The short answer
- 1Rooting or jailbreaking opens full administrative control of the phone, and makes it easier for attackers to get it too.
- 2With root access, an attacker can read apps' memory and storage, so no app is safe, Telegram's FAQ says.
- 3Encryption protects messages in transit, not once they are decrypted on a compromised phone.
In this article
What rooting and jailbreaking change
Rooting an Android phone or jailbreaking an iPhone unlocks full administrative control of the device, called root access. Telegram's FAQ explains why that is dangerous: it makes it easier for an attacker to gain the same control. Someone with root access can bypass the security features built into the operating system, read the memory of running apps and reach restricted areas such as internal storage. In the FAQ's words, once an attacker has root access, "No application can be called safe under these circumstances, no matter how strong the encryption."
| A normal phone | A rooted or jailbroken phone | |
|---|---|---|
| Apps reading each other's data | Blocked by the operating system | An app with root access can read other apps' data |
| A malicious app | Contained by the system's walls | The walls are weaker or gone |
| Telegram's encryption | Protects messages in transit | Still protects them in transit, but not once they are decrypted on the device |
Why encryption cannot help here
Encryption protects a message while it travels between devices. To show it to you, the app has to decrypt it on your phone. Whatever can read your phone's memory or storage at that point can read the message too. That is true for cloud chats and for secret chats: a secret chat's end-to-end encryption ends on the two devices, and what appears on screen, or is saved on the device, is only as safe as the device.
The FAQ makes the same point more generally: Telegram cannot protect you from anyone who gets physical or root access to the phone or computer running it. See what secret chats protect, and what they don't.
If you have to use such a device
- Keep sensitive conversations elsewhere. Use an unmodified phone or computer for anything that matters.
- Use official apps only. Modified "Plus" or "Pro" versions of Telegram add risk on top of risk; see fake Telegram APKs.
- Do not grant root to apps you do not trust. Root permission is exactly the access the FAQ warns about.
- Protect the account itself. Turn on Two-Step Verification and a passcode lock, as the FAQ recommends; see passcode lock.
FAQ
Is Telegram secure on a rooted phone?
Not fully. Telegram's FAQ says that once an attacker has root access, no application can be called safe, however strong the encryption.
Do secret chats protect me on a jailbroken iPhone?
They protect messages in transit, but not what is decrypted and shown on that device.
Should I log in to Telegram on a second-hand phone?
Reset it to factory settings first. If you cannot tell whether it was rooted and cannot reset it, do not use it.
Sources
At a glance
- 1Risk
Root access bypasses the system's protections.
- 2Encryption
Ends on the device; it cannot help after that.
- 3Instead
Sensitive chats on an unmodified device; official apps only.
Updated
