2017-11-01 update: MIT Security analysis of Telegram finds it to be insecure.
Quote from the following paper ...”our survey shows that Telegram has had serious and simple issues in the protocol (e.g. modified buggy Diffie-Hellman key exchange) that any knowledgeable security expert could penetrate.”
https://courses.csail.mit.edu/6.857/2017/project/19.pdf
They also end their paper with a well-worded statement about the Telegram:
“Finally, our conclusion is that Telegram, just like any other application has vulnerabilities. Users have to be aware of this fact, but unfortunately the claims by companies make non-tech-savvy users to believe that their messages are unreadable by third parties.”
Previous update with interesting input: Snowden doubts security of Telegram
https://www.rt.com/news/326565-snowden-durov-security-telegram/
Snowden has a great point here. Why should the server ever have access to the message in cleartext stored or not.
Lots of questions here:
Secure in transit ? Nothing is perfect but the use of a non-standard implementation increases the risk for human errors and probably increases the attack surface. Note: The use of Diffie-Hellman protocol does not mean the implementation of data in transit is secure at all. I could use DH for supposed key generation then promptly ignore the results and use Rot-13 or some other broken encryption scheme for data in transit.
You need to evaluate the system as a whole to determine the strength of the combined controls. Just looking at one part and saying since that's secure the whole thing is secure is a flawed statement at best.
Secure from anyone who has access to the phone or mobile devices operating system ? No, the types of security controls needed are not present on modern mobile operating systems.
Does Telegram use DH or homebrew ? It's not either/or the answer is both.
It appears they are still using, and defending, their home grown implementation. Note: I'm not saying this is a bad thing, progress is made by change, but it's notable that there is no third-party validation of their process on their website. To me this is a ripe situation for the statements on a website to be "technically true" but not painting the whole picture. They claim that messages are safe from "hacker attacks" and in one sense that may be true but is that the only scenario you are concerned about ? Do they answer the question related to the threats you are concerned about ? If not, why not ? Is this safe for people living in countries with repressive governments that do heavy monitoring of communications ? That's a different question entirely and one which they don't address.
https://core.telegram.org/techfaq
Personally I'd be curious about their key handling and it's implementation more than anything. Other questions I'd investigate are :
Could they share keys with service providers and governments without the end users knowledge ? (I know they say they don't but could they ?) How do they comply with warrants ? Have they ever publicly complied with a warrant for such information ? Do employee monitoring systems offer support to decrypt Telegram communications yet ?
Ultimately security is somewhat relative and I think for most people their solution probably works well.
