Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 11 Sep 2018 17:25:47 +0530
From: Dhiraj Mishra <>
Subject: tdesktop leaks user IP address

This is still not fix in telegram desktop  team says their is nothing to
fix here and this is working has intended.


*Steps to reproduce:*
1. ./Telegram
2. Call end user
3. The access log on CLI reveals the end user public IP address.

By default in tdesktop p2p is enable, which open a direct communication
when calling to the other user, potentially seeing his/her IP. Telegram is
supposedly is a secure messaging application but while calling another user
leaks his/her public IP address in access log. However, by navigating to
Settings and Privacy  > Calls > and set P2P to `nobody` in telegram apps in
(iOS and android) will not allow others to view public IP of end user, but
this option is still not available in tdesktop, which makes tdesktop
vulnerable to this issue.

Thank you


*Dhiraj Mishra.*GPG ID :  51720F56   |  Finger Print : 1F6A FC7B 05AA CF29
8C1C  ED65 3233 4D18 5172 0F56

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.