24 ms·

How Telegram Messenger circumvents Google Translate's API

392 points by decrypt 5y ago

deleted 5y ago
[deleted]
drath 5y ago
On one hand, it's quite asshole-ish. On the other, google is serving broken frontends to their services and charge ridiculous prices on their API's. When I tried to make a third party search using google engine, I've exhausted the limit in less than an hour. It'd cost me like $40/mo to get what I get for free using their crappy frontend.
- typingmonkey 5y ago
  Like telegram did with the translate api, there is also a way to have an unlimited api for search results. You have to find one of the old mobile pages of google.
- PragmaticPulp 5y ago
  > On the other, google is serving broken frontends to their services and charge ridiculous prices on their API's. How does that make this okay? Nobody is entitled to get a company’s services for free just because you think their price is too high or their front ends aren’t built to your liking.
  - rebolek 5y ago
    Google isn't entitled to get my personal data for free to, yet they do it anyway.
  - tyingq 5y ago
    You could use the "turnabout is fair play argument". If you publish a web page, and don't specifically block google, they scrape your content, and use it for their own purposes. And even use it for "rich snippets", products other than search, etc. You're basically doing the same to them...using their content for your own purposes until they specifically block you.
    - PragmaticPulp 5y ago
      Disagree. The web is clearly architected such that publishing a webpage makes it public and crawlable. You don’t “block Google”, you specify that the site is not for crawling in robots.txt according to well-known standards. This is all basically the contract of the internet and it shouldn’t be surprising to anyone. Google specifically does not publish their API for free consumption by other companies, yet that’s what’s happening here anyway. The company is also using specific tricks to circumvent detection of the behavior. In your analogy, this would be like a crawler ignoring robots.txt and then scraping the content for their own website with zero attribution to the source, which is nothing like Google indexing your site with full attribution and driving traffic to it for you. Regardless, “turnabout is fair play” is unequivocally not a legally or even ethically acceptable standard, so that argument wouldn’t actually hold up anywhere anyway.
      - tyingq 5y ago
        "driving traffic to it for you." I did mention rich snippets.
      - inportb 5y ago
        > this would be like a crawler ignoring robots.txt Google ignores the noindex directive in robots.txt now. You're supposed to put it in your HTTP response headers or HTML meta tags...
        ldjb 5y ago
        `noindex` was a Google-specific rule that was never officially documented nor supported. I think they were perfectly entitled to withdraw support for it, especially considering there are alternatives. https://developers.google.com/search/blog/2019/07/a-note-on-unsupported-rules-in-robotstxt https://developers.google.com/search/blog/2019/07/a-note-on-...
      - tshaddox 5y ago
        I don’t understand your argument. There is no actual “publishing” of web sites or APIs on the web. You simply make something available at a URL, and it’s up to anyone else to discover that URL. In this regard, your personal web site is no different than this Google Translate web API.
  - agentdrtran 5y ago
    "Nobody is entitled to get a company’s services for free just because you think their price is too high or their front ends aren’t built to your liking." Tell this to Google!
ckastner 5y ago
I think it's possible construct to construct a (very weak) argument for the random user agent rotation, but why split the spring if not to avoid being flagged. On the other hand, I find it hard to believe that Telegram would risk a Play Store ToS violation, given how many tens of millions of users use the app.
- wccrawford 5y ago
  Isn't Google going to move to always having the user agent be the same anyhow? They've already decided to break that contract with the tech community, so I don't see that they have much room to talk there.
  - dmurray 5y ago
    That contract was torn up a long time ago. Or do you really browse the web with "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"?
- vesinisa 5y ago
  Pretty sure at the point you have over a billion(!) installs, even Google affords some leniency towards its Play Store policies. Or at least we are about to find out anyway.. Meanwhile, indie developers with smaller user base are subject to unappealable automated decisions.
- lima 5y ago
  Telegram is well-known for operating in grey areas.
- Bombthecat 5y ago
  Would deepl cheaper?
- arihant 5y ago
  I'm not sure if Google will start flagging the IP addresses of the users because of each request having a different agent. That would render normal Translate unworkable for them too!
88840-8855 5y ago
Another useful feature, interesting article to look how it works under the hood. And again, i wonder how a tiny team can push such great and useful features into such amazing UI. And then I'm looking at other alternatives, from naked WhatsApp over laggy wechat to horrible UX in signal. What's the reason for telegram amazing performance and features?
- iqanq 5y ago
  >What's the reason for telegram amazing performance and features? Wouldn't a better question be "what's the reason for other apps having crappy performance and subpar features"?
  - pjerem 5y ago
    Telegram is pretty impressive when you take into account the number of (well implemented) features that they managed to shove in the app without breaking ergonomics and performance. At this point, I just think the answer is top notch developers and designers with an impressive alignment about what the product should be. I know no other free application with such an amazing usability. There must be some shitload of money behind them, for sure.
    - iqanq 5y ago
      I think it's the result of every one of the clients (desktop, android, ios) having only one developer each.
    - BlueTemplar 5y ago
      Discord ?
      - sorenjan 5y ago
        Does Discord have a native (not Electron) desktop app?
        5y ago
ssl232 5y ago
I guess, given its popularity, Google won't kick Telegram off the store for obfuscating the URL and using an unauthorised (?) API endpoint but I imagine this will get them in some sort of trouble.
- littlecranky67 5y ago
  I think they could do it. In Germany, Telegram is often cited by media as a platform for (illegal) right-wing, antivax and hatespeech. Some politicians openly demand to go ofter Telegram and/or block it. So google could kill two birds with one stone here. At least remove it from the Play Store in some countries.
  - kaladin-jasnah 5y ago
    I believe it is the same in the US. Although at the same time half my friends use it at our (critical) communication platform. So it's not in our best interests.
    - littlecranky67 5y ago
      Telegram is basically opposed to any kind of censorship which is IMHO a good thing. Western politicians are outraged as hatespeech, murder threats, right-wing paroles etc. are openly distributed through Telegram and demand regulation/takedown. At the same time, when protesters in Belarus or HongKong use Telgram to coordinate and those Governments demand takedown, the West screams oppression and demands freedom of speech. In general I am pro Telegram, as I think any democracy needs to have censorship-free communication for whistleblowers etc. and to prevent attacks against democracy itself. Even if this means we have to live with stupid/illegal opinions being expressed too.
- robby_w_g 5y ago
  > I imagine this will get them in some sort of trouble. I'm not sure about this. I bet Google is happy to collect the text data of up to 500 million users with zero restrictions from Telegram's end on how the data is used. I'm not a lawyer, but my hunch is that Google's data privacy policy applies to the official, premium service: https://cloud.google.com/terms/data-processing-terms https://cloud.google.com/terms/data-processing-terms Google might make the determination that they'll get more value from allowing Telegram to abuse the unofficial API. However, they might face some angry customers who are paying a premium to use the official API now that this loophole has been published.
malf 5y ago
Is this an option for encrypted chats as well? Is there a warning that the content gets sent to Google?
- aquatica 5y ago
  Yes. https://imgur.com/a/7UIFLxT https://imgur.com/a/7UIFLxT
kedmi 5y ago
It's smart. It allows Telegram users to hide in plain-sight, within the noise of other Google Translate web users. I'm pretty sure that using the official pre-built java SDK, as suggested by the author, would allow Google to cluster the content of Telegram users (since app-specific id/token should be sent). Other than that, a great read and kudos to the author for shedding light on it. Edit: typo.
- giomasce 5y ago
  It doesn't look very well hidden if there are blog posts about it...
  - OJFord 5y ago
    The users are hiding among all the web traffic to translate.google.tld; not that that Telegram's doing this is top secret undiscoverable magic sauce. It's open source (GPL2): https://github.com/DrKLO/Telegram/blob/9e740dfd4d2b1ab6b8ed2b972e0f72fc9b8bd09d/TMessagesProj/src/main/java/org/telegram/ui/Components/TranslateAlert.java#L1089-L1094 https://github.com/DrKLO/Telegram/blob/9e740dfd4d2b1ab6b8ed2...
