Telegram?

[Gooseman]

Telegram is made in Russia. I'm not sure why you're all so quick to believe it's secure. Signal is a much better alternative.

[MyOdessa]

Telegram is made in Russia. I'm not sure why you're all so quick to believe it's secure. Signal is a much better alternative.

Just plain wrong, but thanks for playing.

Telegram is made by brothers Durov, who are from Russia. They also made VK, when Russian government decided to take that from them, Durov and his team left Russia.
They started Telegram in Europe. Russian government passed the law and demanded that Telegram passed info on its users to the Russian government, Durov refused and Russians tried, unsuccessfully to block Telegram, Russian government gave up after about a year, after they successfully blocked their own banks, businesses and some government websites. Eventually Russian government gave up and now has its own channels on the Telegram. Telegram team are now based in Dubai.

[Cowboy T]

Signal is open source

https://github.com/signalapp

and has been independently audited

https://threatpost.com/signal-audit-reveals-protocol-cryptographically-sound/121892/

Not sure how the CIA factors into that

The same is true of SELinux, the MLS-level security for the Linux kernel. The NSA originally wrote that. Fortunately, since it's Free/Open Source Software, it could be independently audited, and it's been a part of the Linux kernel for a long time as a result.

As long as it's F/OSS, and the open sourcerers have had a good look at it, I tend to trust it.

Therefore, if Signal is likewise F/OSS, and been audited, I would trust that software as well.

The danger is in who controls the *SERVERS*. If there's a way to compromise the communications at the server level, then you're wide open to attack. That's the problem with Skype. That's why end-to-end secret- or public-private key, without trusting anyone in the middle, is important. This is how SSH (Secure Shell) works. Yes, it results in a big, ugly mesh of private keys, but that's how we did PGP back in the day. We had key-exchange parties where people would bring a stack of floppies with their PGP public key and hand them out to people. No Verisign, Thawte, Digicert, or any other "certificate authorities". Those communications were what the FBI/CIA/NSA/etc were really afraid of, and that's why they went after Phil Zimmermann then. No servers to intermediate the key exchange process, no ability to decrypt. Spooked the spooks quite a bit!