Many people who focus on information security, including myself, have long considered Telegram suspicious and untrustworthy. Now, based on findings published by the investigative journalism outlet ISt

Investigation by investigative journalism outlet IStories (EN version by OCCRP) shows that Telegram uses a single, FSB-linked company as their infrastructure provider globally.

Telegram’s MTProto protocol also requires a cleartext identifier to be prepended to all client-server messages.

Combined, these two choices by Telegram make it into a surveillance tool.

I am quoted in the IStories story. I also did packet captures, and I dive into the nitty-gritty technical details on my blog.

Packet captures and MTProto deobfuscation library I wrote linked therein so that others can retrace my steps and check my work.

  • jarfil@beehaw.org
    2·
    2 days ago

    Hm, makes sense, but I feel like we’re still missing something.

    I saw comments about Durov, similar to this investigation, maybe around a month ago.

    With the xAI partnership news, I looked into it and found this nice thing:

    In Telegram, you can clear them one by one, or date ranges, or use disappearing messages, but this tool still found some I had missed.

    (Disclaimer: I got pulled into Telegram by some friends leaving WhatsApp with the policy changes of 2021, my threat model is less one of FSB, and more one of indiscriminate AI siphoning for ad targeting)