Is Telegram’s Privacy Better Than Signal? Elon Musk Slams “Known Vulnerabilities” in Private Messaging App
Which is is the most secure private massaging app out of Telegram and Signal?
Key Takeaways
- Elon Musk recently tweeted that Signal has “known vulnerabilities.”
- But is Telegram any better?
- Although both platforms have their strengths and weaknesses, the cybersecurity community generally favors the open-source signal protocol.
Despite previously endorsing Signal, Elon Musk recently denounced the private messaging app. Sharing an article criticizing Signal Foundation Director Katherine Maher, he alluded to unspecified “known vulnerabilities” which he said the platform hasn’t addressed.
While Musk’s intervention appears to be more political than anything else, it has nonetheless reignited a long-running debate among cryptographers that pits Signal against another encrypted messaging service: Telegram.
Battle of the Private Messaging Apps
Although both apps claim to implement end-to-end encryption of users’ communications, there are some important differences between Telegram and Signal.
For starters, whereas Signal encrypts all messages by default, Telegram users must enable the “secret chat” option if they want their messages to remain private.
But if Telegram users do enable end-to-end encryption, there is still the question of which protocol is more secure.
Signal uses an eponymous open-source protocol that is also favored by Meta and Google, which have implemented it in their respective private communication services.
Meanwhile, Telegram uses its own encryption scheme MTProto, which was developed by one of the company’s founders, Nikolai Durov.
MTProto vs. Signal Protocol
Because MTProto uses unique cryptographic building blocks, Telegram has been accused of “rolling its own crypto.” In contrast, Signal uses open-source and verified hashes, key agreement protocols and zero knowledge proof systems.
Alongside concerns over the hidden nature of some of its components, vulnerabilities discovered in a previous iteration of MTProto further eroded trust in the scheme.
In a cryptographic community that favors openness and transparency, at the protocol level, Signal is the clear favorite. But at the application layer, it is also subject to criticism.
Reported Vulnerabilities
One good way to compare the security of Signal and Telegram is to track weaknesses identified through the Common Vulnerabilities and Exposures (CVE) system.
Currently, there are 14 known Signal vulnerabilities and 36 known Telegram vulnerabilities .
Although Musk didn’t identify a specific vulnerability, in 2023, the cybersecurity researcher John Jackson disclosed two vulnerabilities he discovered in the Signal desktop app that remain a concern.
The first, CVE-2023-24068 , centered on the discovery that the Signal desktop client lacks a file validation mechanism. As such, an attacker could, in theory, replace files communicated between users. The second, CVE-2023-24069 , relates to the way the software stores unencrypted files on users’ devices.
Despite concerns, because both vulnerabilities assume an attacker has access to the local file system, Signal developers have argued that the app still provides adequate privacy for most people’s needs.
The Best Solution? Encrypt Yourself
Together, Signal and Telegram teach us an important lesson about encryption: any scheme is only as secure as its implementation
Both platforms sacrifice security for usability. And given that no Signal or Telegram client is completely free of vulnerabilities, the most private messaging experience will always be to encrypt messages yourself using verified keys.
For more than 30 years, the PGP protocol has provided ironclad encryption for thousands of users who are advocates of the open-source programs that make it easy to sign, encrypt and decrypt messages.
Grindery CEO Tim Delhaes: Telegram’s EVM Focus Driven by Community Demand
Hardware Wallets Will Inspire Privacy Tech Revolution Says Telegram’s Pavel Durov
Tether Stablecoin Could Bypass Financial Censorship As Nations Crack Down On Telegram