Does Telegram suck for privacy?

[superbuu]

If you are talking to your lawyer/accountant/something important over Telegram, and you lose your phone, could they retrieve your conversations?

How do you keep this safe so no one can access the conversations?

[duncannah]

This mainly depends on the security of your device, make sure it has full-device encryption in place. Also, conversations on Telegram aren't encrypted in the cloud by default IIRC, so if your account gets compromised, your data is in peril in this case as well.

[ImWilly]

19 minutes ago, superbuu said:

could they retrieve your conversations?

You could retrieve it as long as you can log in onto your Telegram on other device

 

19 minutes ago, superbuu said:

How do you keep this safe so no one can access the conversations?

You could add passcode specific on the Telegram app, plus after login onto your other or replacement device, you could force logout Telegram from your stolen device through "Devices" list from your replacement device

[Eviljuche]

Well, gee, does a service that requires your phone number suck for privacy?

 

Honestly, it kinda does. You can actually log into anyone’s account bypassing any security measures by just copying some specific files from their computer’s Telegram folder into yours, provided that they were logged in firsthand — that is kinda worrying, albeit the probability of such scenario is negligible. Also, it’s closed-source server-side, so no one has any idea on how exactly your data is processed, not to mention that any middleman (i.e. server-based centralised messengers) in online communication is a potential privacy threat. 

[igormp]

As said above, conversations by default in telegram are not E2E encrypted and you can access those from any device you log into telegram.

 

Telegram does have an E2E option, which they call "secret chat", in theory it's safe and only accessible from the device that started the conversation, and not stored in Telegram's cloud, but it's not the default. 

[OddOod]

2 hours ago, superbuu said:

you lose your phone

You see, that's the thing. To make something actually secure, you have to accept sacrifices on convenience and redundancy. The only really secure comms would be E2E encrypted with no backups and a long security key which needs to be entered with 2FA to decrypt. But that means if you ever lose the key, the second factor, or the device, you're hosed.