“Any sufficiently complex input format is indistinguishable from
bytecode; the code receiving it is indistinguishable from a vir-
tual machine.”
goodmythical 2 hours ago [-]
Did you really name your son Robert'); DROP TABLE Students;-- ?
Forgeties79 2 hours ago [-]
Ah yes little Bobby tables.
bita_nidir 3 hours ago [-]
Related: could we please stop, by default, allowing software to:
a) access all your files, and
b) roam the internet at will.
That was somewhat OK in the 80s, but it hasn't been since.
celsoazevedo 2 hours ago [-]
I wouldn't mind, but there needs to be a way to remove the "training wheels".
I don't want my computer to always be as closed and restrictive as an iPhone. That's good sometimes and perfect for some users, but not for everyone or all the time.
bita_nidir 2 hours ago [-]
Of course, I was just saying "by default". You should be able to allow any access as you want, give it your old socks or granny. Just not by default.
zargon 54 minutes ago [-]
These days, most things that I run that aren't from my distro's repos get their own bubblewrap. On top of this, I use opensnitch. Even if I trust the application (uncommon), I never trust npm, pypi, etc. any longer. It's tedious to set this up and OSes should be helping make this easy.
MomsAVoxell 57 minutes ago [-]
The problem is, peoples files are too valuable - even to the OS vendors - and also, there are simply too many valuable people on the Internet without the willpower to know how to manage their own filesystem.
If the OS vendors are motivated to harvest peoples data, why on Earth would they be motivated to make sure nobody can harvest peoples data?
pizzafeelsright 3 hours ago [-]
I am in agreement. I am always curious as to the solution because VMs are not the solution and zero knowledge is helpful but not quite there.
crossroadsguy 6 hours ago [-]
One of the challenges with Telegram is - they regularly re-enable settings inside the app/account that you had specifically disabled. So at any point you don't know what is happening and what is not. Meaning, even if you didn't see a thing, a malicious file might be sitting all warm and fuzzy on your computer - among possible other things. I used to like the snappiness of this app (and it is still snappier than almost all other IM apps combined, by a margin), but after a while I realised it was a ticking time-bomb (to keep it installed on the desktop) and possibly a scammer safe haven, nothing else.
axegon_ 4 hours ago [-]
A lot of companies do this but I always get a ton of hate for saying this: Telegram is the worst offender I've seen. If you start digging through their apps, you see a ton of security practices that are anything but secure. And one of the hundreds of reasons I treat Telegram as the plague: get it away from me and burn it with fire.
jminnl 5 hours ago [-]
All big companies pull these kind of tricks. Another variation is to retire the old setting and introduce a new one with a deceptive name that is default on again.
boltzmann64 1 hours ago [-]
Can you please tell me what settings get auto re-enabled? I use Telegram as my primary messenger app. I just want to make a more informed decision if I should switch to Signal or something.
gvfsa 17 minutes ago [-]
This hasn’t happened to me absolutely ever in 10+ years.
bluebarbet 5 hours ago [-]
Presumably the risk is mitigated somewhat with the Flatpak version (`org.telegram.desktop`)?
crossroadsguy 2 hours ago [-]
Not on Linux. But if that is a safe variant then yeah great. Also, I see https://flatpak.org (is this the one you meant?) has Telegram has one of the showcases apps on the homepage so I guess they would have done their due dilligence.
SpacePortKnight 10 hours ago [-]
I think it is one of the reasons why I am always hesitant to install any software on my windows pc. Web versions are often more than good enough.
modeless 10 hours ago [-]
Yes. I'm constantly annoyed by the dark patterns Zoom and Slack use to trick you into downloading their desktop apps. The web experience is practically indistinguishable and much more secure.
freehorse 10 hours ago [-]
> The web experience is practically indistinguishable
The web experience is actually better, as eg there I can do web searches when right clicking sth with my default search engine without slack highjacking the options to force me onto google.
nkrisc 7 hours ago [-]
What is “sth”?
jdrek1 6 hours ago [-]
An abbreviation for "something"
sdcfgy 5 hours ago [-]
For me I just refuse to run another damn browser for each app. You can have a tab. That is it.
miroljub 10 hours ago [-]
Slack web app experience on mobile phones is abysmal.
gvfsa 10 hours ago [-]
They are talking about desktop apps.
feeeeeany 8 hours ago [-]
Both are being talked about actually
palata 6 hours ago [-]
> Web versions are often more than good enough.
Except when you want actual end-to-end encryption, in which case web versions fundamentally cannot guarantee it today (and there are no plans to get there).
People using Telegram don't care so much about end-to-end encryption, so there maybe it makes sense to use the web version indeed.
olalonde 5 hours ago [-]
You should be more specific about what you mean here because you can absolutely do E2EE in the browser.
palata 2 hours ago [-]
E2EE fundamentally exists for situations where we don't want to trust the server. That's the whole idea of E2EE, right?
Of course it's not black or white, security is a gradient. But if you want to check today that you are running the legit client of ProtonMail in your browser, you do not have a practical way to do it. It is theoretically feasible, I guess (?), but far from practical. But I can walk you through the steps needed to do it today with Signal, for instance.
I think I put my limit there: it's not enough to run cryptography. Verifying the client has to be practical for the user. The way ProtonMail works in the browser is a nice way for Proton to minimise the data they collect, but it's not E2EE, because even as an advanced user I cannot practically verify the client they serve me. In other words, E2EE means (to me) that there can be some kind of guarantee if you put a reasonable amount of effort into verifying it. The browser doesn't provide that at all.
Interestingly, shipping a webapp in ElectronJS (which is terrible in terms of software, IMO) is different: you can have E2EE in an ElectronJS app.
And I'm assuming that's why Signal has a Desktop app (which I believe is ElectronJS) and not a web (as in, "loads in the browser") version.
thadt 4 hours ago [-]
Not OP, but: You can definitely do encryption in the browser, no problem.
What you can’t do is make sure the server giving you the code that does the encryption doesn’t change it out with code that also sends your secret messages to Siberia. Unless you control the server giving you the web page. And you trust DNS.
