Privacy

32159 readers

485 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

[email protected]

189

Telegram is still leaking user IP addresses to contacts (techcrunch.com)

submitted 1 year ago by [email protected] to c/[email protected]

15 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 74 points 1 year ago (3 children)

Is it a leak if it's a necessary technical part to a functionality?

The main issue is that it's not obvious to non-technical users. They can't asses what sharing IP address means either though.

The reason Telegram leaks a user’s IP addresses during a call is that, by default, Telegram uses a peer-to-peer connection between callers “for better quality and reduced latency,” Telegram spokesperson Remi Vaughn told TechCrunch.

“The downside of this is that it necessitates that both sides know the IP address of the other (since it is a direct connection). Unlike on other messengers, calls from those who are not your contact list will be routed through Telegram’s servers to obscure that,” Vaughn said.

To avoid leaking your IP address, you have to go to Telegram’s Settings > Privacy and Security > Calls, and then select “Never” in the Peer-to-Peer menu, as shown below.

Telegram defaults to using p2p for calls, for contacts only.

It's not a thorough privacy default, but otherwise seems fine to me. If you want p2p it needs to be enabled, and if you don't it needs to be disabled. No-contacts and no-calls receive no IP.

[–] [email protected] 23 points 1 year ago (2 children)

Here's a professional security researcher/pentester explaining in depth why "leaking" IP is blown out of proportion

The relevant gist is

The information is usually not identifying beyond general geographic regions (at best)
if your threat model is that strict, there are other ways you should be obfuscating your IP than relying on VPNs, ISPs, and the apps/servers you're accessing/using.

[–] [email protected] 3 points 1 year ago

Usually it is the town, or nearby town. If you live in a more rural area that can narrow it down to a few hundred people.

Also in some less-developed countries the data protection by ISPs is very weak. Basically if you know someone in the police (or pay a bit under the table) you can easy get the exact name and address of the account owner if you have an IP.

[–] [email protected] 3 points 1 year ago

Here is an alternative Piped link(s):

Here's a professional security researcher/pentester explaining in depth why "leaking" IP is blown out of proportion

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.

[–] [email protected] 7 points 1 year ago

I agree. This requires the user to actually save the attacker phone number as contact in order for this the IP address to “leak”

There’s still a chance that your contacts would have been hacked, and one could be vulnerable. But it all comes back to your risk profile. If you require hiding your IP address, you should turn this off or even use a VPN for all your traffic.