Investigation by investigative journalism outlet IStories (EN version by OCCRP) shows that Telegram uses a single, FSB-linked company as their infrastructure provider globally.
Telegram’s MTProto protocol also requires a cleartext identifier to be prepended to all client-server messages.
Combined, these two choices by Telegram make it into a surveillance tool.
I am quoted in the IStories story. I also did packet captures, and I dive into the nitty-gritty technical details on my blog.
Packet captures and MTProto deobfuscation library I wrote linked therein so that others can retrace my steps and check my work.
That’s all FUD. Matrix is as secure as Signal if you - like Signal - rely on a single centralized server. Actually, since you can host it yourself, it would be even more secure since you don’t need to trust Signal.
(I defend infrastructure and perform hacks against cryptograph & protocols for a living)
My question was specifically about “the general non-technical population”. Do you expect my mom to even remotely understand what different servers are and why talking to me is securely encrypted but talking to her friends group isn’t? The point about secure software is that it needs to be secure by default or else, entry level users will manage to accidentally send their stuff in plain text and not even notice.
For nerds like us, I agree that Matrix is probably a good choice. For someone who needed to be told that “the internet” isn’t the blue “e” on their desktop… not so much. I’d rather send carrier pigeons than explain Matrix to my family.
My extended family use Matrix - including my elderly parents. It’s no more difficult to understand than any other service.
If you need to say it…