At that point your trust model is simpler with an auditable local application. It could even be an Electron app - so almost exactly doing E2EE in the ‘browser’.
johnecheck 4 hours ago [-]
I find this unconvincing. Isn't this the exact same security posture as a native app with automatic updates turned on?
If your thought is just "disable automatic updates", there's no reason you couldn't do the same by declining new versions of a web app. Unless you built it yourself (as a web app or native app), you need to include the servers and DNS in your trust model.
To me, it seems entirely isomorphic. The only material difference I see is whether automatic updates are on by default (an OS/browser vendor issue, not anything inherent to the tech).
palata 2 hours ago [-]
> Isn't this the exact same security posture as a native app with automatic updates turned on?
It's not, I don't think so. For instance, if you install Signal on your Android, the apk was signed by Signal, sent to Google and distributed by Google. Google cannot modify it, because Signal has to sign it. So in order to make you install a "malevolent" version of Signal, Google has to collude with Signal.
Of course you can download and install the apk from Signal's website, in which case Signal may give you personally a malevolent version. But you can easily compare that file to someone else's. On Android there are verifier apps that allow you to check that.
Finally if E2EE does matter a lot to you, you can compile Signal yourself from the sources, and even go as far as auditing those sources yourself.
You don't get to do any of that on the web. When you load ProtonMail in your browser, you don't have any practical way to verify that the code your browser is running is the same as everybody else who is running it around that time. You have to trust Proton that they give you code that prevents them from reading your emails. It is better than nothing or course, but it still means that you have to trust Proton.
Perseids 3 hours ago [-]
> I find this unconvincing. Isn't this the exact same security posture as a native app with automatic updates turned on?
Mostly. But the alternative shouldn't be a native app that updates itself, but rather a native app that is updated by a package manager. The big difference is traceability and auditability: With a trusted package manager (and even in good app stores) the company can only decide to push an update to everyone or to no-one. There is no way to push an update just to the pesky journalist or whistle blower. A covert attack is really hard to accomplish this way.
palata 2 hours ago [-]
Exactly, to me there are two requirements:
* The cryptography must be sound. That's the obvious one, if it's not encrypted then it's not "end-to-end" encrypted.
* There must be a practical way for the user to "verify" (with some definition of verifying) the client they are running.
A web browser doesn't provide that at all. It does not mean that everything else provides it: there are many ways to provide a Desktop app that break E2EE, but that is a different discussion. My point is that fundamentally, the web browser does not provide that. It's not that the laws of physics prevent it, it's just that the web browser never chose to provide that.
thadt 59 minutes ago [-]
> it's just that the web browser never chose to provide that.
Yes, this exactly. If we wanted ‘verifiable’ app distribution via browser, then we’d need browsers to implement some way to cross check the code downloaded vs a publicly published list somewhere - similar to certificate transparency or what WhatsApp is trying to do with an extension [1]. Without that, web apps are left working with a weaker threat model.
It depends on how the automatic updates are handled.
App updates can be cryptographically signed with a key that’s kept offline and only held by a few people. Your trust in the app can be equal to your trust in those people, multiplied by your trust in the technology that keeps those offline keys safe from compromise.
Your trust in a web app will be equal to your trust in the people running the server multiplied by your trust that the server isn’t compromised. Since the server is necessarily always online, that trust will be much lower.
perching_aix 6 hours ago [-]
Why couldn't they?
palata 2 hours ago [-]
Because when you load a page in your browser, you fundamentally trust that the server is giving you what you expect. And the whole point of end-to-end encryption is that you don't trust the server.
If you download an install a program on your OS, you can e.g. check the hash of that downloaded archive and compare it to others, ideally making sure that you are running an audited version of the program. You don't have that guarantee when loading code in a browser: the server could totally serve you a modified version of the code, and you don't have a practical way to check that. Not that the laws of physics prevent it; it's just not how a browser works.
perching_aix 4 minutes ago [-]
[delayed]
emilfihlman 3 hours ago [-]
The lack of TOFU in browsers is an extreme pain point.
I'm going to go out on a limb and say that it is on purpose, and not a good purpose. The trust model of the web is fundamentally broken.
palata 2 hours ago [-]
The way I see it, it's just different.
IMHO, the web should be to load websites (obviously) and small webapps that don't require E2EE or any kind of auditing. As soon as those are desirable, it shouldn't be a webapp anymore.
I find it nice to be able to load websites in my browser, instead of installing one program per website.
But sometimes I want a program.
Eueudhsbsj32 10 hours ago [-]
When I really need to run an app on my Linux laptop, it always gets its own bubblewrap container.
drnick1 2 hours ago [-]
This, especially commercial apps like Zoom, Steam and others. Sometimes a separate user profile is easier though.
prophesi 6 hours ago [-]
Don't most things people use day-to-day for both work and entertainment require use of the actual app these days, or at least make it very difficult to do so?
monster_truck 9 hours ago [-]
Don't let yourself be fooled into thinking this is enough. Plenty of examples of, especially through wasm, being able to reach far beyond what they're supposed to.
It gets buttoned up fast and is always getting better, but its absolutely not a silver bullet.
Fethbita 8 hours ago [-]
If you enable lockdown mode on your iPhone and Mac, WASM is disabled through Safari. If absolutely needed, an alternative browser like Firefox can be used for those sites.
10 hours ago [-]
Razengan 9 hours ago [-]
Even on Mac, where apps like Dropbox showed you a FAKE DIALOG to STEAL YOUR ADMIN PASSWORD:
Look at who is on the board of Dropbox and ask yourself what the value of a file syncing service having accessibility (and previously kernel extension) privileges on your machine are.
Not to mention that Dropbox has never been E2E protected and had that Lenovo credential free access bug on web not too long ago.
Dropbox should be considered untrustworthy at this point, especially since iCloud Drive offers E2E encryption and so do other competitors.
Kwpolska 8 hours ago [-]
Is this a fake dialog, or just the standard system sudo dialog, which used to allow app developers to show an arbitrary reason string?