- xg15 5y ago
  I think Google can still cluster Telegram users pretty easily, especially now that that the method is in the open. Yes, Telegram fakes the user-agent, but the rest of the request still looks very different from a request an actual browser would do. (No referrer, missing headers, different connection pooling behaviour, possibly different TLS and HTTP2 behaviour, etc). So if Google is doing any detection for browser vs non-browser requests, those requests should show up as suspicious.
  - nothasan 5y ago
    If they used cronet, they could get past these checks.
- michaelmcmillan 5y ago
  A rotated user agent does not hide anything from Google.
deleted 5y ago
[deleted]
einpoklum 5y ago
I wonder how useful this, considering how Telegram conversations are unencrypted by default. If they were to change this default, now _that_ would be something.
barnabee 5y ago
Someone deleted an interesting comment about adversarial interoperability [0] I’d love to see and give money to a project to create and maintain easy to use and stable “adversarial interoperability” APIs for as many services and products as possible. Perhaps companies and projects would not often use these directly because of the risks (hopefully some would, though!) but individuals could drop the library or the URL to a server hosting it into their apps to gain extra features. If standardised, whole open source apps could be built around them that allow querying and analysis of data from services and aggregating and automating using the services including optimising prices, taking advantage of offers, and using undocumented APIs to the users advantage. Maybe something architected and incentivised like https://thegraph.com/ https://thegraph.com/ for adversarial intercom and undocumented APIs. Building as a network of nodes and funding with crypto would make it harder to attack and take down. [0] https://www.eff.org/deeplinks/2019/10/adversarial-interoperability https://www.eff.org/deeplinks/2019/10/adversarial-interopera...
- novok 5y ago
  I think https://plaid.com https://plaid.com 's entire business is pretty much an adversarial interoperability webscraping play for banking. The business exists!
- sdeframond 5y ago
  Do you know Woob ? https://woob.tech/ https://woob.tech/
  - _xnmw 5y ago
    Holy s*t this is amazing! A set of web-scraper automations!
  - danpetrov 5y ago
    Wow that is really cool!
  - deleted 5y ago
    [deleted]
  - 5y ago
jlelse 5y ago
On iOS Telegram uses a system API, but on Android they seem to try to avoid the high Google Cloud fees: https://jlelse.blog/posts/telegram-translation https://jlelse.blog/posts/telegram-translation
- Gigachad 5y ago
  Is iOS using that local translation app added in iOS 14?
  - marcellus23 5y ago
    Looks like it, but it’s still an undocumented private API they’re using.
rossmohax 5y ago
Telegram should have disclosed that every time someone uses this feature, their IP address is leaked to Google.
- fault1 5y ago
  I think they already do: https://imgur.com/a/7UIFLxT https://imgur.com/a/7UIFLxT Well, the plain text, not the IP, but that should be implicit with how web services work.
  - themacguffinman 5y ago
    I wouldn't say it's obvious to either laymen or technical users, some apps will proxy a web service for the exact reason of hiding user info.
- deleted 5y ago
  [deleted]
- Gigachad 5y ago
  Telegram includes google services baked in to the app for things like maps.
  - ju-st 5y ago
    There is a Telegram-FOSS fork with most Google services removed but the translation feature is not removed (yet?) in the code.
- Anunayj 5y ago
  also the content of the translated message is leaked in plain text too?
  - whimsicalism 5y ago
    That is disclosed
- bencollier49 5y ago
aenis 5y ago
This can't work for long. Translate is a profit center for google, and this also shows others that they can disregard google's monetization model for translate. Commercial use of those APIs is common, despite translate being pretty expensive. Also, GCP current leadership is so hell bent on nickel-and-diming their customers, and their compensation packages are so dependent on value share growth, that they simply can't afford anyone openly violating their pricing models. Especially a popular app. My guess is this will be down within the first week of January.
- hdjjhhvvhga 5y ago
  I'm curious what techniques they will use to differentiate between Telegram and non-Telegram users. If I were them, I'd simply use my power leverage and threaten them to remove the app from the Play store unless they remove/fix the offending code - it's much simpler than an eternal mouse-and-cat game, with possible collateral damage.
  - michaelt 5y ago
    Given that Google runs ReCapcha - which is almost certainly the world's most widely used browser fingerprinting system - they have ample experience with is-it-a-real-browser cat and mouse games.
    - iqanq 5y ago
      In fact if you use this API constantly, you are presented with a recaptcha.
      - rfoo 5y ago
        In this case, Telegram may just display the captcha and let the user solve it. That's likely also why Telegram doesn't proxy every translation request over their server: so that it is users individually requesting small number of translations, from their phone, getting around quota of free APIs "naturally".
      - 5y ago
01acheru 5y ago
I used something like this years past for image resizing, the URL was: https://images1-focus-opensocial.googleusercontent.com/gadgets/proxy https://images1-focus-opensocial.googleusercontent.com/gadge... It is now blocked, always responds 403, maybe tweaking some request parameters can make it work again. Edit: if you want to try it out the parameters I used were: - container: focus (there are other values I cannot find anymore) - url: urlencoded URL of the image to be resized - resize_w: width in px - resize_h: height in px
- tyingq 5y ago
  It still works, just not with a direct url. It's checking that there's a referrer, I think. So that it only works if the image is in a web page: https://jsfiddle.net/depxb0gn/2/ https://jsfiddle.net/depxb0gn/2/
Namidairo 5y ago
I remember seeing the aforementioned API endpoint being used a while ago for some automatic chat translation. From what I remember, there was some minor rate-limiting that I hit once or twice while using it, which complicated things a little.
homami 5y ago
Off topic, but this is a code smell for me: [(int) Math.round(Math.random() * (userAgents.length - 1))]); This leads to a lower probability of selecting the 0th and the last items in the array.
- namdnay 5y ago
  It should be floor right? Math.floor(Math.random()*userAgents.length)
  - lern_too_spel 5y ago
    There's a built-in method for randomly selecting an int in a range. Use that.
    - csears 5y ago
      Are you thinking of the Lodash random() function? Or Crypto.getRandomValues()?
      - lern_too_spel 5y ago
        https://docs.oracle.com/javase/8/docs/api/java/util/Random.html#nextInt-int- https://docs.oracle.com/javase/8/docs/api/java/util/Random.h...
  - homami 5y ago
    Yeah. > The java.lang.Math.random() method returns a pseudorandom double type number greater than or equal to 0.0 and less than 1.0.
  - lern_too_spel 5y ago
    floor is unnecessary. The cast does it for you. The problem is that a random double is not going to be evenly distributed into length equal parts unless length is a power of 2.
morelish 5y ago
Quite a lot of libraries exist to do this. But doing this in an app with a large user base looks offensive. Solution would be for some decent open source translation APIs to appear.
- whimsicalism 5y ago
  There are plenty of open source, decent translation APIs, the catch being that obviously nobody is going to pay for your translation compute.
  - morelish 5y ago
    Any ideas which ones are the best? I would quite like to use a good open-source api, am happy to pay for my own compute. (I've just used googles before because it was handy. But I wouldn't use it the way telegram have done.)
    - MiroF 5y ago
      It depends if you have pretrained models or not. Huggingface offers a few models that are pre-trained [0], OpenNMT is a good framework [1] as is MarianMT [2]. Many of the best MarianMT models have been ported to HuggingFace. If you don't want to self host, huggingface offers these APIs at a cost. [0]: https://huggingface.co/models?pipeline_tag=translation https://huggingface.co/models?pipeline_tag=translation [1]: https://opennmt.net/ https://opennmt.net/ [2]: https://marian-nmt.github.io/ https://marian-nmt.github.io/
polote 5y ago
Is there any proof in this post that Telegram actually circumvent Google Translate API ? Because it is also possible that Google told Telegram to use the method explained in the article.
- user-the-name 5y ago
  That is not how Google works.
  - aenis 5y ago
    Yup. And those guys will get bonus points for actively evading detection. IANAL, but its one thing to use an open api and claim ignorance, and quite another to intentionally defeat access restrictions/rate limits. Stupid thing to do.
- jmnicolas 5y ago
