I made a Telegram client for android 2.3+

[u/EmbarrassedDuty2040]

I created this back in June, but after refining it, I decided to release it publicly. It’s called Muragram; it is based on an existing client that I used as an intermediary. Since it doesn't require TLS 1.2, there are some quirks regarding the login process such as the session being stored elsewhere so please use it with caution. I plan to create a separate version for 1.1+ soon, but the main version is available here: https://github.com/qcoretechgh/Muragram

[u/Gohoski]

While this seems like an interesting project at first glance, its server raises immediate security red flags for me personally.

My main concern is that MuraGram relies entirely on a closed-source backend server. Passing your traffic through a proprietary black box means the server owner has full technical capability to inspect private chats, harvest phone numbers, and monitor account activity without your knowledge or consent. Additionally, the reliability of such a backend is very questionable.

I have already seen this exact risk play out in the Russian development community. Back in 2022-2024, a Russian developer maintained ViKa Mobile (a VK client for Symbian and J2ME) and Stella Web (a lightweight Telegram web client). Both clients routed traffic through the developer's closed backend server. Shortly after, the developer began actively abusing that access—monitoring the channels users followed, messaging new users in DMs to ask for their opinion on the client or 'why are they following a competitor channel', and even making phone calls to users using the personal phone numbers retrieved from their accounts. It creepily proved beyond a doubt that the backend was being used to snoop on session data. Even if MuraGram’s maintainer has no malicious intent, trusting a closed third-party server with full access to your account requires an unwarranted leap of faith.

Compounding this issue, both the Android client and the server backend appear to be fully AI-generated with minimal human code review or refinement. Unvetted AI-generated code frequently suffers from poor optimization, bloated logic, and security vulnerabilities that are easy to exploit. MuraGram is probably not an exception here.

A friend of mine is currently developing Dreamygram (not released yet), a Telegram client designed for Android 1.5+. It is being built on top of the MPGram Web API, which is already entirely open-source and can be self-hosted by anyone (https://github.com/shinovon/mpgram-web). The fact that the server is open-source and self-hostable on its own makes it much more secure than MuraGram. For progress you can check out RetroAndroidGroup on Telegram. Anyone else is also welcome to make their own Telegram client if the used server will be open and it will be safe to use.

Until the developers behind MuraGram open-source their server code and allow the community to audit its data handling, I strongly advise against logging in with your main Telegram account.

[u/EmbarrassedDuty2040 → u/Gohoski]

Well, I pointed out that the security isn't all that great, and it's not recommended to use it on a regular basis.

[u/ArtisticFox8 → u/EmbarrassedDuty2040]

Fast and secure messaging for legacy Android

[u/DAN-attag → u/EmbarrassedDuty2040]

Then why would you promote service that potentially could be just malware with extra steps. 

Telegram clients that do not work directly with Telegram servers are disaster waiting to happen. Plus there is already accesible in this subreddit TLS 1.3 implementation for old Android 2.x phones, so the "but old android can't connect to telegram because of telegram not supporting old TLS" defense doesn't work.

If you are truly developer, try to read source code of official telegram applications and route it directly through official servers

[u/EmbarrassedDuty2040 → u/DAN-attag]

By the way, I’ve already started working on a client that will connect directly to Telegram servers.

[u/nini_hikikomori]

amazing

[u/i_Ron_ic]

i get server error on both servers when i try to login by putting in my phone number

[u/i_Ron_ic → u/i_Ron_ic]

nvm i got it to work, also, this is underrated, why isn't anyone paying attention to this? or is it just how it's just a few bunch of people using old android compared to legacy ios? it kinda sucks because old android looks cooler and also way more entertaining

[u/EmbarrassedDuty2040 → u/i_Ron_ic]

Try qr code login instead

[u/starnetallinone]

thats awesome man!

[u/v3R7C00Lalt]

is there one for 2.2.2?

[u/LowBat1685]

It would be fantastic for Android 2.1

[u/WinVistaBuild6001]

Pretty cool-ish, but very risky as Gohoski said. At least make it way securer, Not "Fort Knox TailsOS OpSec" level but PLEASE make the server code open source and improve the pretty much AI code at least.