Tdesktop: I think this is a fundamental security issue

Created on 30 Jun 2020 · 5Comments · Source: telegramdesktop/tdesktop

Unfortunately, the configuration of the Telegram account on GNU/Linux (I'm not a Windows user, but this problem is definitely worse on Windows) is stored in the wrong place and is not encrypted

~/.local/share/TelegramDesktop

If anyone has physical access to our system, they can easily copy the ~/.local/share/TelegramDesktop folder from the system and use it in another system; Please encrypt this folder and change its location
This problem is actually a feature, but it has a major problem. Please add the backup feature of the session But in this way, the backup can be encrypted and this feature can only be activated for people who enable the two-step feature

stale

Source

RezaSh13

Most helpful comment

I think the rule of thumb is if someone have physical access to our computer then we're fundamentally end of story.

rizaumami on 1 Jul 2020

👍7

All 5 comments

@RezaSh13 It is encrypted if you use a local passcode.

john-preston on 30 Jun 2020

👍3

I think the rule of thumb is if someone have physical access to our computer then we're fundamentally end of story.

rizaumami on 1 Jul 2020

👍7

https://telegram.dog/faq#q-can-telegram-protect-me-against-everything

"Telegram can help when it comes to data transfer and secure communication. This means that all data (including media and files) that you send and receive via Telegram cannot be deciphered when intercepted by your internet service provider, owners of Wi-Fi routers you connect to, or other third parties.

But please remember that we cannot protect you from your own mother if she takes your unlocked phone without a passcode. Or from your IT-department if they access your computer at work. Or from any other people that get physical or root access to your phones or computers running Telegram.

If you have reasons to worry about your personal security, we strongly recommend using only Secret Chats in official or at least verifiable open-source apps for sensitive information, preferably with a self-destruct timer. We also recommend enabling 2-Step Verification and setting up a strong passcode to lock your app, you will find both options in Settings > Privacy and Security."

GodSaveTheDoge on 11 Jul 2020

👍1

You can also use -workdir /an/other/path start parameter to move data folder to another location.

RadRussianRus on 12 Jul 2020

Hey there!

This issue will be automatically closed in 7 days if there would be no activity. We therefore assume that the user has lost interest or resolved the problem on their own.

Don't worry though; if this is an error, let us know with a comment and we'll be happy to reopen the issue.

Thanks!