  Why would they concatenate the API url string then? The only reason I see is to avoid detection when their app is scanned when submitted to the PlayStore.
leodriesch 5y ago
I don’t understand the way this was implemented. They are bound to get in trouble with Google for this, but they can’t easily pull the feature. They can’t just be like „oh you’ve had translate for two weeks now, but now we can’t pay for it, so it’s gone.“ What is the long term thinking behind this? Or is this just developers and management not communicating?
- zenexer 5y ago
  “Google cut us off—they’re the bad guys, not us. Blame them.” …but with more elegant phrasing.
  - sgjohnson 5y ago
    s/elegant phrasing/corporate doublespeak blah blah blah on 31st of February 1970 Google unanimously decided to terminate our access to their Translate API blah blah blah blah
    - skinkestek 5y ago
      This is Telegram. They are actually known for elegant phrasing, not corporate doublespeak.
    - zenexer 5y ago
      Telegram knows how to play the PR game. It’s going to be a bit more elegant than that, with a “we will rise from the ashes” tone. They know what they’re doing, and I doubt they had any intention of getting away with this.
- simias 5y ago
  Yeah I'm a bit shocked honestly that it made it into an application as widely used as Telegram. It's bound to be detected eventually and the feature will suddenly break. Such a strange software engineering decision. They can't even plausibly pretend that they didn't know and it's all a big misunderstanding given the lengths they went to obfuscate it in the code.
- 5y ago
oefrha 5y ago
This reminds me of my own usage of Google Translate's speech synthesis API in a chat bot way back. It was as easy as sending a GET request to https://translate.google.com/translate_tts https://translate.google.com/translate_tts. People loved it. Of course, my use case was neither commercial nor large scale.
cj 5y ago
As a small company who spends $70-80k per year on Google's official Translate API, it's disappointing if Google allows this type of abuse to continue. If they don't want to pay, they should be using a free open source alternative like https://github.com/LibreTranslate/LibreTranslate https://github.com/LibreTranslate/LibreTranslate
- charcircuit 5y ago
  Not everyone can afford to use these APIs or are able to get permission to use the external APIs. The internal APIs are very good for people who don't mind taking the risk of using a potentially unstable API.
  - HatchedLake721 5y ago
    Then don’t run a business with services you can’t afford?
    - charcircuit 5y ago
      But using internal APIs are free. I can afford to use them since I don't mind having to update my usage of them / work around rate limiting.
      - IX-103 5y ago
        Do you also only eat free samples from the grocery store?
        jokethrowaway 5y ago
        Those are usually rate limited. I'd recommend pizza and beer at tech events instead (albeit the nutritional content of your diet could be more important than free food).
        Const-me 5y ago
        Which part of https://translate.google.com/ https://translate.google.com/ web page says the service provided by the page is a free sample of commercially available API?
taubek 5y ago
I see few possible issues: 1) If this is some kind of hack to reduce the cost this means that Google can pull the plug to this at any given time 2) How many users are aware that this means that the content is sent to Google? Yes, there is a warning on the screen where you turn one the option but will the users see it?
ozten 5y ago
This is an interesting data point for folks designing demo pages. The API was discovered by playing with the demo page [1] according to a link from a link in the article [1] https://weblog.west-wind.com/posts/2011/aug/06/translating-with-google-translate-without-api-and-c-code https://weblog.west-wind.com/posts/2011/aug/06/translating-w...
Jerrrry 5y ago
When a dev gets a requirement and no red tape is involved.
bencollier49 5y ago
Using undocumented API features in a commercial product seems a bit fly-by-night to me - doesn't convey the best impression of the company.
- aenis 5y ago
  Yeah, and doing this client side, and with the code open sourced? "Achievement unlocked".
ape4 5y ago
There are bound to be duplicate phrases for translation over all the many Telegram users. Why not cache to avoid API calls. How many times do you have to use the API to translate "OK" or other commonly used words.
littlecranky67 5y ago
Not sure if this is a smart move, especially since they piss off the same company that could remove them from the Play Store in no time.
Markoff 5y ago
why even bother with any API, just implement it on client side as regular browser with regular google translate request through URL like https://translate.google.com/?sl=auto&tl=en&text=hello%20world&op=translate https://translate.google.com/?sl=auto&tl=en&text=hello%20wor...
Const-me 5y ago
Visiting a publicly available web page doesn’t create contractual obligation between end users and web server owners. If Google views what telegram doing as abuse, then how it’s different from what end users are doing while interacting with https://translate.google.com/ https://translate.google.com/ web page? Especially if these end users are running an ad blocker or two in their web browser? BTW, uBlock origin blocked 4 pieces of content on that web page.
- dodobirdlord 5y ago
  Because Telegram has their app in the Play Store, which does require legal agreements, that presumably forbid this sort of thing.
zarzavat 5y ago
The following predictable chain of events will happen. Someone working at Google will read this blog post and report it internally. Google will contact Telegram and inform them that they are violating the Play Store agreement and could they please use the official API instead. Telegram will remove the feature as they can't spend the GDP of the Earth on translations. The end.
- whimsicalism 5y ago
  Don't know why they can't just roll their own... At this point you could probably even do reasonably well on-device.
  - judge2020 5y ago
    I guess this would also be in a legal grey zone/break TOS, but I wonder if they could reuse the offline models the official Google Translate app downloads. > worst case you could just self host a translation service
    - whimsicalism 5y ago
      What? How would this violate ToS? iirc even the Google translate app does on device translation. And worst case you could just self host a translation service. Google's translation is good, but it's not that much better than what you can get OSS. e: Misunderstood your comment (I believe the quote was at the top and you edited), now I see that you were referring to your idea as the potential ToS violation. I agree, you can't violate IP law in your app.
      - judge2020 5y ago
        As in, the translate models are owned by Google and AFAIK they don't allow anyone, even other developers, to use them. It's against ToS to use intellectual property/code/ml models/etc without permission from the owner > 11.2 If You use third-party materials, You represent and warrant that You have the right to distribute the third-party material in the Product. You agree that You will not submit material to Google Play that is subject to third -party Intellectual Property Rights unless You are the owner of such rights or have permission from their rightful owner to submit the material. https://play.google.com/about/developer-distribution-agreement.html#:~:text=11.2%20If%20You,submit%20the%20material https://play.google.com/about/developer-distribution-agreeme....
skinkestek 5y ago
As someone who has often defended Telegram I am somewhat puzzled by this one. While the legal aspects of this might have to be decided by someone more skilled than me I feel they are morally on the same ground as early Google and if Google makes a big case of it it might backfire spectacularly. More interesting is it that Telegram sends user texts directly to Google without any proxying (did I get that right and has the author studied it carefully enough?). This might (again, if this blog post is correct and I read kt correctly) be an actual dangerous move from Telegram. Unlike the problems that many here worry about regarding E2E-encryption, this can potentially drag Telegram down to WhatsApp levels, sending huge amounts of user data straight into Google. Then of course, we'll need to see. Very much of what Telegram has done security wise is very well thought out and has improved over time. Recently for example when I started my backup of one of the groups I participate in I had to confirm from a mobile client or wait 24 hours to start backup. Account recovery is almost automagically simple but has some nifty touches to prevent account hijacking. Settings to delete the account if I fail to log in has existed for years, I wonder if they even did this before Google launched it. So now I am anxious to know if Telegram has done something brilliant again or if this is a turning point.
- judge2020 5y ago
  > without any proxying (did I get that right and has the author studied it carefully enough?). Most likely, since the user-agent rotation code is in the app itself. If it were a Telegram proxy, the proxy would do its own UA and IP hopping and the clients would use their default UAs. At a certain point, I wonder why Google's abuse team don't simply look for 3+ occurrences of User Agent strings because UA rotation is rarely used for legitimate purposes.
