This is precisely a breach of Telegram, they are essentially sending auth keys to the adversary when the adversary asks them too. New devices should only be au

This is precisely a breach of Telegram, they are essentially sending auth keys to the adversary when the adversary asks them too. New devices should only be authorised with the use of an authentication token from an existing client device; one needs to decide if the new device should have access to old messages. Ideally it would be clear to all parties as to which devices and identities have joined a chat.