@kazani: Telegram's MTProto exposes persistent device IDs to network observers

A report by blackGNMX-01 claims that Telegram's MTProto protocol exposes a persistent device identifier that lets passive network observers track users over long periods. It states that the auth_key_id, a 64-bit device identifier, is sent in cleartext or trivially obfuscated form and stays constant across application restarts and network changes. The report says Telegram for Android and Telegram Desktop send MTProto over unencrypted TCP despite secure alternatives, and that the issue affects all users, including those using Secret Chats or Perfect Forward Secrecy. It recommends mandatory TLS for all MTProto connections, which it says would eliminate the tracking with minimal impact.