Telegram is still leaking user IP addresses to contacts | TechCrunch
techcrunch.comA security researcher has created a tool that allows someone to find out the IP address of a Telegram contact just by calling them.
You must log in or register to comment.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 124 users / day
- 1.05K users / week
- 1.3K users / month
- 4.58K users / 6 months
- 1 subscriber
- 3.67K Posts
- 93.3K Comments
- Modlog
The way they try to defame telegram lmao
[This comment has been deleted by an automated system]
Telegram not being part of Western Intelligence Toolkit along with facebook, google, apple and others offends people to the extreme, so they make a hill out of moles. P2P is inherently privacy friendly and your IP is most likely going to geolocate to the ISP. Techcrunch seems retarded.
But do keep up the fearmongering going.
Leaking ip’s is meh, however sharing info with feds while mentioning not doing this very thing in their own FAQ is shady AF. Then we have their serverside being proprietary garbage, plus intrusive info collection (like why do they need no know my hostname, device model, desktop environment, etc?). Did I mentioned they started advertising crap based on the channels a user’s subscribed to? Yeah, telegram still sucks when it comes to privacy, and it’s only getting worse over time
[This comment has been deleted by an automated system]
Ohh no, Someone on the Internet that I’m communicating with has access to a piece of information that is necessary for communicating with me.
deleted by creator
But I could include an image in this message and get your IP address easily. It’s just worthless
deleted by creator
Should have used the word direct, but their point stands.
deleted by creator
We’re not directly communicating. A phone call over IP is direct.
deleted by creator
Is it a leak if it’s a necessary technical part to a functionality?
The main issue is that it’s not obvious to non-technical users. They can’t asses what sharing IP address means either though.
Telegram defaults to using p2p for calls, for contacts only.
It’s not a thorough privacy default, but otherwise seems fine to me. If you want p2p it needs to be enabled, and if you don’t it needs to be disabled. No-contacts and no-calls receive no IP.
Here’s a professional security researcher/pentester explaining in depth why “leaking” IP is blown out of proportion
The relevant gist is
Usually it is the town, or nearby town. If you live in a more rural area that can narrow it down to a few hundred people.
Also in some less-developed countries the data protection by ISPs is very weak. Basically if you know someone in the police (or pay a bit under the table) you can easy get the exact name and address of the account owner if you have an IP.
Here is an alternative Piped link(s):
Here’s a professional security researcher/pentester explaining in depth why “leaking” IP is blown out of proportion
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.
deleted by creator
I agree. This requires the user to actually save the attacker phone number as contact in order for this the IP address to “leak”
There’s still a chance that your contacts would have been hacked, and one could be vulnerable. But it all comes back to your risk profile. If you require hiding your IP address, you should turn this off or even use a VPN for all your traffic.
Thanks for this, I was unaware.
Calls turned off completely now.
This is the best summary I could come up with:
The popular messaging app Telegram can leak your IP address if you simply add a hacker to your contacts and accept a phone call from them.
TechCrunch verified the researcher’s findings by adding Simonov to the contacts of a newly created Telegram account.
Simonov then called the account, and shortly after provided TechCrunch with the IP address of the computer where the experiment was being carried out.
The fact that Telegram leaks your IP address to people in your contacts during a voice call has been known for years, but it’s likely that new, less technical users may not be aware.
Simonov, who founded the cybersecurity firm T.Hunter, told TechCrunch: “Telegram focuses on security and privacy, however, in order to stay safe you need to be aware of the nuances of how the messenger’s voice calls work.”
To avoid leaking your IP address, you have to go to Telegram’s Settings > Privacy and Security > Calls, and then select “Never” in the Peer-to-Peer menu, as shown below.
The original article contains 414 words, the summary contains 167 words. Saved 60%. I’m a bot and I’m open source!