Signal requires phone number just like Telegram does. Does it mean it is susceptible to the same attack that Telegram is?

With Signal, if a the numbers registers a new account like in this attack scenario, 1. the attacker cannot access old/pending messages (as they are always encrypted), and 2. the person on the other side of the conversation gets a warning that the keys have changed, thus need new verification before continuing the conversation. So, Signal is more secure on that front.

Telegram got two factor support which a user can enable anytime for security.

Also, there's a PIN code you can use to protect from transferring your number to another device. This is periodically asked by the client app so that you'll remember it.

Yes

Yes. But you don't get message history.

I thought that you can get message history but it is not automatic.

How about Wire as an alternative? I'm curious.

I've started using Wire recently, and while it has some minor warts, call quality has always been excellent. In addition I really love being able to use it on my computer without having to check whether my phone has connectivity or not. I hate having to babysit my phone all the time and Wire is just wonderful for that, kind of brings me back to MSN days.

This chart [1] compares several messaging apps' security standards; I'm not sure how accurate it is but maybe it can help you.

[1]: https://www.securemessagingapps.com/

I thought the best jurisdiction for privacy was Iceland? The solutions provided by your link are all USA/Switzerland/Germany.

Meh, jurisdiction is one thing, but if the trust model does not include the server (a e2e encrypted chat app does not require a trusted server by definition), it doesn't really matter that much. Most they can do is social network analysis (as in, who talks to whom), against which the only solution is using an anonymisation network like Tor (no jurisdiction is going to disallow their intelligence services to see to whom an alleged terrorist is talking).

We use Wire at work. It's sometimes a little buggy, but given the advantages (see my other comment in this thread: https://news.ycombinator.com/item?id=18838010), it's a definite recommendation. Full disclosure: my company is one of the independent auditors of Wire (though they did so before I joined them).

I believe Threema is more focused on business messaging these days. My employer recently qualified it as our official mobile messenger.

Providing an Open Source client seems no goal anymore.

What all the other messengers should copy is their poll feature [0]. It can basically act as an integrated Doodle.

[0] https://threema.ch/en/blog/posts/threema-poll-feature

Threema puts more focus on business customers than in the past (as it's more sustainable than one-time payments, there are no external investors). But the business app is still fundamentally the same as the "private" app, just with management/configuration features added. Private users are not second class citizens.

Regarding open source, the app isn't unfortunately. But the crypto (based on NaCl by djb) is documented[1], has been audited[2], has been reverse engineered twice[3][4] and there is an alternative client implementation[5].

[1] https://threema.ch/press-files/2_documentation/cryptography_... [2] https://threema.ch/press-files/2_documentation/external_audi... [3] http://blog.jan-ahrens.eu/files/threema-protocol-analysis.pd... [4] https://media.ccc.de/v/33c3-8062-a_look_into_the_mobile_mess... [5] https://openmittsu.de/

(Disclaimer: Threema dev)

I think Threema is more well known in Germany.