Watch: CORIE Framework
In an era of increasing digital surveillance and data breaches, the choice of messaging platform has significant implications for both personal privacy and organizational security. Signal and Telegram are two of the most widely discussed alternatives to mainstream messaging applications, but they take fundamentally different approaches to security and privacy. This article provides a technical comparison to help individuals and organizations make informed choices about their communications infrastructure.
By Rafay Baloch, Lead Security Researcher, Cyber Citadel.
Encryption Architecture
The most significant technical difference between Signal and Telegram lies in their approach to encryption. Signal employs end-to-end encryption (E2EE) by default for all communications, including one-to-one messages, group chats, voice calls, and video calls. This means that only the sender and recipient can read the content of messages; Signal's servers never have access to plaintext message content, and Signal itself cannot decrypt messages even under legal compulsion.
Telegram, in contrast, uses a client-server encryption model for standard chats, meaning messages are encrypted between the client and Telegram's servers, but Telegram holds the encryption keys and can technically access message content. End-to-end encryption on Telegram is available only through the "Secret Chats" feature, which must be manually initiated for each conversation and is not available for group chats. This architectural difference is fundamental: in standard Telegram conversations, the platform has the technical capability to read your messages.
Encryption Protocols
Signal uses the Signal Protocol (formerly known as the Axolotl protocol), which is widely regarded as the gold standard for messaging encryption. The protocol provides forward secrecy through the Double Ratchet algorithm, meaning that even if a long-term encryption key is compromised, past messages remain secure because each message uses a unique encryption key that is derived and then discarded. The Signal Protocol has been independently audited multiple times and is used as the basis for encryption in WhatsApp, Facebook Messenger's encrypted mode, and Google Messages.
Telegram uses its own proprietary encryption protocol called MTProto, developed internally by the Telegram team. While MTProto has undergone some external review, it has been criticised by cryptographers for its non-standard design choices, including its approach to authenticated encryption and its use of SHA-1 in certain contexts. The decision to develop a proprietary protocol rather than adopting well-established standards has been a persistent point of concern among security researchers.
The security community's consensus is clear: Signal's approach of end-to-end encryption by default, using a well-audited open protocol, provides significantly stronger privacy guarantees than Telegram's default client-server encryption model.
Metadata Handling
Beyond message content, metadata, the information about who is communicating with whom, when, and how often, can be extremely revealing. Signal has made significant investments in minimizing the metadata it collects and retains. The platform uses Sealed Sender technology to hide the identity of the message sender from Signal's own servers, and Signal stores virtually no user metadata. When served with legal requests, Signal has consistently demonstrated that it has almost no data to provide, typically only a user's registration date and last connection timestamp.
Telegram collects and retains significantly more metadata, including IP addresses, device information, and contact lists. This data is stored on Telegram's servers and is accessible to the company. While Telegram has publicly stated its commitment to user privacy and has resisted some government data requests, the technical reality is that the platform possesses substantial metadata that could be disclosed under legal compulsion or compromised in a data breach.
Privacy Features Compared
Both platforms offer additional privacy features, though with different scope and implementation:
- Disappearing Messages: Signal offers disappearing messages for all conversation types with configurable timers. Telegram offers self-destructing messages only in Secret Chats.
- Registration: Both platforms require a phone number for registration, though Signal has introduced the ability to use usernames to communicate without revealing your phone number. Telegram also supports usernames for public communication.
- Open Source: Signal's client and server code are fully open source, allowing independent verification of its security claims. Telegram's client code is open source, but its server code is proprietary, meaning the server-side encryption implementation cannot be independently verified.
- Group Privacy: Signal encrypts all group communications end-to-end. Telegram's group chats use client-server encryption only, and Secret Chats are not available for groups.
- Data Storage: Signal stores messages locally on the user's device only. Telegram stores messages in the cloud, enabling multi-device sync but also meaning that message data persists on Telegram's infrastructure.
Contact Discovery
Signal uses Intel's Software Guard Extensions (SGX) for contact discovery, performing lookups within secure enclaves that even Signal's own servers cannot observe. This means that Signal never learns which contacts a user is searching for, preserving the privacy of social relationships. Telegram, by contrast, uploads entire address books to the cloud, learning about users' social graphs including people who have never used the service.
Compliance with Legal Requests
Telegram has faced scrutiny over compliance with government requests. In 2017, Telegram shut down an Iranian opposition channel at the government's request. Telegram was banned in Russia from April 2020 until June 2020, when the ban was lifted upon Telegram's agreement to assist with investigations. Signal maintains a zero-knowledge system — when subpoenaed by the Eastern District of Virginia, the only data Signal could provide was the timestamp of account creation and the last time the user connected, limited to the day.
Technical Details
Signal stores messages in a local SQLite database encrypted with SQLCipher, ensuring that even if a device is physically compromised, message data remains protected without the correct passphrase. Telegram retains metadata for 12 months before deletion. Signal's group chats use Multi-party Off-the-Record Messaging (mpOTR) for end-to-end encryption, while Telegram group chats are not end-to-end encrypted and rely solely on client-server encryption.
Making the Right Choice
The choice between Signal and Telegram depends on your specific requirements and threat model. For users and organizations where confidentiality of communications is paramount, Signal's end-to-end encryption by default, minimal metadata collection, and fully open-source architecture make it the stronger choice. For users who prioritise features such as large group management, cloud-based message history, and a rich channel ecosystem, Telegram offers capabilities that Signal does not, though with meaningful trade-offs in security and privacy.
For organizations handling sensitive information, client communications, or regulated data, the security architecture differences between these platforms are material. Cyber Citadel advises organizations to assess their communication security requirements as part of a broader information security strategy, ensuring that the tools in use align with the sensitivity of the data being communicated and the threats facing the organization.