Some messaging apps handle link previews in a highly insecure manner.
Instead of generating the link preview locally on the user’s own device, these apps choose to send links to a hosted service and generate the link preview remotely instead.
This puts the remote link preview service in a position where it can see and potentially monitor which links people are sharing, who is sharing them, and when they were shared.
Telegram Link Previews
Link Previews in Telegram are always generated remotely on Telegram’s servers.
Telegram provides an option to completely disable Link Previews in Secret Chats. If this setting isn’t disabled, even URLs and websites that are exchanged in end-to-end encrypted chats are leaked to Telegram’s servers.
iOS: Telegram Settings > Privacy and Security > Data Settings > Link Previews
Android: Telegram Settings > Privacy and Security > Link Previews
End-to-end encryption is not enabled when exchanging messages with other RCS apps (e.g. Samsung Messages).
Legacy message formats like SMS and MMS are not end-to-end encrypted.
Apple Messages End-to-end Encryption
End-to-end encryption is only enabled by default for iMessage (blue bubbles).
Legacy message formats like SMS and MMS (green bubbles) are not end-to-end encrypted.
Apple can also access end-to-end encrypted chats and reveal message contents to external parties under some circumstances.
To prevent this, every participant in the conversation must either enable Advanced Data Protection for iCloud or completely turn off iCloud backups on all of their devices.
In addition to other group attributes that are end-to-end encrypted (such as group names, group descriptions, and group avatars), the Signal service also doesn’t have access to any information about which accounts are part of a group, which accounts are admins in a group, which accounts can add new people to a group, which accounts can approve requests to join a group, or which accounts can send messages in a group.
