3 ms·
Telegram uses it's own custom MTProto protocol. Although the traffic is encrypted, it is identifiable as Telegram traffic (fixed structure, identifiable prefix
by partyfaker 8y ago
Telegram uses it's own custom MTProto protocol.
Although the traffic is encrypted, it is identifiable as Telegram traffic (fixed structure, identifiable prefix for packets).
There's an outcry for them to use TLS but I didn't see that they said anything about that.
Here's a nice article for more info:
https://blog.susanka.eu/how-telegram-obfuscates-its-mtproto-traffic/ https://blog.susanka.eu/how-telegram-obfuscates-its-mtproto-...
- aaomidi 8y agoIt's not like TLS would've fixed this. Iran is blocking Telegram very easily. If they also used anything with TLS 1.3 or HTTPS with TLS 1.2, the plaintext SNI would've been enough to detect Telegram.
- lucb1e 8y agoWait, didn't TLS 1.3 have encrypted SNI? I haven't yet read up on the details but iirc that was one of the major new things.
- kardos 8y agoUnfortunately no, but there is an RFC [1] in the works for the more distant future [1] https://tools.ietf.org/html/draft-rescorla-tls-esni-00 https://tools.ietf.org/html/draft-rescorla-tls-esni-00
- codedokode 8y agoThe MTProto traffic (which can be detected by signature) is wrapped into an obfuscation layer by some clients (including the official one). This layer makes packet look like random bytes. Earlier it has a flaw making all packets the same length and some ISPs started blocking packets by length by later it was fixed. This my comment contains more links about protocol and obfuscation: https://news.ycombinator.com/item?id=17888241 https://news.ycombinator.com/item?id=17888241