Telegram has launched a pretty intense campaign to malign Signal as insecure

Context: Telegram’s campaign & reactions

• Discussion centers on a Telegram post and related social media chatter claiming Signal is insecure, amplified by high‑profile tech figures.
• Many see this as a coordinated attempt to discredit Signal and promote Telegram; others argue both sides are now running “campaigns” against each other.

Encryption and security defaults

• Strong consensus: Signal uses end‑to‑end encryption (E2EE) by default for all chats and is widely adopted by other messengers as a protocol.
• Telegram’s “secret chats” are E2EE but:
  • Not enabled by default.
  • Only work for 1:1, mobile‑only, not desktop.
  • Coexist with non‑E2EE chats with the same contact, making mistakes easy.
• Several commenters say “optional E2EE” is effectively no E2EE for most users.

Metadata, phone numbers, and anonymity

• Criticism of Signal: phone number requirement, metadata concerns, previous lack of usernames, and leveraging the phone’s social graph.
• Others reply:
  • Signal now supports usernames and hiding numbers from contacts.
  • Subpoena examples in the thread show Signal retaining only minimal metadata (account creation time and last connection).
• Both Signal and Telegram still require a phone number for registration (Telegram can be used with paid “anonymous numbers”), which some see as fundamentally de‑anonymizing.

Code openness, builds, and distribution

• Signal:
  • Open‑source clients and server; Android builds are reproducible.
  • No F‑Droid release; prefers its own APK and major app stores for update control and stats.
  • Criticized for past lag between deployed server features (e.g., crypto payments) and public server code.
  • Uses Electron on desktop and a --no-sandbox configuration on many Linux installs, raising attack‑surface concerns.
• Telegram:
  • Client code is (partially) available and has reproducible builds guides; server code is closed.
  • FOSS forks in F‑Droid and distros exist but often lag, require volunteer “wrangling,” and can’t be used to register accounts or access premium features.
  • Some praise this ecosystem; others note closed server and lack of default E2EE negate security claims.

Protocol quality: Signal vs MTProto

• Many commenters: Signal protocol has undergone extensive, multi‑party review and is broadly considered sound.
• Telegram’s MTProto:
  • Earlier versions had serious design issues (non‑standard crypto, odd ECDH, unnecessary double encryption, nonce misuse).
  • Newer work symbolically proves MTProto 2.0 secure under ideal assumptions, but critics still call the design “weird” and amateurish compared to established practice.
  • A minority argue the remaining issues are overstated or FUD.

Trust, geopolitics, and honeypot fears

• Recurrent suspicion that Telegram may be influenced by or useful to Russian security services; some call it an FSB honeypot, others find that speculative.
• Counterpoint: Telegram moved to Dubai, has resisted Russian demands in the past, and is heavily used by both Russian and Ukrainian actors and Hong Kong activists, which some take as evidence it’s “safe enough.”
• Others argue physical coercion of founders or developers is possible in any jurisdiction, and no large centralized service is fully trustable.

Usability, adoption, and spam

• Many praise Telegram’s UX: fast, polished clients, rich features (channels, large groups, saved messages, scheduling, spoilers, formatting, editing, “RSS‑like” following of channels).
• Signal’s UX, especially desktop, is called clunky; critics cite slow feature rollout, limited group/community tooling, and past crypto payment integration.
• Usage is highly regional:
  • Some say “everyone uses Telegram” (e.g., parts of post‑Soviet space, some EU circles); others say “nobody does” or only scammers use it.
• Spam and scams:
  • Telegram widely described as full of bots and scams.
  • Some users report increasing scam attempts on Signal as it grows, but far fewer than on Telegram.

Alternatives and broader skepticism

• Several commenters advocate Matrix, XMPP, SimpleX, Briar, Session, Tox, or PGP over both apps, emphasizing decentralization and federation.
• A noticeable contingent distrusts all big messengers and all states (US, Russia, China, etc.), seeing both Signal and Telegram as potentially compromised.
• Meta‑point: many note the debate is heavily politicized (left/right, US/Russia narratives) and recommend focusing on concrete technical properties: default E2EE, metadata minimization, open audits, and realistic threat models.