Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 27 Sep 2018 13:08:10 +0530
From: Dhiraj Mishra <>
Subject: Telegram uses SOCKS5 to share user/creds

Telegram is supposedly is a secure messaging application but it uses SOCKS5
to transmit user credential's, neither traffic nor credentials are
encrypted in the SOCKS5 protocol, but this is how the SOCKS protocol works
(see SOCKS5 carries passwords in

Product affected: tdesktop 1.3.16 alpha
Browser Info: Firefox 62.0 (64 bit)
Tested on: Ubuntu 18.04 LTS x64

Steps to reproduce the issue:
1. Open tdesktop
2. Go to Settings > Advanced Settings > Connection type
3. Open "Proxy Settings" check "Use proxy"
4. Put some random Hostname, Port, Username and Password
5. tdesktop tries to connect it, while it connects click on that line which
is made of 3 small spots (On right hand side)
6. Click share, the link gets copied.

Example Link:
The link which gets generated have the password in plaintext, SOCKS5 is a
transport protocol and by itself it is not encrypted. Requests transmit the
credentials in plain text which is considered a bad security practice.

URI producers should not provide a URI that contains a username or password
that is intended to be secret.  URIs are frequently displayed by browsers,
stored in clear text bookmarks, and logged by user agent history and
intermediary applications (proxies).

Since the request carries the password in cleartext, this subnegotiation is
not recommended for environments where "sniffing" is possible and practical.

Thank you

*Dhiraj Mishra.*GPG ID :  51720F56   |  Finger Print : 1F6A FC7B 05AA CF29
8C1C  ED65 3233 4D18 5172 0F56

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.