Item — HN Reader

This is exactly why Telegram rocks.

Secret chats use end-to-end encryption. We do not store your secret chats on our servers. We also do not keep any logs for messages in secret chats. What this all means, is that there is no way for us to know who or when you message via secret chats — as soon as the messages are delivered, they're gone. And there is no way for anybody, including us, to learn what was in those messages, photos or videos. For the same reasons secret chats are not available in the cloud — you can only access those messages from the device they were sent to or from.

And from [the FAQ](http://telegram.org/faq#q-whats-this-encryption-key-39-thing):

When a secret chat is created, the participating devices exchange encryption keys using the so called Diffie-Hellman key exchange. After the secure end-to-end connection has been established, we generate a picture that visualizes the encryption key for your chat. You can then compare this image with the one your friend has — if the two images are the same, you can be sure that the secret chat is secure and no man-in-the-middle attack can possibly succeed.

Note: I'm in no way affiliated with Telegram—I just happen to think it's a great piece of software and deserves more highlight.

And Telegram [supports](http://telegram.org/faq#q-how-do-self-destructing-messages-w...) true self-destructing messages.

This isn't the problem the blog post talks about.

The issue isn't the security of the network layer for Snapchat, it's the security of the data once it's on the devices.

Which is to say, when the message self-destructs, it doesn't actually self-destruct on the device, at least not fully.

How does the Diffe-Hellman key exchange happen? How do you know that Telegram is not secretly intercepting the keys? Based on the FAQ, it looks like they are using some form of RSA public/private keys. Does each user have their own set of keys signed by a CA? Has the source code been vetted on both client and server side to ensure that the encryption is happening properly?

There are a lot of problems with just saying "it's encrypted."