If you use Telegram in a region where it's blocked, you've probably installed an MTProto proxy without thinking twice. The gray cloud icon vanishes, messages send, and you move on. But what does running your traffic through someone else's server actually expose? And should you trust free proxies listed on random Telegram channels?
Let's walk through the encryption model, the limitations of trust, and how to pick a proxy that isn't a honeypot.
The MTProto Security Model
Telegram's MTProto is designed to encrypt messages end-to-end only in secret chats. Regular chats (cloud chats) are encrypted between your client and Telegram's servers, but the server holds the decryption keys. The proxy sits in the middle as a transport layer: it carries encrypted traffic between your device and Telegram's data centers.
From your client's perspective, the connection to the proxy is wrapped in a custom encryption scheme that resembles TLS but isn't real TLS. The proxy operator sees only the encrypted tunnel content—they cannot decrypt the inner Telegram packets. That's the theory.
In practice, the security depends on two things:
- The proxy cannot break Telegram's end-to-end encryption for secret chats.
- The proxy can observe metadata about your connection.
What the Proxy Server Knows
A proxy operator sees the following:
- Your IP address – obvious, but worth stating. The operator knows where you're connecting from.
- The destination Telegram IP – they can see which Telegram data center you're reaching.
- Connection timing – how often you reconnect, session duration, idle patterns.
- Traffic volume – rough size of encrypted blobs going in and out.
They cannot see:
- Which chats you're in
- Message content (unless you're using a cloud chat without secret chat, but even then the proxy only sees ciphertext)
- Your phone number or username directly from traffic
However, if the proxy operator is malicious and also runs a Telegram bot or client, they could correlate IP addresses with user activity elsewhere. This is far-fetched but not impossible.
The Hidden Risks of Free Proxies
Free proxies are often run by volunteers—or by entities with unknown intentions. The biggest risk is not data theft (since the proxy can't decrypt), but these three:
- Traffic logging and deanonymization – even if the proxy can't read messages, logging IPs over time builds a profile.
- Malicious configuration – a fake proxy could redirect traffic to a phishing server that mimics Telegram's login page. This requires user action (like clicking a link), not passive interception.
- MITM via fake TLS certificate – MTProto proxies with Fake-TLS support can present a forged certificate to your client. If you blindly accept it, your entire connection is compromised. The official Telegram client does verify server certificates, but older or modified clients may not.
The most common attack is simply harvesting IP addresses for resale or surveillance. In countries like Iran or Russia, using a proxy provided by an unknown entity could flag you to authorities.
How to Verify Proxy Authenticity
You cannot fully prove a proxy is safe without controlling the server yourself. But you can reduce risk:
- Use only proxies from sources that publish their server configurations – raw host:port:secret strings are easy to verify. Compare across multiple listings.
- Check the secret – in MTProto, the secret is a 32-character hex string. If the same secret appears on multiple unrelated servers, it's likely a shared secret used by a coordinator. That's not inherently bad, but it means the operator can rotate servers without changing clients.
- Test with a burner account – if you're paranoid, create a throwaway Telegram account and use the proxy for a few days. Check if you receive unsolicited messages or see unusual login alerts.
A practical tip: when you add a proxy manually in Telegram, the format is:
tg://proxy?server=123.123.123.123&port=443&secret=ee...secret_hex_here...
You can extract the secret and verify it matches the one published by the proxy source.
Why This Repository Exists
The repo free-mtproto-proxies takes a different approach from Telegram channels that dump random proxy lists. It's an automated scraper that collects proxies from public sources, validates them, and publishes the results on a live web page. The code is open for inspection, and the proxy list is continuously updated.
The transparency matters: you can see where each proxy was found, and if the source is known to be unreliable, you can flag it. The repository also includes Fake-TLS proxy entries, which are harder to detect by deep packet inspection in Iran and China.
If you're already reading about MTProto proxy battery drain on mobile (a topic I covered in detail here), the same verification principles apply. A proxy that saves battery but logs your IP is no bargain.
For a deeper dive into the protocol itself, this Telegra.ph guide explains the Fake-TLS handshake in technical terms.
A Practical Note on Verification
No proxy list is 100% trustworthy. The best you can do is cross-reference multiple sources and avoid using a single proxy for extended periods. The free-mtproto-proxies repository is one such cross-reference: its automated checks at least confirm the proxy is reachable and returns valid MTProto responses. That's a step above a random link in a Telegram group.
If you're in a high-risk environment (e.g., Iran, Russia, China), consider running your own MTProto proxy on a cheap VPS. The repository includes scripts that can help you set one up. Failing that, rotate proxies weekly and never trust one that asks you to install a custom certificate.
The security model of MTProto gives you strong encryption at the transport layer, but no encryption can protect you from the operator who logs your IP and sells it. Choose your proxy sources as carefully as you choose your VPN.
Top comments (0)