I'm not a huge fan of the blog title - the clear intent of the title is to make it sound like they didn't want any public disclosure, but my reading is that the

I'm not a huge fan of the blog title - the clear intent of the title is to make it sound like they didn't want any public disclosure, but my reading is that the first response incorrectly considered it low priority, and then after Tencent realized it was a real issue they quickly said "whoops, please don't disclose this as we need to fix it". It seems like this could be in part mitigated by making sure their server is not an oracle (though obviously fixing the primitives is also important, but older/non-updatable clients could exist). I would guess the traffic all over TLS on iOS due to "App Transport Security" requiring https by default - it's not a huge leap to turn it off, but it's controlled by the App's Info.plist so is trivially indexable. Also probably more work than just adding 's' to the protocol (at least from the PoV of the individual dev working on the code).