Covid19 Telegram community groups should be channels

29 March 2020 - 5 mins read time
Tags: Cybersecurity Telegram

Recently, I hesitated before joining some Telegram Covid-19 community support groups in Germany. These Corona News a well-intentioned security flaw. For a country where everyone remembers to ask your permission every time before they give out your phone number, it’s ironic that so many people would opt in to giving away their contacts so readily. In contrast, this Covid Soli Group List is a channel that protects the privacy of the 400 odd subscribers.

It’s hard not to use Telegram. It juggles convenience (it’s web app), security (secret chat), fun (stickers), and community (channels and groups). Better yet, it’s not owned by Facebook like WhatsApp is – (it depends on whether you think Telegram being housed in Dubai and by Russian developers is an issue).

If you stop reading, the two important things to know about Telegram are:

Why does this matter?

Telegram has emerged as a preferred app for activists around the world, from Hong Kong through to the Middle East, and even recently in China for people evading the government’s Covid-19 censorship.

Though security and privacy become an issue usually when going against the powerful, taking steps to minimize the exposure of your own personal data online is important in an age where it’s easy for people to track you down or identify you.

End-to-end encryption for privacy

End-to-end encryption should be an essential feature for messaging apps, but it is not. In its quest for convenience, especially on with its web app, it trades end-to-end encryption. The default chat is not encrypted, and in order to use Telegram’s encrypted chat feature, you must start a Secret chat.

Secret chats will only be accessible by your phone, and your contact’s phone. This ensures that messages only go from one end to another and that your messages are also stored locally on your phones (not in the cloud like your regular chats).

Group chats on Telegram are not encrypted. They are public, given that anyone can browse a group’s messages with a Telegram link even without joining the group. Therefore, treat all group messages as public messages on the web.

As a general rule on Telegram, if you can see a chat in the Telegram web app, that chat is not encrypted because it is stored in Telegram’s cloud servers.

Contact exposure on Telegram groups

Telegram groups are useful as a knowledge sharing resource because anyone can contribute at any time, but it comes with the trade off of exposing your contact.

If you join a group on Telegram, your account is visible to everyone in that group. This means anyone can directly message you and see your contact details (such as your name, display picture or initials).

The first thing to do is to remove your name from your contact details, so that it is less obvious who you may be.

Prior to August 2019, Telegram automatically matched phone numbers with the user names in groups. This means that if you have someone’s number in a group, you will automatically see their name. Anyone who bulk adds numbers will be able to learn a user’s true identity. In Hong Kong, Telegram offered a fix that allowed users to disable phone number matching, allowing those who who did not want to be automatically discovered to hide their identities. At the same time, users who prefer convenience can continue to have phone number matching so contacts can find them.

By creating community groups in Germany, people are effectively offering their numbers to be added by anyone at any time, especially if they have left their names in their contact details.

Using Telegram channels

Telegram Channels are hosted by one individual, who can create a Telegram alias and hide their contact details and identity. Subscribers in th group can also hide their identities.

To use a Telegram channel for a community, think of the channel host as the moderator. Subscribing members can message this person, and the channel host can forward the message in to the channel for everyone to see.

This method may be a bit more burdensome for an individual, but it strikes a balance between community and privacy.

In the end, I joined the Telegram groups for my neighbourhoods because I am in Germany and generally trust that the people who have set them up have done so for community benefit. In addition, there’s no particular reason for the German government to use these groups to identify people. However, I would urge that creators for groups in the future consider protecting the privacy of all participants as a default and create a channel.

The list of links for Covid-19 Germany community groups are mostly on Telegram, but there are some Facebook links as well. You can start by finding your city or neighbourhood in this list,:

https://listling.org/lists/pwfjfkpjmesjjinm/solidarische-nachbarschaftshilfe

Here are additional support groups on Telegram: Berlinweite Gruppe: https://t.me/joinchat/IafppEdTmHTRObqU4-VTeg Berlin support groups:

Further readings

Secure Messaging Apps: I suggest scanning the top row of the table to know which apps are actually secure, and the far left column to learn about what security features you should think about. Not all of them, such as making code opensource, are obvious to a consumer.