Compliant Telegram Mini App Authentication via Russian ID Providers in My Anti-Social Network Project
The project My Anti-Social Network shows how to implement legally compliant entry into Telegram Mini Apps for Russian audiences by moving identity verification away from Telegram itself. While Telegram’s initData HMAC-SHA-256 signature check remains reliable, Russian regulatory demands for user identification require additional steps when the service targets domestic users.
The core design separates identity (who the user is) from channel identity (where notifications are delivered). Users authenticate via VK ID, Yandex ID, or MAX; the resulting telegram_id is stored only as a delivery channel, never as the primary login credential.
VK ID Flow with PKCE
For VK ID the application follows OAuth 2.1 with PKCE. The browser generates a code_verifier, derives a code_challenge using S256, and stores the verifier on the server under a cryptographically random state value. The authorization URL opens in a new tab so users can complete login even when the Mini App runs inside Telegram WebView or on another device.
Yandex ID and MAX Integration
Yandex ID uses a similar OAuth 2.0 redirect that returns a short-lived code exchanged server-side for an identifier. MAX authentication relies on a one-time deep-link token that the MAX bot confirms inside the chat. In all cases the final exchange endpoint issues an HttpOnly session cookie; OAuth tokens never become accessible to client-side JavaScript.
Security Controls
- state values are generated with crypto.randomUUID() or equivalent 128-bit entropy and carry short TTLs.
- Polling for authentication results uses up to 120 attempts with 3-second intervals.
- Consent checkboxes for data processing are shown according to the platform (two checkboxes inside Telegram WebApp, one in PWA).
The same codebase powers Telegram bots, MAX and VK bots, PWA, browser extensions, and Home Assistant voice-assistant integrations with Alice, Sber, and Marusya. All state, code exchange, and polling logic remains invisible to the end user.
Related articles
CryptoPro Develops CryptoPro-Browser with Russian Cryptography for FSB Compliance
CryptoPro is creating its own browser called CryptoPro-Browser as part of the CryptoPro CSP 6.0 cryptographic information protection system. The product will include built-in cryptographic tools, support for the company's plugin, and TLS connections using Russian cryptographic algorithms. The development follows Google's removal of the CryptoPro extension from the Chrome Web Store in February 2025, which left new users without an easy installation method. The project has been coordinated with the FSB of Russia and targets scenarios requiring compliance with Russian information security regulations. CryptoPro plans to incorporate experience from its earlier Chromium-Gost project started in 2017, while also recommending Yandex Browser as an alternative. Analysts estimate the development cost at several tens of millions of rubles, with the main focus on corporate customers needing certificate management and specialized support.
Yandex 360 Email Archive Documentation Shows Search Snapshots and Former Employee Log Filters
The Yandex 360 administrator guide describes the email archive as a tool that stores copies of all messages sent and received by employees on the organization's domain. Two specific statements in the documentation indicate that each saved search returns a static snapshot that does not update automatically when new mail arrives, requiring manual cloning or recreation of the search to obtain current results. The same documentation states that the action log records every operation performed in the archive, yet the employee filter in the log interface only displays currently active accounts, making it impossible to select a former administrator by name. API 360 currently provides no documented endpoints for creating, executing, or retrieving archive searches, leaving all operations dependent on the web console. Additional notes clarify that messages remain available after an account is blocked but disappear once the account is deleted, and that messages removed before the archive was enabled cannot be recovered. These documented behaviors directly affect incident response and offboarding procedures that rely on historical email retrieval and audit trails.
Global AI Regulation: From Strict School Bans to Unregulated AI Havens
Countries are adopting sharply different approaches to AI oversight, ranging from comprehensive risk-based frameworks to outright prohibitions on generative tools in education. The United States relies on a patchwork of state laws and presidential actions, including Texas TRAIGA restrictions on high-risk AI systems and New York’s moratorium on generative AI in grades 2–8. The European Union enforces the AI Act with four risk categories, while Italy adds criminal liability and human oversight requirements in critical sectors. Norway and China have implemented some of the strictest classroom and content-authenticity rules, and Russia introduced its first baseline AI law defining sovereign models effective September 2026. Several nations have also blocked popular chatbots such as ChatGPT, DeepSeek, and Grok. Meanwhile, commercial platforms like FinamX continue integrating multiple AI models into financial workflows despite the regulatory tightening.
How Russian Companies Can Legally Transfer Personal Data to Contractors Under 152-FZ
The article explains the legal distinction between data processors and independent operators when outsourcing tasks involving personal data. It details that the role of a contractor is determined by who sets the processing purpose, not by the service contract itself. For processors, a detailed data processing instruction under Article 6 of 152-FZ is required, while independent operators need a separate legal basis such as consent or contract performance. Special rules apply to employee data under Article 88 of the Labor Code, mandating written employee consent for transfers to third parties. The guidance also covers sub-processing risks, transparency obligations, and penalties under Article 13.11 of the Code of Administrative Offenses. Practical checklists help organizations classify contractors and prepare the correct documentation.