security problem

[libora]

Hi, file "config" in folder "tdata" contains the login information and password for proxy in an unencrypted form. It can be very big safety problem especialy for portable version!

[telegramdesktop]

We can't encrypt this data in such way, that no one will have access to it, as long as we don't use password-protected launch of the application. But we can still encrypt it with some generated and saved key, so that it won't be plain text. Is that what you are talking about?

[sullivanmatt]

You might be able to leverage the Windows CryptoAPI to have it store the credentials on the application's behalf.

[libora]

Yes, that's the way, do not use a plain text. Generated key would be unique
for each instance of application.
Dne 4. 6. 2014 21:10 "telegramdesktop" notifications@github.com napsal(a):

We can't encrypt this data in such way, that no one will have access to
it, as long as we don't use password-protected launch of the application.
But we can still encrypt it with some generated and saved key, so that it
won't be plain text. Is that what you are talking about?

—
Reply to this email directly or view it on GitHub
#13 (comment)
.

[edmundlaugasson]

There is some discussion about Telegram security issues and also one master thesis from September 2015 available talking about Telegram protocol security issues. It would be good if Telegram would rely on proven free and open-source encryption protocol(s) and not reinvent the wheel. There are some competitive alternatives, e.g. Zyptonite, Wire, Tox, etc. It would be good to see comparison table about security features these programs have and compared with Telegram Desktop. Here is one secure messaging comparison table - unfortunately looks like Telegram isn't the securest one.... There is yet another interesting solution - Maidsafe. I really hope that Telegram Desktop will benefit from all of them and offer really secure solution (preferally built-in).

[edmundlaugasson]

One more idea regarding secret chat - using telegram.me mechanism I would propose to make possible to create link which will directly start secret chat. E.g. https://telegram.me/secret/YourUsernameHere

[john-preston]

Proxy settings are encrypted for a long time now.

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.