Is it wise to trust Telegram?

[cesarcafe]

Moving myself towards an environment with more privacy, I'm not sure if Telegram is completely reliable in terms of privacy. I mean, what are the interests behind their business? Do they have any liaison with any corporation, ideology, etc? The client is open source, but why the server is not? Also, whenever you look for technical details, addons, etc, you end up in Russian-only forums and groups (which doesn't make me feel confident because I'm not able to understand anything).

I don't want to imply I dislike Telegram, I want to like it, but the thing is that I know what's behind Whatsapp (very bad stuff) but I'm not able to find conclusive evidence showing that Telegram is 100% trustworthy in terms of privacy, so any comment you can make on this topic will be greatly welcome.

[muntasiraonik]

Well, your question is too narrow. I have seen many reviews and most of them suggest telegram is a good platform.

[cesarcafe]

Well, your question is too narrow. I have seen many reviews and most of them suggest telegram is a good platform.

To be honest, I didn't know how to write the question. The thing is, I want to avoid whatsapp, but is telegram something I can trust? For example, when I visit the protonmail site, I can conclude that I can trust protonmail. But, when I research telegram... I don't find things explained in the way I need for saying I can trust them.

[evasb]

If you are using secret chats, yes, but If you are using cloud chats you have to trust Pavel Durov.

I, personally, think that Pavel Durov is a good guy, but the less you trust somebody else about the privacy of your conversations the better.

[Paradigm Shifter]

What about Signal? I've got no experience of either, but it's another messaging app that has cropped up in the privacy debates. I really should look into this stuff more myself.

[cesarcafe]

What about Signal? I've got no experience of either, but it's another messaging app that has cropped up in the privacy debates. I really should look into this stuff more myself.

What I dislike from Signal is that they seem to take a position not only in terms of privacy, but in terms of political activism. I'm interested in privacy only, and I prefer that the products I choose don't go into political activism (although I admit that sometimes you just need to take the technology and ignore the politics behind them, or even put a sticker covering their logo if you don't want to promote them nor to imply that you back their ideas).

[cesarcafe]

If you are using secret chats, yes, but If you are using cloud chats you have to trust Pavel Durov.

I, personally, think that Pavel Durov is a good guy, but the less you trust somebody else about the privacy of your conversations the better.

Bummer, I looked for secret group chats and they are not implemented yet in Telegram In fact I could convince some of my friends to move our groups from Whatsapp to Telegram, but if there are no secret group chats yet, there's no point in doing it...

[Paradigm Shifter]

What I dislike from Signal is that they seem to take a position not only in terms of privacy, but in terms of political activism. I'm interested in privacy only, and I prefer that the products I choose don't go into political activism (although I admit that sometimes you just need to take the technology and ignore the politics behind them, or even put a sticker covering their logo if you don't want to promote them nor to imply that you back their ideas).

Thanks for the info. I didn't realise they were quite that polarised.

[cesarcafe]

Thanks for the info. I didn't realise they were quite that polarised.

However, after reading more about Whatsapp, Telegram, and Signal, I feel Signal is better. I don't back their political ideology, but, as I said above, sometimes you adopt technology from people you don't agree with, and use such technology for purposes different to theirs. In some cases, when you want to avoid promoting them, you can hide their logos/brands, although this is more applicable to physical products (ie: Macs for example) than to software.

Said this, and back to the point, what I found is (please correct me if any of this is wrong, because cybersecurity is not my field):

Whatsapp has end to end encryption for all messages (protocol developed by Signal for them) but for metadata: metadata is stored in their servers without encryption. This means that Whatsapp knows what people you communicate with, and at what times. They cannot access the content (it's E2EE'd) but they can know what people and communities you participate with. Also, it's closed source, so nobody knows what's going on behind.

Signal has end to end encryption for everything including metadata. By the way, some people believe that Signal doesn't store your messages, but this is not true: they are stored in a queue until the message has been read by all the recipients and all linked devices, and then it's deleted from the queue. However, while it's stored in the queue servers, it's encrypted with E2EE, so nobody can read them unless they know the keys for the sender and the receiver, or unless they attack the message with (costly) deciphering. This means that, unlike Whatsapp, Signal doesn't know what people or communities you are in contact with, nor the times you communicated at. Signal is open source, so the software cannot hide any surprise (well, unless nobody notices it by reading the source, that is).

Telegram has no end to end encryption unless you activate a "secret chat". Unfortunately, "secret chats" are not available to groups. This means that, for groups, Whatsapp can be even safer than Telegram, because in Telegram your group messages are stored in servers with encryption that can be removed with keys that Telegram controls. Also, Telegram also stores metadata without E2EE (so they know who you communicate with, and when --and even the full message if it's in a group or in any other non-secret chat). They publish the source code for the client, but not the server, which doesn't look like a transparent policy at all. Honestly, I don't understand the trend of moving to Telegram because of being "more secure" than Whatsapp: That's not what I feel now, after having read all of this for the last days. The only advantage I see in Telegram is that you can have accounts not attached to a mobile phone number. This is very good, but the other problems are too severe, IMHO.

Yes, I know I started this thread asking about Telegram, but, unless I'm missing something, I ended up finding that Signal is preferred (I've also read that Signal is also working in future support to accounts without a mobile phone number, but I'm not sure how real is this).

If anybody has additional advice, or any corrections to make, please feel free to do so!

[Paradigm Shifter]

If anybody has additional advice, or any corrections to make, please feel free to do so!

You've done a lot of looking at this; thanks for the summary!