Well, there was this glaring hole that let the server MITM secret chats on every key negotiation back when they were all cocky on HN.

That was not theoretical at all, and very much something that could be used without detection, even if the users verified fingerprints, since it made clients create insecure keys.

The guy who found it got their maximum bounty IIRC.

Whereas the best attack on signal was somewhat sort of relay thing of very questionable usability to an attacker.

> That was not theoretical at all, and very much something that could be used without detection, even if the users verified fingerprints, since it made clients create insecure keys.

It could have been done by Telegram. No proof it was. Still sound theoretical to me. I doubt they knew it was possible.

Also: Was Telegram's source used to find the vulnability? If so, it's unfair to compare WhatsApp and Telegram like that.

Also WhatsApp doesn't bait with a bounty like Telegram does (see https://www.linkedin.com/pulse/whatsapp-security-vulnerabili... for example).

It wasn't theoretical in the sense "this could potentially be a problem" as with most crypto vulnerabilities. We don't know that it was performed, but we know that the protocol was vulnerable, either because of malice or because their world champion programmers thought it was a good idea to let the server provide the client with entropy to create keys.

I don't know which one is worse.

There is also a pretty substantial branch of the computer security industry that thrives on security problems found in software they don't have the source code of. And good luck keeping up reviewing telegram. They release sources every 6 months. Last one was for 3.18 which had something like 170k additions and 90k deletions.

No. See also: https://news.ycombinator.com/item?id=10713064

His point still stands though