Every so often the question of "which private messaging system is best?" pops up. The answer, as always is.... it depends.

First, the biggest caveat:

The biggest weakness in any secure system is your device. If your device (computer, tablet, phone, whatever) is hacked or compromised, then it's "game over." If a government intelligence agency wants to get at your communications data, they aren't going to screw around trying to beat unbreakable cryptosystems. They're going to just hack your device. There are mitigations for this, but those are things I do professionally and charge lots of money for, and in any case they're way outside of "do-it-yourself" territory.

Secondly, the honorable mention: Apple Messenger and FaceTime.

Apple Messenger and FaceTime offer extremely high-security communications... so long as everyone involved is using Apple products, and as long as you don't enable iCloud storage. Your iCloud storage is accessible by Apple technicians and government agencies. iCloud keychains are protected, but files, images, videos, etc. are not. FaceTime will only work over securely-encrypted connections, but Messenger will "fail back" to unencrypted and heavily-spied-on SMS/MMS messaging if it can't create an encrypted connection for some reason. This happens periodically. The best thing about Apple Messenger is that it's automatically installed on all Apple products and is enabled by default - so it's securing communications between many people even if they do nothing.

The Showdown - Similarities

Both Telegram and Signal are offered by non-profit organizations. Both received startup funding from extremely wealthy tech entreprenuers who were angry about what was done with their platforms after they were sold. Telegram is presently funded by an ICO and corporate bonds (largely VC-backed). Signal is funded by donations to their 501.3(c) entity, and its corporate charter is full of "poison pills" that effectively prevent it from ever being sold or acquired.

Both systems allow you to send private messages that are deleted automatically, although Signal's options are far more comprehensive here.

The Showdown - Telegram

Telegram is a communcations platform based in Russia, founded by Nikolai and Pavel Durov. Communications are encrypted, but in their default mode are stored on servers in Russia and can be accessed by Telegram's technicians and presumably by Russian government agencies. If you think this information cannot / will not be sold or traded to other governments, then you need to get better at thinking. You can create secure "end-to-end encrypted" communications with Telegram, but it is never automatic, it only works between you and one other person, and those conversations can only be accessed from one device.

Additionally, it is possible to take over a Telegram account through SMS interception and impersonation (any government, and most hackers can do this). Doing so will kick the legitimate user out of the system and they will know this as soon as they try to start messaging, but there is no warning to the people they communicate with in group chats and any direct messages that aren't "end-to-end" encrypted.

The main advantage of Telegram is that it is pseudonymous - people identify themselves with user IDs, which can be anything. It is good for creating large-scale group chats, and for chats with people you don't know well enough to share your phone number with.

Telegram has "open APIs" which allow it to be accessed by other software, allowing for the creation of bots and other nontraditional accounts.

The Showdown - Signal

Signal was founded by Brian Acton, the founder of WhatsApp, and WhatsApp's crypto architect, Moxie Marlinspike. Acton was made several promises by Facebook with regards to privacy when he sold WhatsApp, which were then promply broken by Facebook. Acton was incensed, and wrote a $50,000,000 check to start the Signal Foundation - making it one of history's more expensive temper tantrums. He asked Marlinspike, who is a highly-respected cryptographer and has been an out-of-the-closet anarchist for many years, to design an ultra-secure system for personal communications. It started out as a very simple system, barely better than traditional SMS/MMS. It has since added many other features, including individual / group, messaging, audio, and video chat. Signal is also 100% open-source, meaning anyone can inspect the code used to create it for vulnerabilities. Because many of the "big name" cryptographers and security experts prefer it, major changes are often a subject of controversy and discussion.

Signal is not pseudonymous - you must know the phone numbers of everyone you communicate with. Its architectual decisions favor security at the expense of anonymity. This makes it less-useful for many situations. The upside of Signal is that, used properly, it is as close as you can get to "perfect security." Whenever a design trade-off must be made, their standard is "if you had to literally bet your life on the security of this system, which choice is better?" It is designed to be used by political dissidents, journalists, etc. who might be killed if their communications are intercepted and is full of safeguards to ensure that you always know who you are talking with.

All conversations and messages on Signal are end-to-end encrypted, meaning that they can only be viewed by the devices owned by their intended recipients. Messages are only stored on servers during transit, and stored messages cannot be decoded by Signal technicians or anyone who intercepts them in transit. This means that conversations cannot be recovered if a device is lost or destroyed, and someone joining a group chat cannot see the history of that chat. Again, these are deliberate trade-offs made that choose security over convenience.

Like Telegram, it is possible to "take over" a Signal account through SMS/MMS interception and impersonation. However, unlike Telegram, Signal goes crazy with warnings for everyone when this happens. Whoever "takes over" the account has no access to previous messages, and others involved in conversation are given the option to verify encryption keys with some other method of communication before allowing conversations to continue (and this is permanently noted in the message logs). In any case, everyone is alerted and must give explicit permission to keep messaging in this situation.

Showdown - Which is better?

The answers is that they are different tools for diferent jobs.

Telegram is useful for informal, low-security conversations with people you don't know well and don't want to give your personal communication information to. It's more like a lightweight social media platform that's less-intrusive than Facebook or Twitter, and is completley uncensored. I personally use Telegram for this purpose.

Signal is for more intimate, ultra-secure communications with people you already know and trust. With careful and expert usage, it is as close as you can get to a perfectly-secure messaging platform, and I personally use it for this. Edward Snowden says it's his day-to-day commuications platform. I've used it in scenarios where many millions of dollars are at stake and the opposition is actively trying to hack us (dedicated "burner" phones with their paid-for-with-cash SIMs removed after Signal account creation and stored in Faraday bags when not in use can be handy here).

The answer isn't knowing which one to use. The answer is knowing when to use each one.