  - skinkestek 5y ago
    These days Google isn't up to much on a technical level ;-) They cannot even fix the old verbatim feature that they broke a few years ago, so how should should they be able to stop this without breaking something else? Yep, this is somewhat hyperbolic but I'll write it anyway. I want my old Google back.
yosito 5y ago
I really don't understand this. Is Telegram a legitimate app? If so, then why are they attempting to rip off other companies' work without paying them? You want an integration with a translation API? Then pay a fair price for one, or build your own? If Telegram really can't afford an integration, just make a translate button that opens a link to https://translate.google.com/?sl=es&tl=en&text=API%20de%20traducci%C3%B3n%20para%20pobres https://translate.google.com/?sl=es&tl=en&text=API%20de%20tr... Edit: not to mention the privacy implications of sending messages to Google.
- rfoo 5y ago
  Okay, how about I open an embedded WebView of https://translate.google.com/?text= https://translate.google.com/?text=..., with the viewport carefully set to only show the translation results?
alpineidyll3 5y ago
Bahhh do you want to get captchas? THIS IS HOW YOU GET CAPTCHAS!!!
gregoriol 5y ago
Nobody pays for using Telegram, so why would Telegram pay for using... oh...
mdasen 5y ago
"It's a bold strategy, Cotton. Let's see if it pays off for 'em" Deciding to use the Google Translate API in a way that bypasses Google's API-key system seems like a dangerous game. Google controls your access to the Android platform† and now that this blog post has been published, it seems like Google could remove the app from the Play Store for unauthorized access of Google services. If they'd found a way to use an API from some third party, maybe that third party would try and shut it down or whatnot. In this case, it feels like they're poking the bear - especially given how much traffic they might throw at it. At some point, Google might get annoyed that an API that they charge a lot of money for is being used for free and somewhat legitimately remove Telegram from the Play Store. Google can pretty legitimately claim that the Telegram app was accessing Google's servers in an unauthorized way and that they went through steps to obfuscate their access which shows that they knew what they were doing was wrong and tried to hide it. This seems like a bold move. Google might simply shrug and not care. Google might decide that they'll remove Telegram from the Play Store permanently. Google might decide they'll only allow Telegram in the Play Store if it doesn't have translation features. If Google removes Telegram from the Play Store, that's basically the end of Telegram. As people bought new phones, the number of people reachable on Telegram would dwindle‡. As the app no longer could receive updates, eventually it would become old and stale. They'd have to start moving to another platform whether WhatsApp or Signal or Matrix. †sure, other stores and side-loading exist on Android, but Google does control access for the vast majority of Android users (at least in the US/Europe). ‡yes, maybe one can transfer apps and side-loading does exist, but the number of users would dwindle
- fault1 5y ago
  Personally, I think Telegram has enough reach that removing/blocking it would get a lot of unwanted political attention against Google - I mean, a lot of politicians and decision makers seem to use Telegram depending on the country. So I don't think they would do that. I think they will just figure out how to break this feature.
  - Nextgrid 5y ago
    Telegram is also popular within the crypto circles and those are a lucrative target for advertisers which Google's business relies on. Banning it from Android may shrink that market.
zoomablemind 5y ago
Very questionable decision, rather irresponsible one to all parties involved. I hope this won't devolve into a 'rogue-dev' blame, the company has to own it up. I wonder if an alternative route could be somehow leveraging google's own app. The Translate app is likely already installed on user's platform. So is there a way to send the user's translation requests to the app? It's almost a unix-approach, a tool for a task. Instead of a megatool for all-you-want.
- iggldiggl 5y ago
  > So is there a way to send the user's translation requests to the app? You can, but it naturally kicks you out of your app into the Translate app, so not exactly seamless. It's fine for the occasional one-off translation I guess, but not if you possibly want to completely translate one side of the conversation.
ilrwbwrkhv 5y ago
Nice hackers way of thinking. This is what makes telegram the best.
arihant 5y ago
My guess would be (given the size of that array) that this is done to prevent rate limits rather than cost. It could be that this was advised by Google themselves because they could not provision the correct rate limits due to end of year. It's hard to imagine a client of this size isn't in direct contact with Google Cloud engineers. Pretty sure they're paying for it too. Also, this may have been done just for the open source commit of the project to prevent leaking token? Can't jump to conclusions here. Google does the same thing in Google Pay Indian version. Government mandated that no one app can have more than 25% transaction volume of the country for UPI. So Google partnered with 4 banks, essentially having 4 UPI apps in the eyes of government.
- green-eclipse 5y ago
  I think you're looking at this all wrong. If Telegram did this officially with Google, would they have had to craft this klunky workaround for breaking up RPC strings and randomizing the user agent? I don't think so. Also the Google Pay analogy seems off. Telegram backdooring free access to Google Translate is not at all the same as Google partnering with 4 banks for transaction processing. One is totally unofficial, the other is an actual partnership.
  - arihant 5y ago
    Yes the string split is a very odd. I agree with you there. Very confused that Google can't catch this. It's adding to the same string it should look same in the heap anyway? Simple college plagiarism programs like MOSS will catch this. For Google Pay, what Google is doing is actually not legal. Government wanted each third party (non bank) app to be restricted to 25%. Google will get in trouble when government actually starts cracking down (and when they get close to the 25% mark). We don't know how government is looking at them, because they're under threshold anyway. The legal way for GPay to handle over 25% of total transactions is to register at least as a Payment Bank.
- chagaif 5y ago
  This sounds very reasonable and it's the only comment I found in a see of people talking about how Telegram is doing this illegally. Would be curious to see how this turns out.
emilfihlman 5y ago
These comments are funny. Here's a thought for you, though: Telegram can be used just fine without Google Play Store. If Google blocks this new and cool feature and people like this feature, it only serves to push people into skipping the playstore completely because people are invested in their messaging applications. Now, normalising downloading and installing applications from outside the Play Store is a big red flag to Google. This is possibly the most genious and awesome thing Telegram has done, and imho an excellent play. Either TG gets cool new features easily, or people get freedom and still get cool new features. I'm very interested in how this is going to play out!
- skzv 5y ago
  Telegram already encourages downloading the APK directly: https://telegram.org/android https://telegram.org/android
  - emilfihlman 5y ago
    True, but not in the application.
dandiep 5y ago
One thing I don't see mentioned here is that the Google Cloud version of Translate is actually different than the user-facing one at translate.google.com. At least when I tried it a year ago, the Google cloud version was vastly inferior. I suspect it has to do with licensing agreements around certain datasets. Very curious if anyone knows more on this...
iwillnot 5y ago
[dead]
bacan 5y ago
Telegram is just spyware. Whatsapp is better. Signal is the best
bratwurst3000 5y ago
Someone else thinks that telegramm is only a coverup by the cia or russians to get data from people? I mean an app that tracks the living shit out of you and saves all your data unencrypted on their server and is the host of some rly strange groups…. Pure gold for such agencies
lowdose 5y ago
Yandex image search is superior to google image search because it does not interpret the content to a string and searches for this “one liner” but searches actually for similar images. Yandex also has Papiamento in their text translation. Which Google doesn’t support at all.
mrjin 5y ago
So a big no to use Telegram? I thought Telegram claimed to provide private communication, so now it will send contents to Google for translation? Hmmm...
brookmg 5y ago
Is it just me who thinks this is a work of a junior or intermediate dev to show a POW? I am sure they are working on some internal service to be used for translation but just worked on it fast to make it a 2021 feature.
bryanp2021 5y ago
If Google has been collecting (translating) users data, is that a good time for them to release them to everyone?

