Home / News / Technology / Is Telegram’s Privacy Better Than Signal? Elon Musk Slams “Known Vulnerabilities” in Private Messaging App
Technology
4 min read

Is Telegram’s Privacy Better Than Signal? Elon Musk Slams “Known Vulnerabilities” in Private Messaging App

Published 3 days ago
James Morales
Published 3 days ago

Key Takeaways

  • Elon Musk recently tweeted that Signal has “known vulnerabilities.”
  • But is Telegram any better?
  • Although both platforms have their strengths and weaknesses, the cybersecurity community generally favors the open-source signal protocol.

Despite previously endorsing Signal, Elon Musk recently denounced the private messaging app. Sharing an article criticizing Signal Foundation Director Katherine Maher, he alluded to unspecified “known vulnerabilities” which he said the platform hasn’t addressed. 

While Musk’s intervention appears to be more political than anything else, it has nonetheless reignited a long-running debate among cryptographers that pits Signal against another encrypted messaging service: Telegram

Battle of the Private Messaging Apps

Although both apps claim to implement end-to-end encryption of users’ communications, there are some important differences between Telegram and Signal.

For starters, whereas Signal encrypts all messages by default, Telegram users must enable the “secret chat” option if they want their messages to remain private.

But if Telegram users do enable end-to-end encryption, there is still the question of which protocol is more secure.

Signal uses an eponymous open-source protocol that is also favored by Meta and Google, which have implemented it in their respective private communication services.

Meanwhile, Telegram uses its own encryption scheme MTProto, which was developed by one of the company’s founders, Nikolai Durov.

MTProto vs. Signal Protocol

Because MTProto uses unique cryptographic building blocks, Telegram has been accused of “rolling its own crypto.” In contrast, Signal uses open-source and verified hashes, key agreement protocols and zero knowledge proof systems.

Alongside concerns over the hidden nature of some of its components, vulnerabilities discovered in a previous iteration of MTProto further eroded trust in the scheme.

In a cryptographic community that favors openness and transparency, at the protocol level, Signal is the clear favorite. But at the application layer, it is also subject to criticism.

Reported Vulnerabilities

One good way to compare the security of Signal and Telegram is to track weaknesses identified through the Common Vulnerabilities and Exposures (CVE) system.

Currently, there are 14 known Signal vulnerabilities  and 36 known Telegram vulnerabilities 

Although Musk didn’t identify a specific vulnerability, in 2023, the cybersecurity researcher John Jackson disclosed two vulnerabilities he discovered in the Signal desktop app that remain a concern.

The first, CVE-2023-24068 , centered on the discovery that the Signal desktop client lacks a file validation mechanism. As such, an attacker could, in theory, replace files communicated between users. The second, CVE-2023-24069 , relates to the way the software stores unencrypted files on users’ devices. 

Despite concerns, because both vulnerabilities assume an attacker has access to the local file system, Signal developers have argued that the app still provides adequate privacy for most people’s needs.

The Best Solution? Encrypt Yourself

Together, Signal and Telegram teach us an important lesson about encryption: any scheme is only as secure as its implementation

Both platforms sacrifice security for usability. And given that no Signal or Telegram client is completely free of vulnerabilities, the most private messaging experience will always be to encrypt messages yourself using verified keys.

For more than 30 years, the PGP protocol has provided ironclad encryption for thousands of users who are advocates of the open-source programs that make it easy to sign, encrypt and decrypt messages.

Was this Article helpful? Yes No