Razengan 8 hours ago [-]
If it was the standard macOS dialog, an app wouldn't have been able to snoop the password
Kwpolska 4 hours ago [-]
Why do you think it snooped the password? Top comment says:
> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple).
Razengan 2 hours ago [-]
[flagged]
yard2010 8 hours ago [-]
Something about reading this blog post knowing every letter and screenshot done manually with no LLM gave me the chills
Razengan 7 hours ago [-]
You can't be sure. Maybe an AI from the future went back in time Skymet-style and wrote everything there
usr1106 12 hours ago [-]
I don't use Telegram Desktop or Windows. But that's exactly the reason why I run Firefox in a firejail sandbox on Linux. The browser has only access to my Downloads folder. I know that it's considered untrusted and don't keep any files there for a long time.
freebsd_lovefes 12 hours ago [-]
Or the reason to run Firefox in a FreeBSD jail to get server-grade security. But the question is can an attacker get access to the Firefox profile data? Because you cannot block that from Firefox, obviously.
usr1106 11 hours ago [-]
Sure, to some degree you must trust your browser. In the extreme case you could open a new, non-persistent browser session for every page you visit. Could be slightly inconvenient...
bmacho 9 hours ago [-]
Or you could have 2 (or 3) separate browser sessions, one for only important stuff, and one for fun.
jcul 4 hours ago [-]
Or Firefox containers.
Not sure how that partitions the files on disk though, would probably need some code changes to work with some kind of firejail setup.
fsflover 6 hours ago [-]
> In the extreme case you could open a new, non-persistent browser session for every page you visit.
This is seamless on Qubes OS: You just click a link and a new empty VM with Firefox opens. You close the browser, and the VM is destroyed. Can't recommend it enough.
eddythompson80 4 hours ago [-]
Not really sure that’s safe. There has been at least 1 Qubes OS specific VM escapes this year and 2 KVM guest->host control ones.
barrkel 12 hours ago [-]
I guess it also has access to the cookies for all your logins.
crossroadsguy 5 hours ago [-]
You mean a website A can have login/auth cookies of website B, D, Z, HK… etc? SOP doesn't work? Or is there some sort of exploit on top of third party cookies? (Just curious. I don't know anout browser dev/etc).
By the way, they don't have just one web apps. They have A, they have K, and apparently a Z – subdomain is webz, or maybe that's actaully A. Not sure.
usr1106 12 hours ago [-]
Yes, it has access to the internal storage mechanisms of the browser.
I used to use Cookie Auto Delete for years. But when I last checked it seemed unmaintained. I log out of all somewhat important services anyway every time I am done.
For important stuff like banking I use Firefox containers.
Yeah, all of them could have their weaknesses and vulnerabilities. I just hope no attacker hits exactly the stack I use...
eddythompson80 10 hours ago [-]
Personally I only open Firefox on Linux booted from a read only usb. In theory there could be a firmware vulnerability in the CPU that could let it write persistent data to the UEFI firmware, but I hope the possibility is small.
ShinyLeftPad 8 hours ago [-]
What makes it doubly funny is that the OP is not even about any browser vulnerability, it's a hole in desktop client IPC
maqp 12 hours ago [-]
The little I have to run Telegram Desktop for, I run in a VM. I'd never let the little oligarch's code touch my desktop OS.
lifeisloving 11 hours ago [-]
I dont write off software because where the person that made it was born. I personally think thats the same thing as refusing to eat at a black owned resturaunt because of the owners skin color.
Seems like many people do this when it comes to russian tech. Im American and I certainly trust my data in the hands of a foriegn government/entity (which is not even the case for telegram), than my own. Even if it was a russian op (its not the Ukrainian military literally used telegram for years), the russian government cant touch me.
ornornor 11 hours ago [-]
Telegram is a double threat: the company is Russian and the founder was arrested then mysteriously released without any charges in France. Given why France wanted him and arrested him, the fact they released him a few days later with no charge annihilated the little shred of trust I had in this Russian piece of software, personally.
snek_case 5 hours ago [-]
I don't know why anyone is using telegram when there is signal. Also with all the issues around telegram and their founder, you'd probably be safer using whatsapp even... :/
writtenone 3 hours ago [-]
Telegram has channels, which are a one-to-many (thousands or millions of people) chat feature letting you have basically your own social feed.
Lots of people follow channels for on the ground news reporting, especially since it's not censored or "advertiser friendly" like social media companies are incentivised to be.
Zancarius 50 minutes ago [-]
The onboarding experience with Telegram is extremely easy, which is useful when dealing with non-technical audiences who might not even have a social media account (but do have smart phones).
My Bible study class has grown enough that standard SMS/MMS group texts are hitting up against Verizon's carrier limit (I think we have only two people who use Verizon), and RCS isn't an option. Telegram wasn't my first choice, but it was a lot easier for everyone, and it supports tablets out-of-the-box.
bluebarbet 5 hours ago [-]
At that's the point. People are not choosing to use anything, they're using what they have to in order to communicate with people.
dylan604 4 hours ago [-]
It's less about what they have but what the people they want to communicate are using.
g-b-r 11 hours ago [-]
You're sure you're replying to the right message? It doesn't mention any country or nationality...
Anyhow, people don't write off Telegram because it's Russian, but for many legitimate reasons.
There are indications that it could be much closer to the Russian government than they pretend, but that matters not because Russians are bad people, but because the current government of Russia is an aggressive dictatorship.
The Ukrainian military literally used Telegram for years and now literally banned it.
The main reason I consider it suspicious is that they are so adamant about not needing end-to-end encryption.
Even assuming they are fully legitimate today, if this ever changes and somebody gets access to their infrastructure, they immediately get a treasure trove of historical messages.
feelamee 9 hours ago [-]
> Anyhow, people don't write off Telegram because it's Russian, but for many legitimate reasons.
> There are indications that it could be much closer to the Russian government than they pretend
Can you give more details, please?
I'm using telegram a lot and want to know if there is something...
