@lukOlejnik DO NOT use Telegram in sensitive applications. Telegram does not need to have its message encryption broken for users to be tracked at the network layer. Telegram sends MTProto over unencrypted TCP, exposing auth_key_id - a long-lived identifier tied to the client’s authorisation key. An ISP, hotel WiFi operator, mobile carrier, transit provider, or surveillance system on the network path can see that identifier if they can observe the traffic. It can remain stable across app restarts, IP changes, VPN use, network switches, and location changes. Secret Chats protect message content, but this leak is below that layer. That makes the attack passive. The risk is in retroactive correlation. Think a journalist using Telegram from different networks for months, then joining hotel or corporate WiFi under a real name. That one identity anchor could make old logs searchable for the same auth_key_id. The fix is simple - mandatory transport encryption for all MTProto connections, with no unencrypted fallback. Telegram chose not to do this. Source: @kaepora https://symbolic.software/pdf/gnmx-01.pd… x.com @lukOlejnik: Telegram exposes auth_key_id over unencrypted TCP enabling tracking by mishaderidder.eth13038 🥝 • 4mo • | |
Recommended by 1 curator | |
 Fact-Check: Telegram MTProto auth_key_idTracking Claim Verdict: Largely accurate. The claims in the post are directly supported by the cited technical report from Symbolic Software (published May 2026), authored by Nadim Kobeissi (@kaepora) The post is essentially a faithful summary of a peer-reviewed technical report by Nadim Kobeissi's Symbolic Software, released around May 21, 2026 The underlying finding is not entirely new — security researcher Michał "rysiek" Woźniak documented the same auth_key_id linkability issue in 2025, including alleged real-world use against Ukrainian partisans in Kherson via Russian SORM infrastructure 1. The 2026 paper provides empirical confirmation across Android and Desktop clients. One slight oversimplification: the post says the identifier is sent "unencrypted," when more precisely it's sent over unencrypted TCP with a thin, trivially reversible obfuscation layer. This does not change the practical conclusion. The post does not mention Telegram's response. As of the report's publication, the fix had not been implemented; the issue was framed as a policy/design choice rather than a technical limitation Bottom line: The claim is well-supported by the cited primary source and corroborated by independent prior research. The advice not to use Telegram for sensitive applications where network-layer adversaries are part of the threat model (journalism, activism, etc.) is consistent with what the underlying report itself concludes. by Claude 4.7 Opus sources: @tim why does kiwi default to firefly for x posts? I hate that so much and just wondering if there’s a real benefit to it? Well it doesn’t :) actually it is my posts that are doing that. I do everything on Firefly because i can see X, Farcaster, Lens and Bluesky at the same time. Great also if you want to compare what someone does on different accounts and see their onchain history at the same time lol. Also there’s no advertisements! And I like the feeds. It’s either just “following” chronologically or “discover” which has a great algo which mostly any time I hit it gives me interesting content. (Did I mention no ads :) Anyway a benefit for Kiwi is that you don’t have to have X installed. Or have to log in to X or anything. It also immediately on opening gives you a clean overview of threads without hiding stuff. It is very readable. And crypto native. But I understand Firefly esthetics are a bit irritating. Also at times it can be nasty buggy or bit slow. But for me it feels through Firefly I have really control over my feeds, and it gives me insight and overview. I think actually Firefly is still in beta, anyway I use the app through TestFlight (but anyway Kiwi is also TestFlight btw). Hope that explains my choice a little. Personally can’t stand X lol. Well. Kiwi is permissionless it is up to anyone what they like to post and how. Probably if there would be more people curating my Firefly posts would not stand out that much. So sorry for that, but I hope my explanation helps! So today I learned that 1) I apparently click on a lot of your submissions here that take me to firefly (lol and also kinda awesome) and 2) all that. Yeah I love X and use grok button a bunch so I have to do this awkward “tap here, end up in firefly on safari, remember for to find OG poster account on there so that I go to X, tap that, be redirected 7 times to finally be in native X app, forget what the fuck I wanted to ask grok about the post, give up, come back here to remember and then do that whole series of steps again” I may have embellished things a bit :/ Well you can do your AI questioning right here in Kiwi! Have you ever tried the button with the little stars right below the posts? Next to the share button. It takes the post right from Kiwi to ChatGPT. Or even better you can copy the context link and paste it in your fav model :) | |
Characters remaining: 10,000 comment guidelines | |
Get Kiwi App
Scan with iPhone to join
TestFlight beta