I’m always amazed how people come out of the woodwork to defend Signal any time any criticism of it comes up. It’s become a sacred cow that cannot be questioned. Whatever you may think of Telegram should bear zero weight on your views of Signal.

The reality is that developers of Signal have close ties to US security agencies. It’s a centralized app hosted in US and subject to US laws. It’s been forcing people to use their phone numbers to register, and this creates a graph of real world contacts people have. This alone is terrible from security/privacy perspective. It doesn’t have reproducible builds on iOS, which means you have no guarantee regarding what you’re actually running. These are just a handful of things that are publicly known.

And then we know stuff like this happens. NSA suggested using specific numbers for encryption that it knew how to factor quickly. The algorithm itself was secure, but the specific configuration of how the algorithm was implemented allowed for the exploit https://thehackernews.com/2015/10/nsa-crack-encryption.html

These kinds of backdoors are very difficult to audit for because if you don’t know what to look for then you won’t have any reason to suspect a particular configuration to be malicious. Given the relationship between people working on Signal and US government, this is a real concern.

The same kind of scrutiny people apply to Telegram and other messaging apps should absolutely be applied to Signal as well.

I am going to repeat what I have said for another similar post.

I still stand for Signal App.

• Telegram has no default E2EE, Telegram is run by for profit company
• Multiple flaws were found in Telegram’s encryption algorithm
• Almost all cleartext messages are stored on telegram server, but signal stores encrypted message temporarily
• Signal is non-profit & all their source code + finances are public. Even their server codes are publically available

There is also Matrix, which has advantages over both of them.

Edward fucking Snowden has recommend Signal and I think if anyone knows whether it’s secure, it’s probably him and the NSA.

That and he is paranoid to a point where he physically kills all mics and cameras on his devices, so if he claims anything is secure, I will believe him unconditionally.

I know that Telegram has a lot of users, so I’m not describing all of them here. But I’ve noticed that it seems especially popular among people who kind of like to “play pretend” as underground hackers. You know, the kind of person who likes to imagine that the government would be after them.

This mudslinging feels like more of a marketing campaign than anything else. An info op that will work well on the Telegram users who like to imagine that they have outmaneuvered all the info ops.

Yeah, I’m going to take this with a massive dose of salt. At least, Signal has encryption on by default for people. Where Telegram does not.

claiming it has ties Which lines of its libre software source code are malicious?