392 points by decrypt 5y ago

deleted 5y ago

[deleted]

On one hand, it's quite asshole-ish. On the other, google is serving broken frontends to their services and charge ridiculous prices on their API's. When I tried to make a third party search using google engine, I've exhausted the limit in less than an hour. It'd cost me like $40/mo to get what I get for free using their crappy frontend.

typingmonkey 5y ago
Like telegram did with the translate api, there is also a way to have an unlimited api for search results. You have to find one of the old mobile pages of google.
PragmaticPulp 5y ago
> On the other, google is serving broken frontends to their services and charge ridiculous prices on their API's. How does that make this okay? Nobody is entitled to get a company’s services for free just because you think their price is too high or their front ends aren’t built to your liking.
- rebolek 5y ago
  Google isn't entitled to get my personal data for free to, yet they do it anyway.
- tyingq 5y ago
  You could use the "turnabout is fair play argument". If you publish a web page, and don't specifically block google, they scrape your content, and use it for their own purposes. And even use it for "rich snippets", products other than search, etc. You're basically doing the same to them...using their content for your own purposes until they specifically block you.
  - PragmaticPulp 5y ago
    Disagree. The web is clearly architected such that publishing a webpage makes it public and crawlable. You don’t “block Google”, you specify that the site is not for crawling in robots.txt according to well-known standards. This is all basically the contract of the internet and it shouldn’t be surprising to anyone. Google specifically does not publish their API for free consumption by other companies, yet that’s what’s happening here anyway. The company is also using specific tricks to circumvent detection of the behavior. In your analogy, this would be like a crawler ignoring robots.txt and then scraping the content for their own website with zero attribution to the source, which is nothing like Google indexing your site with full attribution and driving traffic to it for you. Regardless, “turnabout is fair play” is unequivocally not a legally or even ethically acceptable standard, so that argument wouldn’t actually hold up anywhere anyway.
    - tyingq 5y ago
      "driving traffic to it for you." I did mention rich snippets.
    - inportb 5y ago
      > this would be like a crawler ignoring robots.txt Google ignores the noindex directive in robots.txt now. You're supposed to put it in your HTTP response headers or HTML meta tags...
      - ldjb 5y ago
        `noindex` was a Google-specific rule that was never officially documented nor supported. I think they were perfectly entitled to withdraw support for it, especially considering there are alternatives. https://developers.google.com/search/blog/2019/07/a-note-on-unsupported-rules-in-robotstxt https://developers.google.com/search/blog/2019/07/a-note-on-...
    - tshaddox 5y ago
      I don’t understand your argument. There is no actual “publishing” of web sites or APIs on the web. You simply make something available at a URL, and it’s up to anyone else to discover that URL. In this regard, your personal web site is no different than this Google Translate web API.
- agentdrtran 5y ago
  "Nobody is entitled to get a company’s services for free just because you think their price is too high or their front ends aren’t built to your liking." Tell this to Google!

ckastner 5y ago

I think it's possible construct to construct a (very weak) argument for the random user agent rotation, but why split the spring if not to avoid being flagged. On the other hand, I find it hard to believe that Telegram would risk a Play Store ToS violation, given how many tens of millions of users use the app.

wccrawford 5y ago
Isn't Google going to move to always having the user agent be the same anyhow? They've already decided to break that contract with the tech community, so I don't see that they have much room to talk there.
- dmurray 5y ago
  That contract was torn up a long time ago. Or do you really browse the web with "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"?
vesinisa 5y ago
Pretty sure at the point you have over a billion(!) installs, even Google affords some leniency towards its Play Store policies. Or at least we are about to find out anyway.. Meanwhile, indie developers with smaller user base are subject to unappealable automated decisions.
lima 5y ago
Telegram is well-known for operating in grey areas.
Bombthecat 5y ago
Would deepl cheaper?
arihant 5y ago
I'm not sure if Google will start flagging the IP addresses of the users because of each request having a different agent. That would render normal Translate unworkable for them too!

88840-8855 5y ago

Another useful feature, interesting article to look how it works under the hood. And again, i wonder how a tiny team can push such great and useful features into such amazing UI. And then I'm looking at other alternatives, from naked WhatsApp over laggy wechat to horrible UX in signal. What's the reason for telegram amazing performance and features?

iqanq 5y ago
>What's the reason for telegram amazing performance and features? Wouldn't a better question be "what's the reason for other apps having crappy performance and subpar features"?
- pjerem 5y ago
  Telegram is pretty impressive when you take into account the number of (well implemented) features that they managed to shove in the app without breaking ergonomics and performance. At this point, I just think the answer is top notch developers and designers with an impressive alignment about what the product should be. I know no other free application with such an amazing usability. There must be some shitload of money behind them, for sure.
  - iqanq 5y ago
    I think it's the result of every one of the clients (desktop, android, ios) having only one developer each.
  - BlueTemplar 5y ago
    Discord ?
    - sorenjan 5y ago
      Does Discord have a native (not Electron) desktop app?
      - 5y ago

ssl232 5y ago

I guess, given its popularity, Google won't kick Telegram off the store for obfuscating the URL and using an unauthorised (?) API endpoint but I imagine this will get them in some sort of trouble.

littlecranky67 5y ago
I think they could do it. In Germany, Telegram is often cited by media as a platform for (illegal) right-wing, antivax and hatespeech. Some politicians openly demand to go ofter Telegram and/or block it. So google could kill two birds with one stone here. At least remove it from the Play Store in some countries.
- kaladin-jasnah 5y ago
  I believe it is the same in the US. Although at the same time half my friends use it at our (critical) communication platform. So it's not in our best interests.
  - littlecranky67 5y ago
    Telegram is basically opposed to any kind of censorship which is IMHO a good thing. Western politicians are outraged as hatespeech, murder threats, right-wing paroles etc. are openly distributed through Telegram and demand regulation/takedown. At the same time, when protesters in Belarus or HongKong use Telgram to coordinate and those Governments demand takedown, the West screams oppression and demands freedom of speech. In general I am pro Telegram, as I think any democracy needs to have censorship-free communication for whistleblowers etc. and to prevent attacks against democracy itself. Even if this means we have to live with stupid/illegal opinions being expressed too.
robby_w_g 5y ago
> I imagine this will get them in some sort of trouble. I'm not sure about this. I bet Google is happy to collect the text data of up to 500 million users with zero restrictions from Telegram's end on how the data is used. I'm not a lawyer, but my hunch is that Google's data privacy policy applies to the official, premium service: https://cloud.google.com/terms/data-processing-terms https://cloud.google.com/terms/data-processing-terms Google might make the determination that they'll get more value from allowing Telegram to abuse the unofficial API. However, they might face some angry customers who are paying a premium to use the official API now that this loophole has been published.

malf 5y ago

Is this an option for encrypted chats as well? Is there a warning that the content gets sent to Google?

aquatica 5y ago
Yes. https://imgur.com/a/7UIFLxT https://imgur.com/a/7UIFLxT

kedmi 5y ago

It's smart. It allows Telegram users to hide in plain-sight, within the noise of other Google Translate web users. I'm pretty sure that using the official pre-built java SDK, as suggested by the author, would allow Google to cluster the content of Telegram users (since app-specific id/token should be sent). Other than that, a great read and kudos to the author for shedding light on it. Edit: typo.

