Elham Vaziripour, Reza Farahbakhsh, Mark O'Neill, Justin Wu, Kent Seamons, and Daniel Zappala, Private But Not Secure: A Survey Of the Privacy Preferences and Practices of Iranian Users of Telegram, Workshop on Usable Security (USEC), February 2018.
Telegram is a secure messaging application that offers a wide variety of privacy and security features, but these features must be activated or chosen by users, rather than being turned on by default. At the same time, Telegram has a large number of users in Iran, who may potentially have a high need for privacy and security. In this paper, we present a survey of about 400 Iranian users of Telegram, living both inside and outside of Iran, exploring their privacy preferences and their use of Telegram's available privacy and security features. We find that the overwhelming majority of respondents feel it is important that messaging applications protect the privacy of their messages, yet their adoption of the available privacy and security features is mixed. We discuss in detail these varying practices and how the design of Telegram influences adoption of various features. We finish by discussing recommendations for improving the design of Telegram and similar secure messaging applications so that they place a greater priority on protecting privacy.