Date: Tue, 11 Sep 2018 17:25:47 +0530 From: Dhiraj Mishra <mishra.dhiraj95@...il.com> To: oss-security@...ts.openwall.com Subject: tdesktop leaks user IP address This is still not fix in telegram desktop team says their is nothing to fix here and this is working has intended. tdesktop: https://github.com/telegramdesktop/tdesktop *Steps to reproduce:* 1. ./Telegram 2. Call end user 3. The access log on CLI reveals the end user public IP address. By default in tdesktop p2p is enable, which open a direct communication when calling to the other user, potentially seeing his/her IP. Telegram is supposedly is a secure messaging application but while calling another user leaks his/her public IP address in access log. However, by navigating to Settings and Privacy > Calls > and set P2P to `nobody` in telegram apps in (iOS and android) will not allow others to view public IP of end user, but this option is still not available in tdesktop, which makes tdesktop vulnerable to this issue. Thank you -- Regards *Dhiraj Mishra.*GPG ID : 51720F56 | Finger Print : 1F6A FC7B 05AA CF29 8C1C ED65 3233 4D18 5172 0F56
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.