Telegram Desktop Adds WEB Proxy to Hide MTProxy Traffic Inside HTTPS and WebSocket Connections
Telegram Desktop has received an initial implementation of a new WEB proxy that hides messenger connections inside ordinary HTTPS and WebSocket traffic. For network providers the user appears to be simply visiting a website, while MTProxy continues to function under the hood.
Changes were discovered in the client source code. Developers added more than 3,000 lines, a separate WEB-proxy transport, domain settings, and interface controls including “Open browser” and “Waiting for browser.”
The scheme operates as follows: Telegram Desktop launches an embedded web page and establishes a secure WebSocket connection to a domain that externally resembles an ordinary site. Several MTProxy connections are combined into one stream and transmitted through this channel. On the server side an intermediate node splits the stream back into separate connections and passes them to a conventional MTProxy instance. The relay does not need to decrypt the correspondence content and functions only as a transport sorter.
This approach is expected to complicate traffic blocking by providers that rely on DPI or simple domain blacklists, because the observable traffic matches typical web browsing patterns.
Related articles
rkn-block-checker 0.6.0 Adds Local Web UI and Reduces False Positives on Anti-Bot Responses
The open-source tool rkn-block-checker received a major update in version 0.6.0 that improves accuracy when detecting Russian ISP censorship blocks. The previous version incorrectly flagged sites protected by anti-bot systems as blocked by Roskomnadzor because it searched for common stub-page strings without checking HTTP status codes. A new logic layer now separates rate-limit responses such as HTTP 429 from genuine provider stub pages that typically return 200 OK or 451. The release also introduces a fully local Web UI built with Python’s standard-library HTTP server and vanilla JavaScript, eliminating the need for heavy frameworks. Results stream in real time via NDJSON so users can watch checks complete without polling or WebSocket connections. The project remains available on PyPI and GitHub under the MIT license.
Digital Surveillance in Your Pocket: Audit Uncovers Tracking and Weak Cryptography in 11 Top Russian Android Apps
An independent security researcher conducted a static analysis and passive logcat review of 11 popular Russian Android applications from banks, government services, marketplaces, and navigation tools. The audit identified 237 vulnerabilities in total, including six apps signed with outdated RSA-1024 or DSA-1024 keys that violate current NIST standards. VK led the risk ranking with 11 trackers and a 98/100 surveillance score, while Gosuslugi transmitted analytics signals to VK, Yandex, Google, and Huawei ecosystems. Five apps used WebRTC ICE candidate leaks to detect VPN usage, potentially bypassing user privacy protections. Only Goskluch scored low at 42.4/100 by limiting trackers to two, avoiding VPN detection, and using a compliant RSA-2048 signing key. The methodology relied solely on MobSF, jadx, and logcat without bypassing SSL pinning or requiring root access.
Amnezia VPN Survives Coordinated Russian Censorship Campaign Targeting AmneziaWG Protocol Fingerprints
Amnezia VPN has published a detailed post-mortem on the multi-wave blocking campaign conducted by Russian authorities against its Amnezia Free and Amnezia Premium services during June and July. The company describes a shift from simple protocol blocking to sophisticated fingerprinting of AmneziaWG traffic combined with infrastructure DDoS attacks and automated IP-subnet blacklisting. Engineers closed multiple detection vectors including zero-length UDP packets, fixed-size keepalive messages, handshake timing patterns, and nonce zero bytes. The incident forced accelerated migration to AmneziaWG 2.0, discontinuation of legacy client support, and development of AmneziaWG 3.0 while expanding VLESS infrastructure as a backup. Self-hosted users largely avoided direct protocol blocks but still faced subnet-level restrictions. The report highlights how Roskomnadzor now applies cumulative scoring across multiple traffic features rather than single definitive markers.
Data Masking: 8 Critical Questions Businesses and Developers Ask About Protecting Sensitive Data
Garda expert Dmitry Larin addresses common challenges in data masking during a recent webinar titled 'Data Masking: Battle of Opinions'. The discussion covers why masking remains essential even when encryption is deployed, how to preserve application functionality after anonymization, and the performance trade-offs of processing large databases such as 5 TB PostgreSQL instances. Different masking types including static, dynamic, selective, and streaming are explained with specific use cases for DevOps pipelines, external contractors, and BI systems. The article also examines why machine learning alone is insufficient for discovering personal data and why custom scripts fail at scale across heterogeneous environments like PostgreSQL and Oracle. Practical recommendations include combining masking with encryption, using deterministic transformations for deduplication, and separating replication from masking tasks to avoid production impact.