There are oligarchs in other countries like USA (Musk)
iririririr 12 hours ago [-]
interesting you mention. because Firefox doesn't have a way to disable the single instance functionality which was used on this telegram vulnerability.
one long time Firefox contributor have been for a couple years now removing every part of the --noremote option. even botching (Ooops!) the console notice that the flag was no-op some time ago.
yjftsjthsd-h 11 hours ago [-]
> removing every part of the --noremote option
What's this now? I'm using that to handle multiple profiles and haven't noticed anything breaking
lxgr 10 hours ago [-]
Which Firefox functionality was used in the Telegram vulnerability? Isn’t this all about the desktop app?
g-b-r 9 hours ago [-]
None, I'm not sure what the other user was talking about
Telegram wanting to be single instance means that it has to use some serialization, and it not escaping semicolons enables a part of the attack.
lxgr 9 hours ago [-]
What does "being single instance" mean here?
g-b-r 8 hours ago [-]
That only one instance of Telegram can run at any time.
And if you open a Telegram link it will open in the existing instance.
Windows uri handlers actually always create a new process, though; so if you want this single instance behavior, you have to do some check at the start of the process and communicate the uri to the previously running process (as explained in the article).
Narushia 7 hours ago [-]
It's great that this writeup was published, but unfortunately the text is full of claudisms and made me close the tab pretty quickly.
xg15 7 hours ago [-]
It's annoying, yes, but I think in this case, the information is important enough that people should jump over their shadow and read it.
You wouldn't ignore a zero-day announcement either because the formatting is ugly.
jcul 4 hours ago [-]
I'm just a bit jaded from Claude's tone of voice, so it made me not want to read it.
I did skim over the important bits though.
xg15 4 hours ago [-]
Yeah, no objections there at all...
victor_pudeyev 2 hours ago [-]
Yes, just close your eyes, don't worry! Close the tab...
Panzerschrek 13 hours ago [-]
It's not strictly-speaking a Telegram-specific vulnerability. It's a vulnerability of all modern desktop operating systems allowing any user process to read/write any user file. Ideally all programs should be isolated from the underlying filesystem and be able to read only their own files and files from per-program data directory (like downloads for a browser or Telegram-client).
simonra 12 hours ago [-]
At the same time the mobile operating systems are vulnerable to vendor lock-in due to the absence of this functionality. It is clearly a worse problem that a user can't give their backup system access to the photos stored by other applications (often social media), or for instance reliably capture media streams to use in for instance a remixing application. Bringing custom clients when the software originally used to create the interesting files starts acting against the users by introducing subscriptions or being abandoned is another example of the user dictating what software accesses what files is critical to secure the users operations. Consumers need security against commercial interests infinitely much more than commercial interests need protections against consumers, and it would be unethical to enable commerce at the expense of individuals like the mobile operating systems do.
lxgr 10 hours ago [-]
There is a lot of middle ground between “every app can do anything as the user” and “no shared file system, no user access to app ‘owned’ files”.
debazel 7 hours ago [-]
Any time big corp implements strong sandboxing they'll inevitably put the user inside of the sandbox.
lxgr 5 hours ago [-]
That's a valid concern, but not an argument against sandboxing, in my opinion.
yjftsjthsd-h 11 hours ago [-]
> It's not strictly-speaking a Telegram-specific vulnerability. It's a vulnerability of all modern desktop operating systems allowing any user process to read/write any user file.
No, it's definitely a Telegram specific vulnerability. It might be worse because of poor defense in depth, but without Telegram itself being vulnerable it wouldn't matter.
nvme0n1p1 13 hours ago [-]
If you don't believe it's a vulnerability, then you must believe that tricking Telegram into uploading your messages database to the attacker, leaking all your private conversations, is A-OK? Telegram owns that file, after all.
Panzerschrek 13 hours ago [-]
I didn't say it's not a vulnerability. It is clearly one. But allowing such vulnerabilities to deal damage beyond data of its host application is an OS vulnerability.
lxgr 10 hours ago [-]
Yes, and there are many ways for apps to opt into this, to limit their own blast radius in a case like this.
Does Telegram do that, or do they consider themselves beyond bugs, just like they consider themselves too clever and untouchable by anyone to need end-to-end encryption?
ShinyLeftPad 8 hours ago [-]
> vulnerability of all modern desktop operating systems allowing any user process to read/write any user file
not true on macos.
parampampam 3 hours ago [-]
Not true for apps installed via AppStore. A lot of popular apps aren’t in AppStore, Chrome/FF for example.
alt227 8 hours ago [-]
I would argue one of the main purposes of OSs is securing files between different users. All modern OSes do this securely if set up properly.
BoppreH 8 hours ago [-]
Or Linux with Flatpaks.
lostmsu 7 hours ago [-]
Or Windows Store as long as the proper integrity is used
eviks 13 hours ago [-]
That's broadly-speaking a vulnerable design of all OSes, but strictly speaking it is a bug in Telegram that is now fixed at the app level. Though sandboxes / app isolation solutions exist even in the broadly vulnerable OSes, so apps could use them already today to avoid such issues in the future?
saagarjha 12 hours ago [-]
Telegram is available sandboxed from the Mac App Store on macOS.
lxgr 10 hours ago [-]
It could easily sandbox itself in the non-store distribution as well, yet the developers apparently choose not to.
zorked 11 hours ago [-]
It is also sandboxed in Flatpak.
Saris 7 hours ago [-]
Looking at the flatpak manifest it has `share=ipc` but no directories shared.. I'm not sure on flatpaks defaults for what it would actually have access to on the host.
gvfsa 10 hours ago [-]
That is not the same app.
ubercow13 8 hours ago [-]
Telegram Desktop is also on the app store though.
saagarjha 10 hours ago [-]
I know, it's (slightly) better
10 hours ago [-]
nottorp 11 hours ago [-]
> Ideally all programs should be isolated from the underlying filesystem and be able to read only their own files and files from per-program data directory
So how will you spam all the group chats you're on with meme gifs downloaded from facebook then? :)
yjftsjthsd-h 5 hours ago [-]
Clicking upload opens an OS file picker that lets the user select a file outside the app sandbox. At least flatpak and Android do it that way.
