![](data:image/svg+xml;charset=utf-8,<svg width="640" height="640" style="background-color:%2344badc;font-family:Nunito,sans-serif" viewBox="0 0 100 100" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg">
<text font-size="30" x="50%" y="50%" dy="5" fill="white" dominant-baseline="middle" text-anchor="middle">t</text>
</svg>)
🛡In Telegram Desktop v6.7.2 and Telegram Beta for Android v12.6.4 (6662), TLS ClientHello generation was updated for connections over MTProto proxy. This addresses TLS fingerprint quirks that could previously make such traffic easier for DPI systems to detect and potentially block.
MTProto proxy is used to obfuscate Telegram traffic. When a connection is established, the client sends a TLS ClientHello message, and its parameters can be analyzed by DPI systems to identify the traffic type.
The issue was that the previous TLS ClientHello implementation produced an unusual TLS fingerprint. In Telegram Desktop, for example, 0xfe02 was used instead of 0xfe0d, and there were 20 bytes of random data instead of 32. This increased the likelihood of accurate MTProto proxy traffic detection.
After these changes, TLS ClientHello is now closer to the profile of regular browser traffic. This may make detection and blocking of MTProto proxy connections more difficult, especially in networks with active DPI filtering, including in Russia.
@telelakel
MTProto proxy is used to obfuscate Telegram traffic. When a connection is established, the client sends a TLS ClientHello message, and its parameters can be analyzed by DPI systems to identify the traffic type.
The issue was that the previous TLS ClientHello implementation produced an unusual TLS fingerprint. In Telegram Desktop, for example, 0xfe02 was used instead of 0xfe0d, and there were 20 bytes of random data instead of 32. This increased the likelihood of accurate MTProto proxy traffic detection.
After these changes, TLS ClientHello is now closer to the profile of regular browser traffic. This may make detection and blocking of MTProto proxy connections more difficult, especially in networks with active DPI filtering, including in Russia.
@telelakel