I wonder what the author’s other reservations about Telegram are? Hand rolled crypto is definitely a massive reason to be suspicious, but are there other issues the author is alluding to?
Telegram is not serious about security & privacy at all, for example:
1. It does not support end-to-end-encrypted (E2EE) group chat at all.
2. It does not enable E2EE chat by default.
3. "Secret Chat" (the only E2EE encrypted chat) experience is deliberated nerfed, it's not available on PC / Web and can only be initiated with a buried-in-dot-menu option in phone ap.
4. It had multiple weird 0-click attack surface in the past. [0]
In addition, Telegram always prefers usability over privacy, it does not do tradeoff, more like 100% usability 0% privacy. Users like this, but I don't know what to think about it.
[0] Signal isn't any better on this though, they refused to add an option to disable their video/audio call stack for those who don't use it to do attack-surface reduction.
This isn't terribly specific but its an encrypted chat app from an authoritarian country that in practice is accepted and used by the government. It has further managed to survive an increasingly tight enviornment for censorship and free expression that is distinctly worse than when the app launched.
Every online service has its fair share of malicious actors though, that isn't limited to Telegram. Whatsapp is used for a big chunk of phishing and scams in the Netherlands for example.
I was responding to this. But in most cases people will end up using the things that their communities use. I don't care much for reddit yet I am on reddit almost every day