giomasce 5y ago
It doesn't look very well hidden if there are blog posts about it...
- OJFord 5y ago
  The users are hiding among all the web traffic to translate.google.tld; not that that Telegram's doing this is top secret undiscoverable magic sauce. It's open source (GPL2): https://github.com/DrKLO/Telegram/blob/9e740dfd4d2b1ab6b8ed2b972e0f72fc9b8bd09d/TMessagesProj/src/main/java/org/telegram/ui/Components/TranslateAlert.java#L1089-L1094 https://github.com/DrKLO/Telegram/blob/9e740dfd4d2b1ab6b8ed2...
xg15 5y ago
I think Google can still cluster Telegram users pretty easily, especially now that that the method is in the open. Yes, Telegram fakes the user-agent, but the rest of the request still looks very different from a request an actual browser would do. (No referrer, missing headers, different connection pooling behaviour, possibly different TLS and HTTP2 behaviour, etc). So if Google is doing any detection for browser vs non-browser requests, those requests should show up as suspicious.
- nothasan 5y ago
  If they used cronet, they could get past these checks.
michaelmcmillan 5y ago
A rotated user agent does not hide anything from Google.

deleted 5y ago

[deleted]

einpoklum 5y ago

I wonder how useful this, considering how Telegram conversations are unencrypted by default. If they were to change this default, now _that_ would be something.

barnabee 5y ago

Someone deleted an interesting comment about adversarial interoperability [0] I’d love to see and give money to a project to create and maintain easy to use and stable “adversarial interoperability” APIs for as many services and products as possible. Perhaps companies and projects would not often use these directly because of the risks (hopefully some would, though!) but individuals could drop the library or the URL to a server hosting it into their apps to gain extra features. If standardised, whole open source apps could be built around them that allow querying and analysis of data from services and aggregating and automating using the services including optimising prices, taking advantage of offers, and using undocumented APIs to the users advantage. Maybe something architected and incentivised like https://thegraph.com/ https://thegraph.com/ for adversarial intercom and undocumented APIs. Building as a network of nodes and funding with crypto would make it harder to attack and take down. [0] https://www.eff.org/deeplinks/2019/10/adversarial-interoperability https://www.eff.org/deeplinks/2019/10/adversarial-interopera...

novok 5y ago
I think https://plaid.com https://plaid.com 's entire business is pretty much an adversarial interoperability webscraping play for banking. The business exists!
sdeframond 5y ago
Do you know Woob ? https://woob.tech/ https://woob.tech/
- _xnmw 5y ago
  Holy s*t this is amazing! A set of web-scraper automations!
- danpetrov 5y ago
  Wow that is really cool!
- deleted 5y ago
  [deleted]
- 5y ago

jlelse 5y ago

On iOS Telegram uses a system API, but on Android they seem to try to avoid the high Google Cloud fees: https://jlelse.blog/posts/telegram-translation https://jlelse.blog/posts/telegram-translation

Gigachad 5y ago
Is iOS using that local translation app added in iOS 14?
- marcellus23 5y ago
  Looks like it, but it’s still an undocumented private API they’re using.

rossmohax 5y ago

Telegram should have disclosed that every time someone uses this feature, their IP address is leaked to Google.

fault1 5y ago
I think they already do: https://imgur.com/a/7UIFLxT https://imgur.com/a/7UIFLxT Well, the plain text, not the IP, but that should be implicit with how web services work.
- themacguffinman 5y ago
  I wouldn't say it's obvious to either laymen or technical users, some apps will proxy a web service for the exact reason of hiding user info.
deleted 5y ago
[deleted]
Gigachad 5y ago
Telegram includes google services baked in to the app for things like maps.
- ju-st 5y ago
  There is a Telegram-FOSS fork with most Google services removed but the translation feature is not removed (yet?) in the code.
Anunayj 5y ago
also the content of the translated message is leaked in plain text too?
- whimsicalism 5y ago
  That is disclosed
bencollier49 5y ago

aenis 5y ago

This can't work for long. Translate is a profit center for google, and this also shows others that they can disregard google's monetization model for translate. Commercial use of those APIs is common, despite translate being pretty expensive. Also, GCP current leadership is so hell bent on nickel-and-diming their customers, and their compensation packages are so dependent on value share growth, that they simply can't afford anyone openly violating their pricing models. Especially a popular app. My guess is this will be down within the first week of January.

hdjjhhvvhga 5y ago
I'm curious what techniques they will use to differentiate between Telegram and non-Telegram users. If I were them, I'd simply use my power leverage and threaten them to remove the app from the Play store unless they remove/fix the offending code - it's much simpler than an eternal mouse-and-cat game, with possible collateral damage.
- michaelt 5y ago
  Given that Google runs ReCapcha - which is almost certainly the world's most widely used browser fingerprinting system - they have ample experience with is-it-a-real-browser cat and mouse games.
  - iqanq 5y ago
    In fact if you use this API constantly, you are presented with a recaptcha.
    - rfoo 5y ago
      In this case, Telegram may just display the captcha and let the user solve it. That's likely also why Telegram doesn't proxy every translation request over their server: so that it is users individually requesting small number of translations, from their phone, getting around quota of free APIs "naturally".
    - 5y ago

01acheru 5y ago

I used something like this years past for image resizing, the URL was: https://images1-focus-opensocial.googleusercontent.com/gadgets/proxy https://images1-focus-opensocial.googleusercontent.com/gadge... It is now blocked, always responds 403, maybe tweaking some request parameters can make it work again. Edit: if you want to try it out the parameters I used were: - container: focus (there are other values I cannot find anymore) - url: urlencoded URL of the image to be resized - resize_w: width in px - resize_h: height in px

tyingq 5y ago
It still works, just not with a direct url. It's checking that there's a referrer, I think. So that it only works if the image is in a web page: https://jsfiddle.net/depxb0gn/2/ https://jsfiddle.net/depxb0gn/2/

Namidairo 5y ago

I remember seeing the aforementioned API endpoint being used a while ago for some automatic chat translation. From what I remember, there was some minor rate-limiting that I hit once or twice while using it, which complicated things a little.

homami 5y ago

Off topic, but this is a code smell for me: [(int) Math.round(Math.random() * (userAgents.length - 1))]); This leads to a lower probability of selecting the 0th and the last items in the array.

namdnay 5y ago
It should be floor right? Math.floor(Math.random()*userAgents.length)
- lern_too_spel 5y ago
  There's a built-in method for randomly selecting an int in a range. Use that.
  - csears 5y ago
    Are you thinking of the Lodash random() function? Or Crypto.getRandomValues()?
    - lern_too_spel 5y ago
      https://docs.oracle.com/javase/8/docs/api/java/util/Random.html#nextInt-int- https://docs.oracle.com/javase/8/docs/api/java/util/Random.h...
- homami 5y ago
  Yeah. > The java.lang.Math.random() method returns a pseudorandom double type number greater than or equal to 0.0 and less than 1.0.
- lern_too_spel 5y ago
  floor is unnecessary. The cast does it for you. The problem is that a random double is not going to be evenly distributed into length equal parts unless length is a power of 2.

morelish 5y ago

Quite a lot of libraries exist to do this. But doing this in an app with a large user base looks offensive. Solution would be for some decent open source translation APIs to appear.

whimsicalism 5y ago
There are plenty of open source, decent translation APIs, the catch being that obviously nobody is going to pay for your translation compute.
- morelish 5y ago
  Any ideas which ones are the best? I would quite like to use a good open-source api, am happy to pay for my own compute. (I've just used googles before because it was handy. But I wouldn't use it the way telegram have done.)
  - MiroF 5y ago
    It depends if you have pretrained models or not. Huggingface offers a few models that are pre-trained [0], OpenNMT is a good framework [1] as is MarianMT [2]. Many of the best MarianMT models have been ported to HuggingFace. If you don't want to self host, huggingface offers these APIs at a cost. [0]: https://huggingface.co/models?pipeline_tag=translation https://huggingface.co/models?pipeline_tag=translation [1]: https://opennmt.net/ https://opennmt.net/ [2]: https://marian-nmt.github.io/ https://marian-nmt.github.io/

polote 5y ago

Is there any proof in this post that Telegram actually circumvent Google Translate API ? Because it is also possible that Google told Telegram to use the method explained in the article.