Panzerschrek 11 hours ago [-]
Download an image from Facebook into browser's private downloads directory, copy it using a file-manager application (one of the exceptional applications having full filesystem access) into Telegram's private directory, upload it into chats you need to post it.
The file-manger application managed above is a single point of failure, of course. So, it should be allowed to use only one provided by OS vendor.
lukan 8 hours ago [-]
Sounds like effort, people don't like effort when spreading memes, so would be enraged if this would be the default now, or nobody would activate it.
There is a lot of middle ground, like having a shared folder for access. "Downloads" might be a good default, if clearly communicated, that anything in there, is accessible by any app.
miohtama 7 hours ago [-]
MacOS sandboxes user folders by default. The user need to explicitly give a permission for every application.
parampampam 3 hours ago [-]
It sandboxes some use folders. ~/projects won’t be sandboxed for example.
penskymaterial 12 hours ago [-]
> It's a vulnerability of all modern desktop operating systems
That has the caveat that it only works as far as apps opt into it
ptidhomme 4 hours ago [-]
Chromium and Firefox have unveil on OpenBSD, which is a good start.
g-b-r 13 hours ago [-]
It is.
Not all user processes upload those files somewhere surreptitiously.
Of course operating systems should support that isolation (hopefully in some better way than the hell that smartphones are), but it's not like Telegram can blame the OS for this vulnerability.
Panzerschrek 13 hours ago [-]
> Not all user processes upload those files somewhere surreptitiously.
Only if you have access to full source code, can audit it (including each update) and somehow can prove that it has no vulnerabilities. Otherwise one should assume that any application is potentially-harmful and/or vulnerable.
yjftsjthsd-h 11 hours ago [-]
No, that kind of audit is neither necessary nor sufficient. (A firewall works without application source code, and trusting trust means we can hand wave anything even with source.)
g-b-r 13 hours ago [-]
Ok, at least if it has network access, but can you recognize that this was a vulnerability, and that you're talking of something only tangential to it?
csmlab_notes 7 hours ago [-]
[flagged]
robertlane0 2 hours ago [-]
Telegram and security don't really belong in the same sentence anyways. Say what you will about Signal but they at least have better cryptography and more transparency about what software they're running.
RachelF 9 hours ago [-]
It looks very bad that Telegram took almost 3 months to fix this vulnerability.
Reported 25 June
Fixed 16 September
I wonder why it took them so long?
miohtama 7 hours ago [-]
It was reported to a third party platform which the author says is likely clogged up.
8 hours ago [-]
k__ 9 hours ago [-]
They are restructuring their companies regularly and keep the core company small.
itsmeduncan 3 hours ago [-]
I wonder how much of Apple's announcement around disallowing full system disk access was from this as opposed to Muse, et al.
erelong 14 hours ago [-]
I thought telegram was flagged as insecure like a decade ago, it's never really been "very secure"
Still we are using it, because UX kills any other app and people that are (probably) behind it will cause almost no harm to casual, not-interesting people :)
And yes, I know that by default chats are not E2E, that phone number has way too many effects on accounts etc. Still, UX and agencies interested in important people are more welcome than data selling, ad-based companies.
lxgr 10 hours ago [-]
What a bizarre threat model. Why would you rather have your data with who knows who than just your metadata?
And what UX problems exactly is Telegram solving that its many competitors aren’t? I hear this all the time, but I use both Telegram and WhatsApp and I haven’t found anything lacking in the latter, UX wise.
maxgashkov 9 hours ago [-]
> and I haven’t found anything lacking in the latter, UX wise
I'm sorry if I'll sound condescending, but you probably don't use either frequently enough. With telegram it's the little (and sometimes not so little) things, e.g.:
- voice message transcription
- you can select part of the message via long-press and use it as a quote when responding
- massively more complex formatting possible
- bots as the first class citizens not gated behind some bullshit 'Business' KYC/subscription
- is not crippled by prohibiting system-level phonebook access like whatsapp
- extreme flexibility in managing large groups, mostly due to the bot point above
- and many more
All of the above does not excuse lack of e2e by default, this is almost embarrassing in 2026 now, but Telegram is the most polished IM experience of all the apps I have tried.
lxgr 8 hours ago [-]
I use them daily, so we might just have different priorities.
Bot access is definitely better in Telegram; that’s what I sometimes use it for.
WhatsApp has voice message transcription now, but fortunately I don’t receive many. (I consider it pretty rude to put the effort of messaging on the recipient because the sender can’t be bothered to type or transcribe on their side.)
Everything else you mentioned is a minor inconvenience to me. Knowing the provider can’t mine my message data more than makes up for that.
zahrevsky 5 hours ago [-]
I agree with maxgashkov about the UX. Just wanted to add that the list of good UX features is much, MUCH longer than the one maxgashkov provided.
skeledrew 6 hours ago [-]
For me it isn't the UX really. I was sold on it NOT being WhatsApp, etc, and then I stayed for the unlimited free storage for life (have a virtual FS built on it). Definitely ain't nobody else offering that.
maqp 11 hours ago [-]
"will cause almost no harm to casual, not-interesting people"
Yeah same can be said for Facebook and WhatsApp that Durov vehemently claims should not be trusted with user's data. Maybe it's a ploy for the Mark Zuckerberg of Russia to get the data of people.
Also, Telegram doesn't have to sell it's users if it's an FSB honeypot.
mschuster91 9 hours ago [-]
Well, it makes sense from a threat modeling perspective. If you're Russian, you should use Whatsapp because it is unlikely Whatsapp will cooperate with the Russian dictatorship, but in Western countries, you can assume that anything from Meta, Google or Apple that's in any way useful (and even if it's just metadata) can and will end up in the data lakes at the NSA.
tannertech 7 hours ago [-]
Assuming you think Meta can write secure proprietary software and trust them to do so.
mschuster91 5 hours ago [-]
Well for a Russian I think there's barely a chance that Russia manages to compromise any of the US giants at large scale, so Meta is a better choice than VK, Telegram or any of the Chinese services.
lxgr 10 hours ago [-]
It was, but most people will believe what their peers (real or parasocial) say over the collective screams of every security researcher on the planet, so here we are.
g-b-r 14 hours ago [-]
Absolutely, but mostly for their protocols, statements, people and infrastructure.
