Messaging app Telegram has long been favored for its security, including encryption deployed as standard. But a recently discovered flaw in desktop versions of Telegram has been found to be exposing IP addresses.

Discovered by security researcher Dhiraj Mishra, the flaw in the Windows app and Telegram Desktop app exposes and records the IP address of a user taking a call, with the data stored in the Telegram console logs. The problem is that by default Telegram forces users to both use peer-to-peer for calls and for recording the IP address of each connection.

“Telegram is supposedly a secure messaging application, but it forces clients to only use P2P connection while initiating a call, however, this setting can also be changed from ‘Settings > Privacy and security > Calls > peer-to-peer’ to other available options,” Mishra said in a blog post Saturday. “The tdesktop and Telegram for Windows breaks this trust by leaking public/private IP address of end user and there was no such option available yet for setting ‘P2P > nobody’ in tdesktop and Telegram for Windows.”

Where the so-called feature becomes confusing is not that Telegram records the IP address but the Windows and Desktop apps do so without the ability to turn the feature off. Other versions of the Telegram clients such as those on macOS, iOS and Android also record the IP address but support the ability to turn the feature off.

Telegram responded quickly, not only rewarding Mishra a payment for discovering the bug but also pushing out a new version of the apps. Users who are concerned about privacy are encouraged to download the new version and also opt to disable P2P calling so as to avoid exposure of their IP address.

Image: Dhiraj Mishra