user-the-name 5y ago
That is not how Google works.
- aenis 5y ago
  Yup. And those guys will get bonus points for actively evading detection. IANAL, but its one thing to use an open api and claim ignorance, and quite another to intentionally defeat access restrictions/rate limits. Stupid thing to do.
jmnicolas 5y ago
Why would they concatenate the API url string then? The only reason I see is to avoid detection when their app is scanned when submitted to the PlayStore.

leodriesch 5y ago

I don’t understand the way this was implemented. They are bound to get in trouble with Google for this, but they can’t easily pull the feature. They can’t just be like „oh you’ve had translate for two weeks now, but now we can’t pay for it, so it’s gone.“ What is the long term thinking behind this? Or is this just developers and management not communicating?

zenexer 5y ago
“Google cut us off—they’re the bad guys, not us. Blame them.” …but with more elegant phrasing.
- sgjohnson 5y ago
  s/elegant phrasing/corporate doublespeak blah blah blah on 31st of February 1970 Google unanimously decided to terminate our access to their Translate API blah blah blah blah
  - skinkestek 5y ago
    This is Telegram. They are actually known for elegant phrasing, not corporate doublespeak.
  - zenexer 5y ago
    Telegram knows how to play the PR game. It’s going to be a bit more elegant than that, with a “we will rise from the ashes” tone. They know what they’re doing, and I doubt they had any intention of getting away with this.
simias 5y ago
Yeah I'm a bit shocked honestly that it made it into an application as widely used as Telegram. It's bound to be detected eventually and the feature will suddenly break. Such a strange software engineering decision. They can't even plausibly pretend that they didn't know and it's all a big misunderstanding given the lengths they went to obfuscate it in the code.
5y ago

oefrha 5y ago

This reminds me of my own usage of Google Translate's speech synthesis API in a chat bot way back. It was as easy as sending a GET request to https://translate.google.com/translate_tts https://translate.google.com/translate_tts. People loved it. Of course, my use case was neither commercial nor large scale.

cj 5y ago

As a small company who spends $70-80k per year on Google's official Translate API, it's disappointing if Google allows this type of abuse to continue. If they don't want to pay, they should be using a free open source alternative like https://github.com/LibreTranslate/LibreTranslate https://github.com/LibreTranslate/LibreTranslate

charcircuit 5y ago
Not everyone can afford to use these APIs or are able to get permission to use the external APIs. The internal APIs are very good for people who don't mind taking the risk of using a potentially unstable API.
- HatchedLake721 5y ago
  Then don’t run a business with services you can’t afford?
  - charcircuit 5y ago
    But using internal APIs are free. I can afford to use them since I don't mind having to update my usage of them / work around rate limiting.
    - IX-103 5y ago
      Do you also only eat free samples from the grocery store?
      - jokethrowaway 5y ago
        Those are usually rate limited. I'd recommend pizza and beer at tech events instead (albeit the nutritional content of your diet could be more important than free food).
      - Const-me 5y ago
        Which part of https://translate.google.com/ https://translate.google.com/ web page says the service provided by the page is a free sample of commercially available API?

taubek 5y ago

I see few possible issues: 1) If this is some kind of hack to reduce the cost this means that Google can pull the plug to this at any given time 2) How many users are aware that this means that the content is sent to Google? Yes, there is a warning on the screen where you turn one the option but will the users see it?

ozten 5y ago

This is an interesting data point for folks designing demo pages. The API was discovered by playing with the demo page [1] according to a link from a link in the article [1] https://weblog.west-wind.com/posts/2011/aug/06/translating-with-google-translate-without-api-and-c-code https://weblog.west-wind.com/posts/2011/aug/06/translating-w...

Jerrrry 5y ago

When a dev gets a requirement and no red tape is involved.

bencollier49 5y ago

Using undocumented API features in a commercial product seems a bit fly-by-night to me - doesn't convey the best impression of the company.

aenis 5y ago
Yeah, and doing this client side, and with the code open sourced? "Achievement unlocked".

ape4 5y ago

There are bound to be duplicate phrases for translation over all the many Telegram users. Why not cache to avoid API calls. How many times do you have to use the API to translate "OK" or other commonly used words.

littlecranky67 5y ago

Not sure if this is a smart move, especially since they piss off the same company that could remove them from the Play Store in no time.

Markoff 5y ago

why even bother with any API, just implement it on client side as regular browser with regular google translate request through URL like https://translate.google.com/?sl=auto&tl=en&text=hello%20world&op=translate https://translate.google.com/?sl=auto&tl=en&text=hello%20wor...

Const-me 5y ago

Visiting a publicly available web page doesn’t create contractual obligation between end users and web server owners. If Google views what telegram doing as abuse, then how it’s different from what end users are doing while interacting with https://translate.google.com/ https://translate.google.com/ web page? Especially if these end users are running an ad blocker or two in their web browser? BTW, uBlock origin blocked 4 pieces of content on that web page.

dodobirdlord 5y ago
Because Telegram has their app in the Play Store, which does require legal agreements, that presumably forbid this sort of thing.

zarzavat 5y ago

The following predictable chain of events will happen. Someone working at Google will read this blog post and report it internally. Google will contact Telegram and inform them that they are violating the Play Store agreement and could they please use the official API instead. Telegram will remove the feature as they can't spend the GDP of the Earth on translations. The end.

whimsicalism 5y ago
Don't know why they can't just roll their own... At this point you could probably even do reasonably well on-device.
- judge2020 5y ago
  I guess this would also be in a legal grey zone/break TOS, but I wonder if they could reuse the offline models the official Google Translate app downloads. > worst case you could just self host a translation service
  - whimsicalism 5y ago
    What? How would this violate ToS? iirc even the Google translate app does on device translation. And worst case you could just self host a translation service. Google's translation is good, but it's not that much better than what you can get OSS. e: Misunderstood your comment (I believe the quote was at the top and you edited), now I see that you were referring to your idea as the potential ToS violation. I agree, you can't violate IP law in your app.
    - judge2020 5y ago
      As in, the translate models are owned by Google and AFAIK they don't allow anyone, even other developers, to use them. It's against ToS to use intellectual property/code/ml models/etc without permission from the owner > 11.2 If You use third-party materials, You represent and warrant that You have the right to distribute the third-party material in the Product. You agree that You will not submit material to Google Play that is subject to third -party Intellectual Property Rights unless You are the owner of such rights or have permission from their rightful owner to submit the material. https://play.google.com/about/developer-distribution-agreement.html#:~:text=11.2%20If%20You,submit%20the%20material https://play.google.com/about/developer-distribution-agreeme....

skinkestek 5y ago

As someone who has often defended Telegram I am somewhat puzzled by this one. While the legal aspects of this might have to be decided by someone more skilled than me I feel they are morally on the same ground as early Google and if Google makes a big case of it it might backfire spectacularly. More interesting is it that Telegram sends user texts directly to Google without any proxying (did I get that right and has the author studied it carefully enough?). This might (again, if this blog post is correct and I read kt correctly) be an actual dangerous move from Telegram. Unlike the problems that many here worry about regarding E2E-encryption, this can potentially drag Telegram down to WhatsApp levels, sending huge amounts of user data straight into Google. Then of course, we'll need to see. Very much of what Telegram has done security wise is very well thought out and has improved over time. Recently for example when I started my backup of one of the groups I participate in I had to confirm from a mobile client or wait 24 hours to start backup. Account recovery is almost automagically simple but has some nifty touches to prevent account hijacking. Settings to delete the account if I fail to log in has existed for years, I wonder if they even did this before Google launched it. So now I am anxious to know if Telegram has done something brilliant again or if this is a turning point.

