I also don’t see a lot of evidence that they’re bad, but it should be said that this is the wrong standard. I also haven’t seen a lot of convincing evidence tha

I also don’t see a lot of evidence that they’re bad, but it should be said that this is the wrong standard. I also haven’t seen a lot of convincing evidence that Telegram’s crypto is good (and plenty of past evidence of weird mistakes.) Overall what I’ve learned from examining Telegram’s crypto in the past is that the company does not really value outside expertise and analysis, nor do they make it easy to review their (very strange and non-standard) protocols. Reviewing crypto is hard when you’re working with an organization that has good engineering practices and minimizes the possible risks. My early examination of Telegram crypto led me to the conclusion that Telegram was not an organization whose approach to crypto engineering is compatible with that standard, so it’s not worth the effort to try to vet their crypto when the company leaves so many weird question marks in their engineering approach. Meanwhile there are products with more professional crypto teams working hard to behave in ways that engender trust: I’d rather devote my limited effort to poking around over there. I do recall Telegram building a very weird variant of Diffie-Hellman that effectively let the server modify the secret key (and thus conduct MITM attacks.) In fact they did this multiple times in different ways, either by accident or through malice. This happened a long time ago so it’s entirely possible that they’ve cleaned up their act, but it left a bad enough taste in my mouth that I’m afraid to poke around in their crypto and render any opinion. If I look at it and say “looks better now” I’m afraid I’d just be hurting people. Unless the company makes a real effort to bring their crypto engineering up to a higher standard, I won’t feel confident in any of it: there are too many non-standard bits of engineering where dragons might lurk.