I wish this type of comment wouldn't inevitably come up in these discussions. Not only is it fundamentally wrong but it's actively harmful to improving security and privacy by scaring people away from things that may be just fine and that are probably better than a lot of the insecure alternatives they'll actually use instead.

To the extent open source matters at all when looking at E2E encryption, it theoretically makes it easier to see whether the source code implements a secure protocol. This sounds much more useful than it actually is. For one thing, almost nobody is compiling the source code themselves, so you're ultimately going to have to evaluate the security of compiled code anyways. Also there is an incredibly vast gap between the promise and reality of the open source promise in terms of finding security problems. Accidental or deliberate weaknesses can be subtle and hard to find whether or not you have the code. The extensive history of serious cryptographic problems living in open source code for years before they were found and people regularly being able to find problems in software despite it being closed source suggests open source as a security panacea should be taken with a large grain of salt.

I disagree.

Even a closed source client soon has opensource 'compatible' clients. To build those, you need to reverse engineer/understand the crypto. In the process of doing that, you will likely uncover any systemic flaw that reveals every conversation to a passive attacker.

That effectively leaves the 'send a secret message to leak the key' type backdoors that the client could have. However, if this functionality existed and was used on every chat, then it is quickly discovered by anyone debugging the unofficial client.

So the only remaining 'loophole' is that there is a backdoor in the official client, but that it is only used very rarely or on request.

That in turn means that facebook can't go do large scale data mining on the private chats. Thats a win.

Taking into account that they are known to work closely with the FBI. So what they call e2ee cryptography is ridiculous. Their business is built off violating users privacy, why would anyone trust them? They've got your keys. Signal exists for this very reason.

An open source client gives a false sense of security as the APK you're downloading is compiled. In the end you still need to decompile the APK to know what it is really doing.

Open source client doesn't matter in mobile world, as you never compile the app yourself. This is only misleading to the non-tech users who don't get how the whole thing works. That's why Telegram's claim of security is total garbage because while their client is "open source", the backend is that has all the messages is not. Something they don't clearly state on their website.

So the Telegram's admins can read all the messages in plain text on the backend. So "open source" client means absolutely nothing for the security.