A file exfiltration vulnerability is still noteworthy.
It has this feature where it tells you about other users that are on the platform. I mean it's not a huge leak, but right off the bat it's pretty poor security posture. For an app that competes with other chat apps on supposedly being more secure and privacy aware, it does worse than whatsapp on that end.
lukan 8 hours ago [-]
"For an app that competes with other chat apps on supposedly being more secure and privacy aware"
It mainly competes against facebook and other social media plattforms. The privacy is clearly wrong and only believed by non technical people (which can be amusing, when on TG someone posts a link to FB, or a WhatsApp group and people chime in and lecturing others that they should not use that as it is insecure and owned by a big company who will sell them out).
thenthenthen 6 hours ago [-]
This!! Signal also had this back in the day, very bizarre for an app thats privacy focussed… sadly have to use it because some contacts refuse to use anything meta etc. Sadly it is only big corp stuff that works reliably where i am somehow..
Cider9986 4 hours ago [-]
Telegram is worse than WhatsApp. No E2EE by default in 2026 is insane and Telegram's marketing is so deceptive.
skeledrew 6 hours ago [-]
This is really good to know. Telegram is my primary means of communication, and a bunch of other things, and even though I'm not exactly exposed (I have password set, and only a few people can yank me into a group), I'm running a bit of a custom-method install that I don't update much.
g-b-r 16 hours ago [-]
This link has already been posted with https://news.ycombinator.com/item?id=50019667 , but that post's title ("Telegram Desktop: one-click account takeover") doesn't say that the vulnerability allowed also any user-accessible file on the disk to be stolen.
This aspect is also not highlighted much in the article, which weirdly mostly focuses on the account takeover.
To me it seems something remarkable enough to warrant reposting the link with a different title.
Somewhat astonishingly, the core of the vulnerability comes from an internal url scheme added to Telegram to... help them publish their releases on their channel.
The Telegram developers saw no better way to do that than adding an internal tool which uploads any file it's told to.
Everyone else publishing their app on Telegram is able to do that with a script, but they had to do it that way.
It's true that it was exploitable only in a somewhat convoluted way, but still, it's an obviously dangerous feature.
Anyhow, yes, clicking on a link in Telegram Desktop was enough to have any user's file exfiltrated and to access or take over their account.
arjie 12 hours ago [-]
That is such a JiaTan grade feature because it’s an insane way to implement it but also plausibly deniable.
wrcoro 7 hours ago [-]
Does its official desktop client support "Secret Chats" (E2EE) yet? Last time I used Telegram before moving to more reliable IM platforms that feature was officially unsupported on desktop and there was even some community effort¹ to make a pull request with paid contributions totally ignored by Pavel Durov and his team
I heard Telegram client from aur repository on Arch Linux supports secret chats.
sehw 3 hours ago [-]
I use Signal btw.
opengrass 13 hours ago [-]
doas jexec -U opengrass tellyjail env DISPLAY=:0 Telegram
g-b-r 12 hours ago [-]
Yeah, something like that would not have prevented the account takeover part, though, which relies on Telegram's own files; or the access to cached files.
14 hours ago [-]
anon_cow1111 12 hours ago [-]
Imagine if you forgot to update your phone number with your personal bank, and then some random guy was given full access to your account and all of its contents.
And even if you dug through the account options and set a 2FA password (normally disabled) he could still just delete your account outright.
Last I checked, that's exactly how Telegram works by default. It's laughable to consider a service tied to a phone number secure.
sunaookami 9 hours ago [-]
You would still get a notification inside Telegram that someone else logged in (plus it sends the login code to your session first before you can fallback to SMS) and you can log them out. The "attacker" can't delete your account or log out your sessions because he can't use certain features on a fresh login, there is a downtime. But yeah, he can read all your chats. Same should be true for any app that uses phone number login. That's why there is a password feature.
anon_cow1111 5 hours ago [-]
You can delete an account if you have the phone number but not the password, it's on a 7-day timer before the account gets deleted. It can be canceled by a logged-in instance.
That still means you have to check it every 7 days.
msh 11 hours ago [-]
I guess that’s the idea with phone number based services. Imagine if you could not sign up for telegram/ WhatsApp/ whatever because someone used your number before you.
KingOfCoders 13 hours ago [-]
It's not a bug it's a feature.
iririririr 12 hours ago [-]
was a feature.
technically, this is one agency burning the feature of another agency.
maqp 11 hours ago [-]
The main spy feature that is Telegram collecting 100% of content and metadata is the main feature for every intelligence agency who bothers to ask Mythos to find zero days to pwn the servers.
syngrog66 7 hours ago [-]
if the user values security and privacy would not be using Telegram
buckle8017 6 hours ago [-]
I am shocked......
ramesh31 2 hours ago [-]
I mean it's pretty obvious these things (Signal, et. al) are just honeypots for the three letter agencies, right?
colordrops 11 hours ago [-]
well duh
bibhashBFP 5 hours ago [-]
[flagged]
bibhashBFP 5 hours ago [-]
[flagged]
GreenLightGo 9 hours ago [-]
[dead]
hulitu 8 hours ago [-]
> Telegram Desktop vulnerability allowed any user's file to be stolen
Wait till they find out about web browsers. /s
bashtoni 12 hours ago [-]
Russian social media app has backdoor. Who would have thought?
Wow, that's pretty bad, but imagine if 50% of software allowed this to happen at any time, and it was discovered on December 1st, 2026. What would happen?
“Any sufficiently complex input format is indistinguishable from bytecode; the code receiving it is indistinguishable from a vir- tual machine.”
I don't want my computer to always be as closed and restrictive as an iPhone. That's good sometimes and perfect for some users, but not for everyone or all the time.
If the OS vendors are motivated to harvest peoples data, why on Earth would they be motivated to make sure nobody can harvest peoples data?
The web experience is actually better, as eg there I can do web searches when right clicking sth with my default search engine without slack highjacking the options to force me onto google.
