Telegram's server side software is closed source, owned and ran by them exclusively so they really have no room to talk. WhatsApp doesn't even have OSS clients so they're even worse in that regard

It's hard to overstate what a nothing-burger this article really is! Let me break it down:

• Signal got $3 million from the Open Technology Fund at some point in its development
• Some anonymous source alleges that the OTF's ultimate goal is to promote US foreign interests
• The current chairman of the board Katherine Maher worked at the National Democratic Institute and Wikipedia before
• The same anonymous source says she was recruited because of connections to the OTF
• She has at some point voiced the opinion that a completely free internet without regulation just reproduces existing power structures, and that balancing regulation and 1st amendment rights is a tough problem
• Signal doesn't have reproducible builds on iOS (it absolutely does on Android btw)
• Some people feel like Signal chats come up more often than they should in court cases and media reports

That's it, that's the whole story. That's the reason why the Telegram guy of all people thinks you should be careful, and better use his chat service instead, and the Twitter guy agrees.

I mean, reproducible builds on iOS would be nice, but that platform has much bigger problems from a privacy/security/sovereignty/freedom standpoint anyway. And the rest is just nothing turned up to 11.

Lol telegram calling signal insecure is too funny.

Maybe he should focus on adding e2e encryption to the default chats and group chats instead of spreading FUD.

Telegram: There are backdoors in Signal encryption!

Also Telegram: not encrypted

Looks like a push to discredit Signal right now. While I know Signal isn't perfect, I do like it and I haven't seen anything that is better (on the whole). The 3rd "emoji-point" is quite an accusation, and I would love to see any evidence of this kind of thing, that didn't result from the cops unlocking a defendants phone, or having infiltrated a chat.

arent telegram chats unencrypted by default?

An alarming number of important people I’ve spoken to remarked that their “private” Signal messages had been exploited against them in US courts or media

source?? (i bet this ends up being a "they had full access to my unlocked phone" situation again)

also the whole thing abt US funded encryption is the same bullshit argument ppl use against Tor all the time. it doesnt mean shit.

this just reads like someone desperately trying to get more market share by spreading FUD

Go read the GitHub issue. The main difficulty in implementing reproducible builds is the code signing Apple requires as well as other tweaks Apple makes to modify the binary from what the dev submits to what gets downloaded from the App Store. Note that Android already has reproducible builds. Also the reason the GitHub issue was closed wasn’t “refusal” to implement the feature, they wanted to move the discussion to their forums.

Sounds like someone is mad that security experts would rather trust a tried-and-true encryption standard over Telegram's encryption which is known to not be anywhere near as secure as the Signal protocol.

Pavel resorting to outright slander to promote Telegram is not something I expected to see.

Why all the emojis? Why can't people just write an article?

This comes a few days after Jack Dorsey confirmed that he had left the board of Bluesky and then starting to use Tw(X)tter and calling Tw(X)tter "freedom technology". Coincidence ?

Okay first things first Jack Dorsey is a tool

The US government / CIA did in fact develop the protocol back in the day, with the goal of helping people in China and other countries message securely, probably with ulterior motives.

But the protocol itself is open source, and you can use it without any affiliation with the US government.

The claim " It looks almost as if big tech in the US is not allowed to build its own encryption protocols that would be independent of government interference 🐕‍🦺" is therefore so stupid it almost invalidates everything else being said because the person writing is either an idiot or purposely misrepresenting the facts.

Not having reproducible builds is definitely weird though. Does anybody have more information on that?

You don't need a backdoor in signal to bypass its encryption.

All you need is to exploit the phone and wait for them to open or use signal.

If you think your phone is safe from the NSA or similar services, I got some bad news for you.

Maybe fix Telegrams privacy problems.

https://www.404media.co/this-tool-shows-some-telegram-users-approximate-physical-location/

I don't think i care what Jack Dorsey says that isn't backed up independently. Even if he's right i just don't trust him.

The kettle calls the pot black...

Telegram: We keep you private. Now enter your phone number to sign up.

Yes, sorry, but I can't take something seriously if every paragraph begins and ends with an emoji. I know it's dismissive, but all my Facebook lunatic conspiracy theory alarm bells are blaring.

This is also just a few days after Durov published Nazi dogwhistles in the latest Telegram update blog post.

https://plush.city/@PsyChuan/112336464469767051

Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github.

Not true. Signal has a very similar client verification process to Telegram's, described here. The lack of an iOS reproducible build is an Apple limitation / nuisance.

It’s very complicated, the 2nd jailbroken device is necessary because there’s no other way to download the .ipa, but even if you manage to do that and bit-for-bit reproduce the .ipa you downloaded from source, there’s no way to know if the App Store is sending every user the same .ipa or if your other, non-jailbroken iPhone downloaded a backdoored one.

Telegram docs even acknowledge these limitations.

Ultimately, this client verification is not the selling point Telegram's founder makes it sound like, since most messages are not E2EE and the server code is closed.

I don't care about dorsey or whatever, but a lot of privacy advocates don't consider signal secure, drew devault for example. I'm def among them, you should not trust any centralized US-hosted service.

Saw someone post that City Journal article on mastodon a couple days ago and I'm amazed that so few people picked up that the City Journal and the article's author are basically puppets of the Manhattan Institute, a conservative think tank. I know most people aren't tuned to look out for think tank propaganda but it came off as really obviously FUD-y and unsubstantiated.

Still got server-side code closed source and by default messages are not encrypted.

One is open source and you can check the code while the other is not completely open source and uses proprietary encryption. That's right, proprietary encryption.

I wonder if their recent blog post promoting conspiracy theorists and right-wing people turned away more people from telegram than they expected and now they feel the need to spread FUD against their competitors.

Yeah, he needs to fix his broken secret chat feature first... I think it's broken on purpose..

After seeing his interview with Tucker Carlson, I'm 100% sure the guy has some really dark agenda..

Points 0 and 1: None of this is new. This goes back to 2011 or 2012.

Point 2: If someone gets hold of your phone and unlocks it (meaning, they can interact with it), they have access to your Signal messages on-board. This is why additional security measures (not using biometrics, encrypting your phone natively) are recommended. If your phone is off and someone dumps the data from it, they get encrypted data.

There is SimpleX also