Please don't start a "telegram is not encrypted by default" shitstorm like in every other comment section about anything related to Telegram.
For closed (invite only) group chats and 1:1 chats I think it should be encrypted by default though. Like WA and Signal. There's the secret chats of course but they only work on one device and not on group chats. Of course key management is hard in those cases but the others have worked around this very well.
I agree that encryption issue doesn't really have any bearing on this bot ban though. This thing wasn't really about surveillance. But the best way to make this appear in the comments is Telegram fixing it :)
Edit: FWIW I really like Telegram because they're open to integration with other networks (eg Matrix) and that they actually allow and embrace bots. But it would be so much better if they did have E2E.
I hope that their implementation will stay as it is. I'm all for implementing better security for ordinary chats, but they should keep secret chats feature as a restricted high-security channel.
And if a security feature has so many drawbacks that nobody uses it, you end up with less security. I'd rather have a flawed E2E implementation than one that is not used at all. For example I recently sent passwords to our Makerspace users in secret chats but half of them didn't see them because they were either on another device or they weren't online (also seems to be a requirement for secret chats). So many of them asked to 'stop being difficult' and send them in a normal chat. This is what I mean. And those people are mostly geeks. If they give up on it, what will normal people do?
If it's not seamless enough, only us crypto geeks will use it and the rest will roll their eyes. It has to work for grandma just as easy as it does for us. And Signal and WhatsApp do really pull that off.
I agree that backups were WhatsApp's weak spot but they are making some good modifications that allow users to store the key themselves.
It would help if the key management could be checked though.. I totally agree with you there. Right now it's not transparent enough, even for those of us who know what they're doing it's not really possible to check with WhatsApp. Signal is another story as it's open source.
Probably ends up at the nsa though. But I care more about not being a product of Google.
Its weak point were the backups. They were encrypted but the key was with WhatsApp and the data with Google or Apple. All a friendly secret government request away. Of course you can turn off backups but you don't know whether everyone in your group does.
However they have recently started to shore this up too. You can now choose to keep the key yourself. Of course you still don't know whether everyone in your chat group does this.. But even the alternative password method is much safer than before. According to FB it's stored in a HSM. Yes, we have to take their word for it. But if you use the numeric key only you will have it (and thus no way to recover the data which is a normal consequence of good encryption)
WhatsApp still leaks data for sure. Like all your contacts (even non WhatsApp users), and all your metadata, like when you're talking to whom.
But the content is pretty safe there IMO. Surprisingly so for Facebook. I don't like using it very much either but I'm Europe we simply don't have a choice. I limit its access to my contacts and photos by running it inside a 'work profile' on Android.
Messenger is a different story of course.