Not entirely false, no. It does not have end-to-end encryption by default, and not at all for group chats, and the cryptography is a bigger unknown than with others.

> It does not have end-to-end encryption by default

That doesn't mean it "has a poor security record" (implying that the security is broken), it means it is not as secure as other options.

> not at all for group chats

May not be a requirement for group chats

> the cryptography is a bigger unknown than with others

Unknown does not mean bad, it means unknown. Almost definitely worse than Signal, but almost definitely better than Facebook Messenger.

To say Telegram is less secure than e.g. Signal is true. To say it "has a poor security record" is disingenuous and misleading. Once Telegram has had several security breaches, then that would be a fair phrase. Until then, there are levels of security for given threat models, and Telegram's is not as secure as others', by design.

Quoting Moxie: THere's nothing to be broken because there's no end-to-end encryption to begin with. Do you think nation state hackers publish their finding about the trove of private messages telegram's vast server complex holds indefinitely? hahahahaha

False? Is it? I've yet to see a satisfactory answer to the criticisms that were posed about the security of Telegram.

Are they allowing you to have accounts that don't depend on your phone number yet? I think last I checked you could only login with your phone number, which I consider extremely insecure, especially against a nation state agent (you'd think the Telegram team would care more about that, considering where they come from - and in fact, I believe there were some reports of Russian government hacking people like this with the help of national carriers, too).

> (you'd think the Telegram team would care more about that, considering where they come from)

That assumes the Telegram team aren't part of the nation state apparatus, surely.

Do you have any reason to assume they are? Of course, other than the fact that the founder is _RUSSIAN_ gasp

I don't assume they are. But equally I don't automatically assume they aren't, either.

You're just evading my point. Implicitely or explicitely you must have a _working_ hypothesis. When you make decisions, you must assume one or the other.

There is an optional two-factor login (phone+password).