Sure, I didn't look for an amazing article, just remember hearing about their homebrew "crypto" years ago and going eww.

This might be slightly better:

http://security.stackexchange.com/questions/130559/is-telegr...

You should provide some specific counterpoints and sources to back said points up - because rolling their own encryption is by itself reason enough not to use them. defaulting encryption to off is just icing on the cake

Let's see, what does the article say?

- Telegram isn't end-to-end encrypted per default: true

- Telegram uses homebrew encryption (MTproto): true

- Telegram presence information, at one point, could be read by someone who isn't your contact: true

Eh, Telegram looks more insecure [1] AFAICT. Sure, Signal will not stand up to high threat models due to hardware failings (backdoored baseband RTOS, missing dual backup RTC batteries for secure boot) and software failings (insecure Android), about the only thing designed to be attacked like that is a terminal like a Pax S80 or a Verifone VX520 and they do a bunch of fun stuff with magnetic tamper sensors, conductive wires that tear on opening, heat sensors, etc.

Then again, that isn't the threat model Signal is designed for, and if you are looking to protect against that type of threat model you could totally design hardware to support it for not too much (see Blackphone) and throw Replicant on there (with some development of course). Then, if it were Signal vs Telegram, the latter would likely be your security weakness.

[1] - http://security.stackexchange.com/questions/130559/is-telegr...