A couple of things:
1. the crypto has been improved significantly after the launch as far as I know. That release was back in the dark ages about half a year after WhatsApp got caught sending data unencrypted (and I'm using that word in its original meaning).
2. Can we agree to stop recommending WhatsApp soon?
I shared some notes on crypto issues more recently in another post above, but I would concede its generally more battle tested than the first version released at this point. The choice to start with home rolled crypto at all continues to concern me, but more importantly the fact that it's not default is now my biggest sticking point if I'm honest.
I think WhatsApp comes with an asterisk in that I'd certainly recommend signal over it, but most non-technical people have never heard of signal so given the choice between WhatsApp and Telegram I'd personally opt for WhatsApp based on their e2e encryption by default, but I could understand if someone personally gave more weight to a distrust of Meta (even if encrypted) than they do to Telegram and made use of Telegram's secret chats.
Strong disagree. I would rather have multiple solutions in production, and Telegram's is also well-studied.
> But ultimately they prove that the four key issues “could be done better, more securely and in a more trustworthy manner with a standard approach to cryptography,” said ETH Zurich Professor Kenny Paterson, who was part of the team that uncovered the flaw.
https://www.cyberscoop.com/telegram-app-security-encryption/
We are better off that Telegram exists as an alternative. We don't need Signal's protocol (also used in Whatsapp etc) to be a potential SPOF.
To quote: The central result of this work is a proof that the use of symmetric encryption in Telegram’s MTProto 2.0 can achieve the security of a robust bidirectional channel if small modifications are made.
This is technically incorrect. They use well known cryptografic algorithms for encryption and authentication. However, their protocol is unique combination of these cryptografic algorithms to provide specific purpose. It is different thing and different perspective than ”normal” use case for saying ”don’t roll your own crypto.”
To be specific with what I mean, it is "roll your own" in the sense that 1) their protocol combines cryptographic primitives in unrecommended ways with no particular justification and in the sense that 2) they literally have invented and written many of these primitives themselves.
As a concrete example, the IGE mode used by Telegram for AES is not "well known", in fact to the best of my knowledge Telegram is the only popular software in existence that uses this mode. IGE is avoided by all modern cryptographers because the authentication is broken, however Telegram uses this mode but not the authentication. There's no particular justification for this decision over just using an AES mode that everyone uses, but there's a lot of potential pitfalls if not done carefully.
When you ask what type of authenticated encryption scheme Telegram uses, their answer is "none of them". Normally this would be a huge problem. However, they have solved this with their own custom "security checks". These are also not "well known" because Telegram invented them.
When you ask what type of PKCS they use for padding, the answer is "we came up with our own padding algorithm". This was not "well known" because Telegram invented it. The padding issue they fixed in v2, since it turned out to introduce a vulnerability, but I assume you get what I mean by this point.
Contrast this with Signal, which is also ultimately a unique protocol but is one that was implemented using robust, tested primitives in recommended combinations with boring standard choices for all of the details.
The whatsapp that leaks your data to the FBI in real time [1], or do you mean some other whatsapp?
These comments on whatsapp, which appear with regularity by the way, are misleading and just inflammatory.
Have you seen the source code to claim there are no backdoors? Wait, you haven't because it's a proprietary piece of crap produced by the worst corp in existence - Facebook aka Meta. The same entity that's shamelessly involved into Putin's Russia level political censorship and yet we are to trust it according to the parent comment. Right...
Excerpt from the FBI report:
> Pen Register: Sent every 15 minutes, provides source and destination of every message. [without a warrant of any kind]
(And who knows what other three letter agencies can get.)
BuT ThAt'S jUsT mEtAdAta, wE hAvE nOtHinG tO hIdE. Then keep using it, but don't spread your bullshit to others.
This is not my understanding of the situation at all. There's no end-to-end encryption by default [0], and the end-to-end encryption they do have received significant controversy at launch [1] for being essentially a "roll your own" crypto solution which indeed ended up being found to have some issues [2].
They disable the OS backup and instead they effectively store all their user's contacts, messages, media, etc. directly on their servers except for the conversations that the users directly opt out of by turning on e2e. They've promised since 2014 to open source everything but the backend, which stores all this data, is still closed source.
For small group or individual messaging, whatsapp, signal, or matrix are far better choices. I think it's worth acknowledging that telegram has a much bigger focus on large groups and therefore has to make different security tradeoffs, so I think if we consider telegram a social media service it's pretty good -- but is not the best messenger.
[0]: https://www.howtogeek.com/710344/psa-telegram-chats-arent-en... [1]: https://www.vice.com/en/article/wnx8nq/why-you-dont-roll-you... [2]: https://eprint.iacr.org/2015/1177.pdf