'You can create your own burner Telegram account and tell the bot to forward you these messages,' Somerville says. The idea that a secure messaging service's own feature could downgrade its encryption scheme-without giving any visual cue to the user-is concerning. 'I’ll be honest, it surprised us when we realized that the bot security is that different than how normal messaging works.' 'This is something that affects you if you are operating a bot or are in a channel with bots,' says Luke Somerville, head of special investigations at Forcepoint.

As a result, adding a bot to a chat or channel undermines its security, potentially making it easier for a third party to intercept messages. But while researching the bot platform, Forcepoint realized that the feature doesn't incorporate the encryption algorithm Telegram uses to protect its chats. They are essentially automated Telegram accounts you can just add them to chats and channels as you would a friend. Bots are popular on Telegram, because they're fun and convenient, and Telegram has supported them since 2015. They can offer customized keyboards, produce cat memes on demand, or even accept payments and act as a digital storefront. Telegram bots are small programs that can embed in Telegram chats or public channels and perform a specific function. A new report from the web security firm Forcepoint, about Telegram's use of bots, has implications for both Telegram's users and its critics. The other is that many cryptography experts have cast doubt on the integrity of Telegram's encryption scheme. One is that the app is a go-to encrypted communication tool for hundreds of millions of users around the world, particularly those looking to duck government surveillance and censorship in countries like Russia and Iran.

The secure messaging app Telegram is significant for two very different reasons.

Telegram websites