Tdesktop: Check updates via HTTPS

[nshopik]

This is straightforward currently tdesktop check updates by making HTTP request to updates.tdesktop.com. It should check using HTTPS, as checking via http create false state (no updates available), when someone doing mitm and redirect to some page.

Tested on latest alpha 1.2.19

[sadalhayat]

Luckily, TDesktop update is now support proxy.
https://github.com/telegramdesktop/tdesktop/issues/4332#issuecomment-386856313

I was able to update from Alpha 1.2.18 to 19 by enable a proxy.
It's my connection/ISP issue I guess (at home), because no problem on my TDesktop at office.

[john-preston]

@nshopik I think autoupdates will be changed to https at least for some regions with blocked tdesktop.com access.

[nshopik]

@john-preston Why leave it http at this point?

My point it is rather better see update check failed than no updates availble when there is someone doing mitm be it ISP or just local office policy

[john-preston]

@nshopik At the point of development I was not sure my small tdesktop.com will handle those millions of https requests. Currently it should not be an issue but still better be cautious.

[nshopik]

@john-preston thanks for clarification.

It would be helpful if you enable IPv6 on tdesktop.com if it possible, to give it better reachability.

[magicgoose]

If HTTPS has too much overhead, you can just add cryptographic signatures to the version information replies (they can be cached, of course).
Then nobody else (without the private key) would be able to forge these responses.

[nshopik]

@john-preston MITM is ignored is this intended? I was expecting update failed when untrusted CA appears during update check

[john-preston]

@nshopik It was ignored. The update will be rejected if it won’t be signed with a proper private key, so it was safe in terms of a malicious update injection, but the check info was not interpreted correctly and it was displaying “latest version” instead of “check failed” :(