• Kissaki@feddit.de
    link
    fedilink
    English
    arrow-up
    63
    arrow-down
    1
    ·
    1 year ago

    Is it a leak if it’s a necessary technical part to a functionality?

    The main issue is that it’s not obvious to non-technical users. They can’t asses what sharing IP address means either though.

    The reason Telegram leaks a user’s IP addresses during a call is that, by default, Telegram uses a peer-to-peer connection between callers “for better quality and reduced latency,” Telegram spokesperson Remi Vaughn told TechCrunch.

    “The downside of this is that it necessitates that both sides know the IP address of the other (since it is a direct connection). Unlike on other messengers, calls from those who are not your contact list will be routed through Telegram’s servers to obscure that,” Vaughn said.

    To avoid leaking your IP address, you have to go to Telegram’s Settings > Privacy and Security > Calls, and then select “Never” in the Peer-to-Peer menu, as shown below.

    Telegram defaults to using p2p for calls, for contacts only.

    It’s not a thorough privacy default, but otherwise seems fine to me. If you want p2p it needs to be enabled, and if you don’t it needs to be disabled. No-contacts and no-calls receive no IP.

  • BradleyUffner@lemmy.world
    link
    fedilink
    English
    arrow-up
    23
    arrow-down
    9
    ·
    1 year ago

    Ohh no, Someone on the Internet that I’m communicating with has access to a piece of information that is necessary for communicating with me.

    • whale@lemm.ee
      link
      fedilink
      arrow-up
      8
      arrow-down
      2
      ·
      1 year ago

      Despite communicating with me, I don’t know your IP address…

        • whale@lemm.ee
          link
          fedilink
          arrow-up
          1
          arrow-down
          2
          ·
          1 year ago

          Except direct messages don’t reveal IP addresses.

          See, their point was that IP address leaking was common sense, and that the average person should know better.

          Except there is no reason to assume the average person would know better, if even the person criticizing them can’t accurately summarize the conditions that lead to IP address leaking.

      • Mubelotix@jlai.lu
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        But I could include an image in this message and get your IP address easily. It’s just worthless

        • whale@lemm.ee
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Lemmy doesn’t say it has “a focus on speed and security,” call itself “simple, fast, secure,” or claim to have “the best security”

          I pulled all those claims off the official Telegram Play Store description

  • ink@r.nf
    link
    fedilink
    English
    arrow-up
    14
    arrow-down
    2
    ·
    1 year ago

    Telegram not being part of Western Intelligence Toolkit along with facebook, google, apple and others offends people to the extreme, so they make a hill out of moles. P2P is inherently privacy friendly and your IP is most likely going to geolocate to the ISP. Techcrunch seems retarded.

    But do keep up the fearmongering going.

    • fl42v@lemmy.ml
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      Leaking ip’s is meh, however sharing info with feds while mentioning not doing this very thing in their own FAQ is shady AF. Then we have their serverside being proprietary garbage, plus intrusive info collection (like why do they need no know my hostname, device model, desktop environment, etc?). Did I mentioned they started advertising crap based on the channels a user’s subscribed to? Yeah, telegram still sucks when it comes to privacy, and it’s only getting worse over time

    • Skull giver@popplesburger.hilciferous.nl
      link
      fedilink
      arrow-up
      1
      arrow-down
      2
      ·
      1 year ago

      An IP address allows for a targeted DDoS. Streamers used to get DDoS’ed by getting their IP address through Skype. A $5 DDoS can take down a streamer you don’t like for hours or days.

      P2P is not inherently privacy friendly. In fact, it’s inherently less so. That’s why projects like veilid and Tor used multiple routing layers to provide privacy. Various IP geolocation services I’ve tried in the past have been able to get the lookup location right down to street level for some ISPs.

      Maybe your ISP doesn’t publish geolocation info, but that’s not some kind of universal fact. Furthermore, various tracking libraries also sell IP geolocation data (like the shit they shove into ad supported weather apps). They get a rough geolocation from your phone through either the most recent picture you took or the location permissions the containing app already has, and submit that to their server, allowing them to geolocate you even bevind a VPN.

      There’s nothing an unmotivated attacker can do with your IP address to break into your device’s, but basic bullies can make your life pretty shit.

  • It’s not just Telegram, Signal does the same thing. I’m pretty sure every chat application does this, because routing all video streams through servers is expensive and can cause unnecessary latency, as well as increase risk (i.e. the German government recording your encrypted traffic because the call decided to route everything through German servers, despite you and the person you call living in France). You’re also more likely to leave an accessible record behind it you route your call traffic through a server (though for non-e2ee messengers like Telegram that doesn’t make much of a difference).

    Most messenger calling services are end to end encrypted, including Telegram’s, but if your keys leak out or, frankly more likely, the call is MitM’ed because nobody ever checks the security code, that still allows for surveillance.

    You’re still better off calling people using these apps than though normal cellular traffic, of course. Just know that peer-to-peer is the norm.

  • AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    6
    ·
    1 year ago

    This is the best summary I could come up with:


    The popular messaging app Telegram can leak your IP address if you simply add a hacker to your contacts and accept a phone call from them.

    TechCrunch verified the researcher’s findings by adding Simonov to the contacts of a newly created Telegram account.

    Simonov then called the account, and shortly after provided TechCrunch with the IP address of the computer where the experiment was being carried out.

    The fact that Telegram leaks your IP address to people in your contacts during a voice call has been known for years, but it’s likely that new, less technical users may not be aware.

    Simonov, who founded the cybersecurity firm T.Hunter, told TechCrunch: “Telegram focuses on security and privacy, however, in order to stay safe you need to be aware of the nuances of how the messenger’s voice calls work.”

    To avoid leaking your IP address, you have to go to Telegram’s Settings > Privacy and Security > Calls, and then select “Never” in the Peer-to-Peer menu, as shown below.


    The original article contains 414 words, the summary contains 167 words. Saved 60%. I’m a bot and I’m open source!