Post #2836357
2025-06-10 15:24 UTC
@rysiek@mstdn.social You say: "That “authorization key”, used to encrypt messages between a client and a server, is negotiated once on each device [...] got assigned to at registration time, pretty much for the lifetime of the client on that device."
I wonder what happens with the web client, specially if you somehow get rid of T's data on the browser. I use it daily and TBH for some stuff it's better than Linux and Android native client.
Replies (1)
-
@rysiek@mstdn.social 2025-06-10 15:28
@mdione@en.osm.town in the web client all traffic goes through HTTPS, presumably using websockets. I would assume an authorization key is still generated, and the web client still puts MTProto 2 encrypted messages in that HTTPS tunnel. That authorization key is probably kept in the browser, or perhaps valid only for the session. But I am pretty sure it's there. But the fact that it goes through HTTPS means it is not visible cleartext on the wire.