWW.MIDWEST-AGENCY.COM

WWW.SIX-MAGAZINE.COM

[gingerCodeNinja]

Telegram's primary unique selling point is that it has secret chat (in my opinion anyway), but doesn't provide it to the most popular desktop platform is a major fail. Wondering if they're under pressure from government not to add it. Seems insane to spend time on making things pretty, and adding stickers, bots etc. I don't use Windows myself, but wanted to chat to someone who was on Windows, took me a while to realise why my chat messages were not being read - suggest they could at least detect if a user uses Windows and let people who are creating secret chats to those users know that the destination user may not be able to see the message/s. The conversation is so secret I'm basically talking to myself :p

84% of business users use Windows desktop.

[DmitriyYukhanov]

Just noticed this really disappointing absence of the secret chats in Windows client. As a software developer, I can't imagine how it could happen at all. This app has some protocol. All clients use and should use this same protocol. So why not implement secret chats on windows as you already have it on other platforms?

Would be nice to get any official response from the devs why this really requested and must-have feature is not in the top priorities.

[pwseo]

It's been almost two whole years since this repo was first commited to and this still isn't implemented, which is ridiculous, as is labelling this an "enhancement" instead of a "bug". Secret chats aren't simply "additional functionality". They are part of the core of the protocol and functionality and not having secret chats actually prevents people from using Telegram correctly. It's a BUG not a fancy new feature. It's also the 2nd most commented issue this project has.

Are you even thinking about implementing secret chats? @auchri @john-preston

[john-preston]

@pwseo I've expressed myself here a several times. Secret chats are not a priority task for this desktop app (and for the web version https://web.telegram.org as well). They use a completely separate part of the Telegram API and you can have completely functional apps (like Telegram Desktop or Telegram Web) without them. They require offline message storage which is not yet supported in neither of this two clients (Telegram Desktop loads the messages from the cloud each time it is launched — like the web client does). There is a possibility that they will be implemented some day in Telegram Desktop, together with the encrypted offline message storage, but this project has no defined ETA.

[pwseo]

Sure, the application loads and functions properly, you just can't use two core features heavily publicized by Telegram (arguably the most publicized features). And while I know your opinion on this matter, I'm unable to comprehend how can this not be a priority. I can see the web-version not having this due to encryption and offline storage issues with the browser, but it seems baffling that this would even be a problem on a native desktop app.

[DmitriyYukhanov]

Thanks for your comment, @john-preston !

Though I still can't understand why it's not the top priority =\

This feature is one of the reasons why people start using Telegram at all, and this was a reason for me. I saw the private chats promotion on the website and I'm like "YAY finally I'll be able to throw out all that old jabbers with OTR etc. and move all sensitive conversations to this promising new messenger!".

I open win client and figured out secret chats are not available!... You know, this is ike open Chrome and figure out tabs are not available on Windows and I'll have to work in 1 tab ony =D

I like telegram, really great messenger, but absence of the encryption on the Windows is really disappointing, killing its uniqueness =(

[0xferit]

If it's an API issue, then API should be fixed immediately. There is no excuse for it. "This is a security application, go ahead and use it and make others use it as well, but well we can't implement a critical security feature because of this that and that, sorry."

[three3q]

I'm stunned it's not possible. I don't need sync, just give me the chance to write - and ATTACH! something from desktop. That is why I use Telegram.

[danielhass]

Encrypted chats on desktop and mobile client with sync, even if you have to manually export a private key or something, would move Telegram from a good IM app to THE IM app in my opinion!

[gingerCodeNinja]

@telegramdesktop re:

Uniting cloud sync for messages and attachment across all mobile, tablet and desktop devices, very fast and reliable mobile apps, file sharing up to 1.5GB (for a single file), group conversations for up to 200 members, message history search (from the cloud — for all ever sent messages right after sign in on any device). All those features together are not in any other (known to me, maybe) "just instant messenger".

There are other chat clients have those features, Slack can send 1GB files, handle all that stuff like cloud syncing everything, bots, history search, multiple teams / large groups (far more than 200 users..), great mobile apps, gifs/stickers/emoji and all the pretty stuff that Telegram thinks people want. Even HipChat, Line, Messenger and a bunch of other free common chat programs, other than the file size limit, have everything Telegram has. On the encryption/privacy front, Wickr is taking the lead, Ring.cx is starting to take off.

I thought the USP would be being somewhere between Slack/HipChat/Line and Wickr/Ring, so having good chat functionality, but also having secure conversations. Now I'm not sure where Telegram sits.

Telegram should at least remove 'business' from this -

as 84% of business users use Windows desktop.

[stek29]

@stripyshirtguy

Have everything Telegram has

Even 5000 members in group?)

[gingerCodeNinja]

@stek29 Just asked them, Slack has unlimited users per team, and unlimited users per channel.

[ghost]

Guys, you suppose that missing encryption is a 'mistake' made with good will, but I doubt it.

There is high probability that the whole Telegram project is targeted to gather communication data from "security-aware" people.

Look:

• Program is very high-quality and convenient to use.
• Encryption protocol uses custom unique algorithms - suspicious, but maybe it's made for performance.
• Group chats are not encrypted by design! There is no technical problem to make them encrypted, at least for small number of people - you can imagine it as pairwise secure chats. So there is no real tecnhical reason.
• Telegram server knows all you contacts - the Android client uploads them to server. For agency guys or commercial guys, such metadata is more valuable than even messages content, because it's your friends, your social graph.
• Desktop client may be deliberately made not supporting encryption - soon or later you'll loose your attention and start to chat with the same people in desktop client, for convenience, so the server can sneak into your conversations (even if protocol encryption is strong).

So there is non-zero probability that the Telegram project is an attempt of some second-tier agencies to steal a piece of surveillance from first-tier (US) agencies.