It seems like the best possible thing they could do is to hire Matasano to fly out and dig through their whole architecture for flaws. That way they'd either earn tacit approval from the crypto community, or any obvious internal oversights would be exposed (in which case fixing those errors would earn them approval anyway). This contest doesn't seem to achieve those ends.
The message they've been sending is, "We're Telegram, and we're confident we don't need your help." But resisting the ability of governments to rifle through our data must be a community effort to succeed. Telegram is claiming to be a trustworthy hero. But individual heroes are single points of failure, and have historically been far too easy to coerce or circumvent.
There's also nothing stopping Telegram from being malicious (or being coerced), so I'm worried people won't notice if Telegram themselves try to snoop on everyone's messages by e.g. pushing an update which tweaks the protocol just slightly enough to be exploitable. Whereas if TextSecure tried to pull something like that, people would notice.
Of course, since Telegram refuses to give a proof for the security of their home-grown KDF, it seems like it's possible they designed it to be exploitable in some secret way, in order to access people's conversations. A security proof would prevent this possibility, but they don't seem to think it's a big deal. https://news.ycombinator.com/item?id=6918907
In fact, they've been bizarrely evasive on that point. Why design your own KDF? Speed? Then why not use a secure tunable KDF like scrypt? Is it to show off their own genius? Then why haven't they published it for peer review to take credit for their achievement? And why turn down Moxie's offer to join forces and incorporate an existing 10 million userbase? https://news.ycombinator.com/item?id=6915741 ... None of that makes sense, and the only reasonable explanation I can think of is that maybe they're trying something sneaky.
Their app is already more popular than TextSecure[1][2] and available for more platforms. Why in the world they should all of a sudden change protocol (and probably lose some features, lose control over changes in the protocol, etc.) and join to a less popular network?
[1] http://www.appannie.com/apps/google-play/app/org.telegram.me...
[2] http://www.appannie.com/apps/google-play/app/org.thoughtcrim...
Well, if their own marketing spiel is to be believed, and all the work was done by Mathematicians instead of cryptographers, it's understandable that they'd go and behave like they have. Not out of malice, but ignorance of the accepted practices and modes of behavior that the crypto-community has adopted...often for very good reasons.