Except when you want actual end-to-end encryption, in which case web versions fundamentally cannot guarantee it today (and there are no plans to get there).
People using Telegram don't care so much about end-to-end encryption, so there maybe it makes sense to use the web version indeed.
Of course it's not black or white, security is a gradient. But if you want to check today that you are running the legit client of ProtonMail in your browser, you do not have a practical way to do it. It is theoretically feasible, I guess (?), but far from practical. But I can walk you through the steps needed to do it today with Signal, for instance.
I think I put my limit there: it's not enough to run cryptography. Verifying the client has to be practical for the user. The way ProtonMail works in the browser is a nice way for Proton to minimise the data they collect, but it's not E2EE, because even as an advanced user I cannot practically verify the client they serve me. In other words, E2EE means (to me) that there can be some kind of guarantee if you put a reasonable amount of effort into verifying it. The browser doesn't provide that at all.
Interestingly, shipping a webapp in ElectronJS (which is terrible in terms of software, IMO) is different: you can have E2EE in an ElectronJS app.
And I'm assuming that's why Signal has a Desktop app (which I believe is ElectronJS) and not a web (as in, "loads in the browser") version.
What you can’t do is make sure the server giving you the code that does the encryption doesn’t change it out with code that also sends your secret messages to Siberia. Unless you control the server giving you the web page. And you trust DNS.
At that point your trust model is simpler with an auditable local application. It could even be an Electron app - so almost exactly doing E2EE in the ‘browser’.
If your thought is just "disable automatic updates", there's no reason you couldn't do the same by declining new versions of a web app. Unless you built it yourself (as a web app or native app), you need to include the servers and DNS in your trust model.
To me, it seems entirely isomorphic. The only material difference I see is whether automatic updates are on by default (an OS/browser vendor issue, not anything inherent to the tech).
It's not, I don't think so. For instance, if you install Signal on your Android, the apk was signed by Signal, sent to Google and distributed by Google. Google cannot modify it, because Signal has to sign it. So in order to make you install a "malevolent" version of Signal, Google has to collude with Signal.
Of course you can download and install the apk from Signal's website, in which case Signal may give you personally a malevolent version. But you can easily compare that file to someone else's. On Android there are verifier apps that allow you to check that.
Finally if E2EE does matter a lot to you, you can compile Signal yourself from the sources, and even go as far as auditing those sources yourself.
You don't get to do any of that on the web. When you load ProtonMail in your browser, you don't have any practical way to verify that the code your browser is running is the same as everybody else who is running it around that time. You have to trust Proton that they give you code that prevents them from reading your emails. It is better than nothing or course, but it still means that you have to trust Proton.
Mostly. But the alternative shouldn't be a native app that updates itself, but rather a native app that is updated by a package manager. The big difference is traceability and auditability: With a trusted package manager (and even in good app stores) the company can only decide to push an update to everyone or to no-one. There is no way to push an update just to the pesky journalist or whistle blower. A covert attack is really hard to accomplish this way.
* The cryptography must be sound. That's the obvious one, if it's not encrypted then it's not "end-to-end" encrypted.
* There must be a practical way for the user to "verify" (with some definition of verifying) the client they are running.
A web browser doesn't provide that at all. It does not mean that everything else provides it: there are many ways to provide a Desktop app that break E2EE, but that is a different discussion. My point is that fundamentally, the web browser does not provide that. It's not that the laws of physics prevent it, it's just that the web browser never chose to provide that.
Yes, this exactly. If we wanted ‘verifiable’ app distribution via browser, then we’d need browsers to implement some way to cross check the code downloaded vs a publicly published list somewhere - similar to certificate transparency or what WhatsApp is trying to do with an extension [1]. Without that, web apps are left working with a weaker threat model.
[1] https://engineering.fb.com/2022/03/10/security/code-verify
App updates can be cryptographically signed with a key that’s kept offline and only held by a few people. Your trust in the app can be equal to your trust in those people, multiplied by your trust in the technology that keeps those offline keys safe from compromise.
Your trust in a web app will be equal to your trust in the people running the server multiplied by your trust that the server isn’t compromised. Since the server is necessarily always online, that trust will be much lower.
If you download an install a program on your OS, you can e.g. check the hash of that downloaded archive and compare it to others, ideally making sure that you are running an audited version of the program. You don't have that guarantee when loading code in a browser: the server could totally serve you a modified version of the code, and you don't have a practical way to check that. Not that the laws of physics prevent it; it's just not how a browser works.
I'm going to go out on a limb and say that it is on purpose, and not a good purpose. The trust model of the web is fundamentally broken.
IMHO, the web should be to load websites (obviously) and small webapps that don't require E2EE or any kind of auditing. As soon as those are desirable, it shouldn't be a webapp anymore.
I find it nice to be able to load websites in my browser, instead of installing one program per website.
But sometimes I want a program.
It gets buttoned up fast and is always getting better, but its absolutely not a silver bullet.
https://news.ycombinator.com/item?id=12463338
Not to mention that Dropbox has never been E2E protected and had that Lenovo credential free access bug on web not too long ago.
Dropbox should be considered untrustworthy at this point, especially since iCloud Drive offers E2E encryption and so do other competitors.
> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple).
Not sure how that partitions the files on disk though, would probably need some code changes to work with some kind of firejail setup.
This is seamless on Qubes OS: You just click a link and a new empty VM with Firefox opens. You close the browser, and the VM is destroyed. Can't recommend it enough.
By the way, they don't have just one web apps. They have A, they have K, and apparently a Z – subdomain is webz, or maybe that's actaully A. Not sure.
I used to use Cookie Auto Delete for years. But when I last checked it seemed unmaintained. I log out of all somewhat important services anyway every time I am done.
For important stuff like banking I use Firefox containers.
Yeah, all of them could have their weaknesses and vulnerabilities. I just hope no attacker hits exactly the stack I use...
Seems like many people do this when it comes to russian tech. Im American and I certainly trust my data in the hands of a foriegn government/entity (which is not even the case for telegram), than my own. Even if it was a russian op (its not the Ukrainian military literally used telegram for years), the russian government cant touch me.
