Post #2836359
2025-06-10 15:28 UTC
@mdione@en.osm.town in the web client all traffic goes through HTTPS, presumably using websockets.
I would assume an authorization key is still generated, and the web client still puts MTProto 2 encrypted messages in that HTTPS tunnel. That authorization key is probably kept in the browser, or perhaps valid only for the session. But I am pretty sure it's there.
But the fact that it goes through HTTPS means it is not visible cleartext on the wire.
Replies (1)
-
@rysiek@mstdn.social 2025-06-10 15:31
@mdione@en.osm.town which might not mean all that much. Telegram's choices of infrastructure provider and of protocol design, and the way these facilitate surveillance in case of the mobile client, would make me very wary of any other choices and decisions they might have made with relation to the web client that would have a similar effect. Question: do you have to log in every time into the web client? Or does your browser keep the session for, say, a few days or weeks, even when traveling?