Investigation by investigative journalism outlet IStories (EN version by OCCRP) shows that Telegram uses a single, FSB-linked company as their infrastructure provider globally.
Telegram’s MTProto protocol also requires a cleartext identifier to be prepended to all client-server messages.
Combined, these two choices by Telegram make it into a surveillance tool.
I am quoted in the IStories story. I also did packet captures, and I dive into the nitty-gritty technical details on my blog.
Packet captures and MTProto deobfuscation library I wrote linked therein so that others can retrace my steps and check my work.
Well, it was obvious to you. I’m a casual user, who tries to “do his best” and consider himself “somewhat informed” - obviously not by your standard. It was all news to me, and I find tremendous value in this article.
Thank you, that means a lot. For people working in information security it really feels sometimes that a). a lot of stuff is obvious, b). people just don’t listen and don’t care.
Your comment shows how incorrect this is. That really helps keep motivated.
No, I can’t stress enough how much I appreciate it. What I do right now is sending this article with TLDR to all my friends and family.