TL;DR: No, Telegram is not secure.
I'd like to ignore the comparison to WhatsApp because WhatsApp does not advertise itself as a "secure" messaging option. I'd like to instead focus on whether Telegram is secure.
Telegram's security is built around their home spun MTProto protocol. We all know that the first rule of Cryptography is Don't Roll Your Own Crypto. Especially if you aren't trained cryptographers. Which the Telegram people most certainly aren't.
The team behind Telegram, led by Nikolai Durov, consists of six ACM champions, half of them Ph.Ds in math. It took them about two years to roll out the current version of MTProto. Names and degrees may indeed not mean as much in some fields as they do in others, but this protocol is the result of thougtful and prolonged work of professionals.
Math Ph.Ds are not cryptographers. The protocol they invented is flawed. Here is a nice blog post explaining why. In addition to that, Telegram has issued a rather ridiculous challenge offering a reward to anyone who can break the protocol. Except that the terms they set makes even the most ridiculously weak protocol difficult to break. Moxie Marlinspike has a nice blog post explaining why the challenge is ridiculous.
So, no. Telegram is by no means secure. For commonly accepted definitions of secure, not the one Telegram made up.
If you want a real secure means of communication on your phone, look to more reputable projects such as Signal or WhatsApp (which, since this answer was first written, now uses the Signal Protocol for end-to-end message encryption).
As the Telegram FAQ mentions, there is a 'secret chat' option that does not store chats on their servers.
As for the underlying question of, "does storing chats lower their security?" then that is something to consider. Chats being stored on the server does mean that copies can be made on the server for decryption later. This increases the exposure of the messages. Encrypting the messages means that there is a high cost to decrypt the messages, but there is still some exposure.
Taking this added exposure into account, the real question becomes (as it always does), "what are you protecting from?" If you are worried about secure communications in transit, then Telegram 'appears' to be more secure. If you're worried about secure communications at rest, then WhatsApp 'appears' to have a better model, except that none of it is encrypted.
The answer, then, is 'it depends on your focus', and encryption is better than non-encryption, and there is the Telegram's 'secure chat' option.
New research shows deep problems with the crypto: https://medium.com/@thegrugq/operational-telegram-cbbaadb9013a#.gb7od1j6i
EFF's Secure Messaging Scorecard currently rates "Telegram (secret chats)" with a 100% security rating. However, the software of the servers Telegram uses is not open; cf. the FAQ "Why not open source everything?"
WhatsApp was docked on the "Is the code open to independent review?" metric. Telegram is now completely open; source code here. Being open, you can verify for yourself that there is no back-doors which could possibly be in a closed app. WhatsApp is closed-source now that it's gone proprietary (Facebook bought it).
EFF compares all messenger apps and publishes the results in Secure Messaging Scorecard link.
note:EFF compares Telegram in secret chats mode with WhatsApp
EFF criteria are:
- encrypted messages in transit? both,telegram uses MTProto protocol and Whatsapp uses an undisclosed protocol
- encrypted so the provider can't read it?
this criterion requires that all user communications are end-to-end encrypted. This means the keys necessary to decrypt messages must be generated and stored at the endpoints (i.e. by users, not by servers)telegram has this criterion but Whatsapp has not it
- can you verify contacts' identities?
this criterion requires that a built-in method exists for users to verify the identity of correspondents they are speaking with and the integrity of the channel, even if the service provider or other third parties are compromisedtelegram has this criterion but Whatsapp has not it
- are past communications secure if your key are stolen?
this criterion requires that the app provide forward secrecytelegram has this criterion but Whatsapp has not it
- is the code open to independent review? telegram has this criterion but Whatsapp has not it
- is security design properly documented?
this criterion requires clear and detailed explanations of the cryptography used by the applicationtelegram has this criterion but Whatsapp has not it
- has there been any recent code audit?
this criterion requires an independent security review has been performed within the 12 months prior to evaluationboth have it
finally,the result is that Telegram is more secure than Whatsapp
Besides the protocol issues, the app itself is not very secure. In February 2015, Zimperium published a detailed analysis of Telegram's local vulnerability, allowing the attacker to get full access to plain text messages.
Basically, even if the protocol was secure, the application itself isn't, becoming the weak link in secure communication.
According to Zimperium, the Telegram team has never responded to their vulnerability notification. It tells me something about their attitude to security in general, and goes in line, for example, with how they implement "secure chats": no desktop support, graphical-only fingerprint of the key, no possibility to simply enter the key.
protected by Community♦ May 8 '16 at 10:16
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?