Pavel Durov laughs at WhatsApp, but Telegram is just as opaque

Telegram founder Pavel Durov has claimed that trusting WhatsApp for secure messaging is “braindead,” after a lawsuit claimed that Mark Zuckerberg’s Meta could access “virtually all” of the messaging app’s messages.

Durov has also claimed that his own team has independently discovered “multiple attack vectors.”

Allegations of Meta’s ability to access WhatsApp messages are, at present, merely a claim by plaintiffs in the lawsuit filed in US District Court in San Francisco last week.

The suit alleges that Meta Platforms, which owns WhatsApp, made false claims about the platform’s privacy and security.

A WhatsApp spokesperson has denied the allegations, telling Bloomberg, “Any claim that people’s WhatsApp messages are not encrypted is categorically false and absurd. This lawsuit is a frivolous work of fiction.”

Security weaknesses at WhatsApp competitors

While laughing at WhatsApp, Durov failed to mention Telegram’s many security shortcomings.

For example, in 2017, college students were easily snooping on one another’s Telegram status. By 2021, researchers had discovered critical bugs that allowed hackers to retrieve plaintext of encrypted messages, perform man-in-the-middle takeovers, and even change the order of messages. 

In 2022, another research team discovered Telegram’s protocol was vulnerable to an unknown key-share attack. 

A 2024 investigation of Telegram group messaging channels revealed 22 channels selling Schedule 1 narcotics and 24 channels selling weapons. Telegram employees told the New York Times that the company “rarely checks” email requests from law enforcement.

According to their investigation, “The company can gain access to messages unless users select a secret chat option with end-to-end encryption, according to two former employees.

On at least two occasions, the company has retrieved the messages of former employees, one person said.”