3 ms·
TL;DR version Telegram is completely open-source and has an open API. There is no PKI, so the public key of the Telegram is hard coded in the application. An a
by jvdh 12y ago
TL;DR version
Telegram is completely open-source and has an open API. There is no PKI, so the public key of the Telegram is hard coded in the application.
An attacker could simply take the source code, change the server IP and public-key and has a working MITM, if he can somehow make the user install this one instead of the original.
- saurik 12y agoAs soon as you have "somehow make the user install this one instead of the original" as a step, nothing is safe from MITM attacks.
- xyzzy123 12y agoHmmm. I don't see why any of the crypto stuff in the paper is necessary. A modified client can log, leak or change any message it wants once it has the plaintext. You shouldn't need to understand the protocol at all.