Lots of people follow channels for on the ground news reporting, especially since it's not censored or "advertiser friendly" like social media companies are incentivised to be.
My Bible study class has grown enough that standard SMS/MMS group texts are hitting up against Verizon's carrier limit (I think we have only two people who use Verizon), and RCS isn't an option. Telegram wasn't my first choice, but it was a lot easier for everyone, and it supports tablets out-of-the-box.
Anyhow, people don't write off Telegram because it's Russian, but for many legitimate reasons.
There are indications that it could be much closer to the Russian government than they pretend, but that matters not because Russians are bad people, but because the current government of Russia is an aggressive dictatorship.
The Ukrainian military literally used Telegram for years and now literally banned it.
Maybe in part for this Ukrainian article: https://texty.org.ua/articles/112347/eight-signsof-danger-te...
Even assuming they are fully legitimate today, if this ever changes and somebody gets access to their infrastructure, they immediately get a treasure trove of historical messages.
> There are indications that it could be much closer to the Russian government than they pretend
Can you give more details, please? I'm using telegram a lot and want to know if there is something...
one long time Firefox contributor have been for a couple years now removing every part of the --noremote option. even botching (Ooops!) the console notice that the flag was no-op some time ago.
What's this now? I'm using that to handle multiple profiles and haven't noticed anything breaking
Telegram wanting to be single instance means that it has to use some serialization, and it not escaping semicolons enables a part of the attack.
And if you open a Telegram link it will open in the existing instance.
Windows uri handlers actually always create a new process, though; so if you want this single instance behavior, you have to do some check at the start of the process and communicate the uri to the previously running process (as explained in the article).
You wouldn't ignore a zero-day announcement either because the formatting is ugly.
I did skim over the important bits though.
No, it's definitely a Telegram specific vulnerability. It might be worse because of poor defense in depth, but without Telegram itself being vulnerable it wouldn't matter.
Does Telegram do that, or do they consider themselves beyond bugs, just like they consider themselves too clever and untouchable by anyone to need end-to-end encryption?
not true on macos.
So how will you spam all the group chats you're on with meme gifs downloaded from facebook then? :)
The file-manger application managed above is a single point of failure, of course. So, it should be allowed to use only one provided by OS vendor.
There is a lot of middle ground, like having a shared folder for access. "Downloads" might be a good default, if clearly communicated, that anything in there, is accessible by any app.
Uhm, OpenBSD would like a word, buddy.
https://man.openbsd.org/unveil
[1]: https://github.com/containers/bubblewrap#usage
[2]: https://man.archlinux.org/man/bwrap.1
[3]: https://wiki.archlinux.org/title/Bubblewrap#Usage_examples
[4]: https://wiki.archlinux.org/title/Bubblewrap/Examples#p7zip
Not all user processes upload those files somewhere surreptitiously.
Of course operating systems should support that isolation (hopefully in some better way than the hell that smartphones are), but it's not like Telegram can blame the OS for this vulnerability.
Only if you have access to full source code, can audit it (including each update) and somehow can prove that it has no vulnerabilities. Otherwise one should assume that any application is potentially-harmful and/or vulnerable.
Reported 25 June
Fixed 16 September
I wonder why it took them so long?
Like any number of articles like this: https://hackernoon.com/7-reason-why-telegram-is-insecure-by-...
And yes, I know that by default chats are not E2E, that phone number has way too many effects on accounts etc. Still, UX and agencies interested in important people are more welcome than data selling, ad-based companies.
And what UX problems exactly is Telegram solving that its many competitors aren’t? I hear this all the time, but I use both Telegram and WhatsApp and I haven’t found anything lacking in the latter, UX wise.
I'm sorry if I'll sound condescending, but you probably don't use either frequently enough. With telegram it's the little (and sometimes not so little) things, e.g.:
All of the above does not excuse lack of e2e by default, this is almost embarrassing in 2026 now, but Telegram is the most polished IM experience of all the apps I have tried.Bot access is definitely better in Telegram; that’s what I sometimes use it for.
WhatsApp has voice message transcription now, but fortunately I don’t receive many. (I consider it pretty rude to put the effort of messaging on the recipient because the sender can’t be bothered to type or transcribe on their side.)
Everything else you mentioned is a minor inconvenience to me. Knowing the provider can’t mine my message data more than makes up for that.
Yeah same can be said for Facebook and WhatsApp that Durov vehemently claims should not be trusted with user's data. Maybe it's a ploy for the Mark Zuckerberg of Russia to get the data of people.
Also, Telegram doesn't have to sell it's users if it's an FSB honeypot.
A file exfiltration vulnerability is still noteworthy.
The Most Backdoor-Looking Bug I’ve Ever Seen - https://words.filippo.io/telegram-ecdh/
It mainly competes against facebook and other social media plattforms. The privacy is clearly wrong and only believed by non technical people (which can be amusing, when on TG someone posts a link to FB, or a WhatsApp group and people chime in and lecturing others that they should not use that as it is insecure and owned by a big company who will sell them out).
This aspect is also not highlighted much in the article, which weirdly mostly focuses on the account takeover.
To me it seems something remarkable enough to warrant reposting the link with a different title.
Somewhat astonishingly, the core of the vulnerability comes from an internal url scheme added to Telegram to... help them publish their releases on their channel.
The Telegram developers saw no better way to do that than adding an internal tool which uploads any file it's told to.
Everyone else publishing their app on Telegram is able to do that with a script, but they had to do it that way.
It's true that it was exploitable only in a somewhat convoluted way, but still, it's an obviously dangerous feature.
Anyhow, yes, clicking on a link in Telegram Desktop was enough to have any user's file exfiltrated and to access or take over their account.
[1] https://github.com/marcovelon/tdesktop/blob/NoSecretChats/RE...
Last I checked, that's exactly how Telegram works by default. It's laughable to consider a service tied to a phone number secure.
That still means you have to check it every 7 days.
technically, this is one agency burning the feature of another agency.
Wait till they find out about web browsers. /s
(Yes, I know they're technically Dubai based now)