judge2020 5y ago
> without any proxying (did I get that right and has the author studied it carefully enough?). Most likely, since the user-agent rotation code is in the app itself. If it were a Telegram proxy, the proxy would do its own UA and IP hopping and the clients would use their default UAs. At a certain point, I wonder why Google's abuse team don't simply look for 3+ occurrences of User Agent strings because UA rotation is rarely used for legitimate purposes.
- skinkestek 5y ago
  These days Google isn't up to much on a technical level ;-) They cannot even fix the old verbatim feature that they broke a few years ago, so how should should they be able to stop this without breaking something else? Yep, this is somewhat hyperbolic but I'll write it anyway. I want my old Google back.

yosito 5y ago

I really don't understand this. Is Telegram a legitimate app? If so, then why are they attempting to rip off other companies' work without paying them? You want an integration with a translation API? Then pay a fair price for one, or build your own? If Telegram really can't afford an integration, just make a translate button that opens a link to https://translate.google.com/?sl=es&tl=en&text=API%20de%20traducci%C3%B3n%20para%20pobres https://translate.google.com/?sl=es&tl=en&text=API%20de%20tr... Edit: not to mention the privacy implications of sending messages to Google.

rfoo 5y ago
Okay, how about I open an embedded WebView of https://translate.google.com/?text= https://translate.google.com/?text=..., with the viewport carefully set to only show the translation results?

alpineidyll3 5y ago

Bahhh do you want to get captchas? THIS IS HOW YOU GET CAPTCHAS!!!

gregoriol 5y ago

Nobody pays for using Telegram, so why would Telegram pay for using... oh...

mdasen 5y ago

"It's a bold strategy, Cotton. Let's see if it pays off for 'em" Deciding to use the Google Translate API in a way that bypasses Google's API-key system seems like a dangerous game. Google controls your access to the Android platform† and now that this blog post has been published, it seems like Google could remove the app from the Play Store for unauthorized access of Google services. If they'd found a way to use an API from some third party, maybe that third party would try and shut it down or whatnot. In this case, it feels like they're poking the bear - especially given how much traffic they might throw at it. At some point, Google might get annoyed that an API that they charge a lot of money for is being used for free and somewhat legitimately remove Telegram from the Play Store. Google can pretty legitimately claim that the Telegram app was accessing Google's servers in an unauthorized way and that they went through steps to obfuscate their access which shows that they knew what they were doing was wrong and tried to hide it. This seems like a bold move. Google might simply shrug and not care. Google might decide that they'll remove Telegram from the Play Store permanently. Google might decide they'll only allow Telegram in the Play Store if it doesn't have translation features. If Google removes Telegram from the Play Store, that's basically the end of Telegram. As people bought new phones, the number of people reachable on Telegram would dwindle‡. As the app no longer could receive updates, eventually it would become old and stale. They'd have to start moving to another platform whether WhatsApp or Signal or Matrix. †sure, other stores and side-loading exist on Android, but Google does control access for the vast majority of Android users (at least in the US/Europe). ‡yes, maybe one can transfer apps and side-loading does exist, but the number of users would dwindle

fault1 5y ago
Personally, I think Telegram has enough reach that removing/blocking it would get a lot of unwanted political attention against Google - I mean, a lot of politicians and decision makers seem to use Telegram depending on the country. So I don't think they would do that. I think they will just figure out how to break this feature.
- Nextgrid 5y ago
  Telegram is also popular within the crypto circles and those are a lucrative target for advertisers which Google's business relies on. Banning it from Android may shrink that market.

zoomablemind 5y ago

Very questionable decision, rather irresponsible one to all parties involved. I hope this won't devolve into a 'rogue-dev' blame, the company has to own it up. I wonder if an alternative route could be somehow leveraging google's own app. The Translate app is likely already installed on user's platform. So is there a way to send the user's translation requests to the app? It's almost a unix-approach, a tool for a task. Instead of a megatool for all-you-want.

iggldiggl 5y ago
> So is there a way to send the user's translation requests to the app? You can, but it naturally kicks you out of your app into the Translate app, so not exactly seamless. It's fine for the occasional one-off translation I guess, but not if you possibly want to completely translate one side of the conversation.

ilrwbwrkhv 5y ago

Nice hackers way of thinking. This is what makes telegram the best.

arihant 5y ago

My guess would be (given the size of that array) that this is done to prevent rate limits rather than cost. It could be that this was advised by Google themselves because they could not provision the correct rate limits due to end of year. It's hard to imagine a client of this size isn't in direct contact with Google Cloud engineers. Pretty sure they're paying for it too. Also, this may have been done just for the open source commit of the project to prevent leaking token? Can't jump to conclusions here. Google does the same thing in Google Pay Indian version. Government mandated that no one app can have more than 25% transaction volume of the country for UPI. So Google partnered with 4 banks, essentially having 4 UPI apps in the eyes of government.

green-eclipse 5y ago
I think you're looking at this all wrong. If Telegram did this officially with Google, would they have had to craft this klunky workaround for breaking up RPC strings and randomizing the user agent? I don't think so. Also the Google Pay analogy seems off. Telegram backdooring free access to Google Translate is not at all the same as Google partnering with 4 banks for transaction processing. One is totally unofficial, the other is an actual partnership.
- arihant 5y ago
  Yes the string split is a very odd. I agree with you there. Very confused that Google can't catch this. It's adding to the same string it should look same in the heap anyway? Simple college plagiarism programs like MOSS will catch this. For Google Pay, what Google is doing is actually not legal. Government wanted each third party (non bank) app to be restricted to 25%. Google will get in trouble when government actually starts cracking down (and when they get close to the 25% mark). We don't know how government is looking at them, because they're under threshold anyway. The legal way for GPay to handle over 25% of total transactions is to register at least as a Payment Bank.
chagaif 5y ago
This sounds very reasonable and it's the only comment I found in a see of people talking about how Telegram is doing this illegally. Would be curious to see how this turns out.

emilfihlman 5y ago

These comments are funny. Here's a thought for you, though: Telegram can be used just fine without Google Play Store. If Google blocks this new and cool feature and people like this feature, it only serves to push people into skipping the playstore completely because people are invested in their messaging applications. Now, normalising downloading and installing applications from outside the Play Store is a big red flag to Google. This is possibly the most genious and awesome thing Telegram has done, and imho an excellent play. Either TG gets cool new features easily, or people get freedom and still get cool new features. I'm very interested in how this is going to play out!

skzv 5y ago
Telegram already encourages downloading the APK directly: https://telegram.org/android https://telegram.org/android
- emilfihlman 5y ago
  True, but not in the application.

dandiep 5y ago

One thing I don't see mentioned here is that the Google Cloud version of Translate is actually different than the user-facing one at translate.google.com. At least when I tried it a year ago, the Google cloud version was vastly inferior. I suspect it has to do with licensing agreements around certain datasets. Very curious if anyone knows more on this...

iwillnot 5y ago

[dead]

bacan 5y ago

Telegram is just spyware. Whatsapp is better. Signal is the best

bratwurst3000 5y ago

Someone else thinks that telegramm is only a coverup by the cia or russians to get data from people? I mean an app that tracks the living shit out of you and saves all your data unencrypted on their server and is the host of some rly strange groups…. Pure gold for such agencies

lowdose 5y ago

Yandex image search is superior to google image search because it does not interpret the content to a string and searches for this “one liner” but searches actually for similar images. Yandex also has Papiamento in their text translation. Which Google doesn’t support at all.

mrjin 5y ago

So a big no to use Telegram? I thought Telegram claimed to provide private communication, so now it will send contents to Google for translation? Hmmm...

brookmg 5y ago

Is it just me who thinks this is a work of a junior or intermediate dev to show a POW? I am sure they are working on some internal service to be used for translation but just worked on it fast to make it a 2021 feature.

bryanp2021 5y ago

If Google has been collecting (translating) users data, is that a good time for them to release them to everyone?