overtake / TelegramSwift

Source code of Telegram for macos on Swift 5.0
https://macos.telegram.org
GNU General Public License v2.0
5.03k stars 852 forks source link

Unsafe file permissions for encryption key and postbox database #860

Open homedirectory opened 1 year ago

homedirectory commented 1 year ago

There are two files that give complete access to sensitive telegram data stored locally (e.g. chat history):

Users that don't have "Screen Lock" feature enabled are at highest risk, since the encryption key can then be directly used to decrypt the database contents.

Both of the mentioned files are "world readable", that is, they have the following UNIX permissions: rw-r--r--, which make it possible for other users to read or copy them.

ghost commented 1 year ago

how to run it in ventura

VityaSchel commented 2 months ago

I'm trying to open my database to recover deleted content from there, but I can't open it. I tried converting .tempkeyEncrypted to hex and prepending it with 0x to open but sqlitebrowser app won't let me decrypt it. I think what I'm missing is parameters that were used to encrypt the database, but I don't know how to find them in source code