At least that's what they tell you. We can't know for sure because it's closed-source.

WhatsApp is as closed as the version of Telegram you download from the (App|Play) Store.

Before you say "but I can compile it myself", think of how many people will ever bother to do that.

You can download it from F-Droid where they will compile it from the source for you. Yes, only very few people will use that version, too. But with that logic there isn't any reason for open-source at all.

Same as every other app including Signal. For the record, not advocating using Telegram over Signal.

One would do in order to unearth any backdoors. In case of WhatsApp, that would be more difficult.

No, we can easily know for sure, despite the fact that it's closed source.

How?

Sorry, I don't understand your question.

How can you know for sure?

By looking at the code.

but it's closed-source, so we can't do that

`tptacek is being obtuse, but it really is pretty straightforward: https://en.wikipedia.org/wiki/Decompiler

It's a forward tick: 'tptacek. We're not writing Lisp macros. :)

So you concede that you were being obtuse ;)

Not really: I'd just rather find out where the point of contention is before getting pedantically prolix.

You understand how frustrating it is for open source advocates to hear that normal users will never look at source code and so there's no practical difference for them between closed source and open source since it's all opaque to them anyways?

That's how literally every security person feels about the argument that closed-source software is unknowable.

We don't need decompilers or special tools to read closed-source applications. Almost all of them --- very much including the Signal-based messengers --- are built with tools that produce straightforward easy to follow assembly code.

So there's no practical difference for you in understanding algorithms between assembly and higher-level source code?

I think there is another issue to remember, you can't trust the source.

So, I doubt any security professionals would say its preferable to not have the source, but to do the job of verifying the software you have to do it at a lower level than the source anyway, so having the source is a bonus, not a requirement.

In practice we often don't even need to read the assembly code; we can match control-flow graphs. There really are some software security verification problems that are easier from the binary, particularly if the build system is complex.

But that's sort of besides the point. Reading assembly is more tedious than reading C code, which is in turn more tedious than reading Python code. But you don't get to move the goalposts now. You claimed, repeatedly, that closed-source software was unknowable. It is not; it is in fact very far from unknowable. So the idea that Facebook is going to sneak backdoors into some of its most prominent code under cover of "closed source" is an extraordinary claim, requiring extraordinary evidence.

I see, thanks for clarifying.

According to https://www.eff.org/node/82654

whatsapp 6 out of 7

telegram(in secret chat) 7 out of 7

So i am not going to comment on the quality of whatsapp, because their sources are closed.

But I think you need to mention by default telegram is 4 out of 7, by default whatsapp is 6 out of 7 if you want to compare that kind of thing.

Most people are not going to use the secret chat.

Is anyone so incapable that they would not know how to enable the secure features?

Most people don't care about secret chat. This is for people who care. Granted, they don't have secret chat on Desktop which makes the whole app useless in general unless you only use phones for communication.

>Most people are not going to use the secret chat.

This is a reason i said "It's ok" in my original comment. Few people need encryption in day to day communication, but if you need it telegram is better.

Completely out of date.

Try this one: https://www.securemessagingapps.com

Recommends Signal and (with caveats) Threema and Wire.

> This is version 1.0 of our scorecard; it is out of date, and is preserved here for purely historical reasons.

It is out of date but they have revised it just after whatsapp implemented p2p encryption. Before that whatsapp rating was even lower.