Many people who focus on information security, including myself, have long considered Telegram suspicious and untrustworthy. Now, based on findings published by the investigative journalism outlet ISt

Investigation by investigative journalism outlet IStories (EN version by OCCRP) shows that Telegram uses a single, FSB-linked company as their infrastructure provider globally.

Telegram’s MTProto protocol also requires a cleartext identifier to be prepended to all client-server messages.

Combined, these two choices by Telegram make it into a surveillance tool.

I am quoted in the IStories story. I also did packet captures, and I dive into the nitty-gritty technical details on my blog.

Packet captures and MTProto deobfuscation library I wrote linked therein so that others can retrace my steps and check my work.

  • rysiek@szmer.infoOP
    14·
    2 days ago

    Thank you, that means a lot. For people working in information security it really feels sometimes that a). a lot of stuff is obvious, b). people just don’t listen and don’t care.

    Your comment shows how incorrect this is. That really helps keep motivated.

    • ideonek@piefed.socialEnglish
      10·
      2 days ago

      No, I can’t stress enough how much I appreciate it. What I do right now is sending this article with TLDR to all my friends and family.