free-mtproto-proxies
free-mtproto-proxies### What Your MTProto Proxy Operator Actually Sees: The Security Model of Free Proxies
Telegram’s MTProto protocol is not end-to-end encrypted by default. That fact alone changes how you should think about the free proxies you rely on. If you use an MTProto proxy to bypass censorship, you are trusting that proxy operator with a surprising amount of metadata—and with the security of your connection.
This post breaks down what MTProto protects, what a proxy operator can observe, and how to minimize risk when using open proxy lists. The repository at [https://github.com/dubblebyte/free-mtproto-proxies](https://github.com/dubblebyte/free-mtproto-proxies) is built for transparency, but no automated scraper guarantees good faith. You need to know what you're agreeing to.
---
The MTProto Encryption Model (What It Does and Doesn't Do)
MTProto encrypts traffic between your Telegram client and the Telegram server. The proxy sits in the middle—it does **not** have the key to decrypt your messages. That part is solid.
But encryption only covers the **content** of the communication. It does not hide:
- **The fact that you are using Telegram.** The handshake uses specific byte patterns. Censors like Iran’s DPI and Russia’s TSPU already fingerprint those patterns and block them. Fake-TLS (a feature in this repo’s proxies) tries to disguise the handshake as HTTPS traffic.
- **The destination server.** Even with encryption, the proxy operator (or a network eavesdropper) can see the IP address of Telegram’s server you are connecting to. That IP leaks whether you are talking to a chat server, a media server, or a login endpoint.
- **The size and timing of your messages.** A proxy sees the length of each encrypted packet, plus the timing between them. This is enough to infer rough user behavior (e.g., sending a large file vs. a short text).
In short: **the proxy cannot read your messages, but it can see you’re using Telegram, where you’re connecting, and how much data you send.**
---
What a Malicious Proxy Operator Could Do
Free proxies are donated by volunteers—or harvested from compromised servers. A bad actor running an MTProto proxy could:
- **Tamper with the connection.** MTProto includes some protection against replay and downgrade attacks, but misconfigured proxies or old client versions can be vulnerable. The proxy could inject malicious responses that trick your client into connecting to a fake server (man-in-the-middle attack). Telegram’s client does some certificate pinning, but it’s not foolproof.
- **Log connection metadata.** Your IP address, Telegram server IPs, connection timestamps, and duration. This information can be sold, shared, or used for surveillance.
- **Serve you an outdated or compromised proxy config.** Some proxy lists are not kept clean; they might include proxies that were once good but have been repurposed. The free-mtproto-proxies repo updates its list every hour and runs a scraper, but it cannot audit the operators.
The real risk is not that a proxy will steal your message content (that’s encrypted). The risk is that it will **correlate your behavior** across sessions, or that an adversary (state actor, ISP) will use the proxy logs to identify you.
---
How Free Proxy Lists Amplify the Risk
Most free proxy repositories scrape proxies from public channels. That means:
- Anyone can add a proxy to a Telegram channel. The repo might index it automatically.
- No operator vetting. No KYC. No escrow.
- Proxies come and go. The one you used yesterday might now be run by someone else.
The free-mtproto-proxies repository takes a community-checked approach: the source code is open, the list is refreshed frequently, and you can verify the proxy yourself before using it. But **verification is up to you**. The repo provides the raw data—transparency, not security guarantees.
---
How to Verify a Proxy Before Using It
Do not blindly trust any proxy, even from a trusted list. Here’s a practical workflow:
1. **Check the proxy’s uptime and source.** The repo’s live listing shows last-seen timestamps. If a proxy disappears and reappears, treat it with suspicion.
2. **Use Telegram’s built-in proxy test.** In Telegram go to Settings > Data and Storage > Proxy. Add the proxy, then hit the check mark. Telegram will test connectivity and latency. A successful check means the proxy works, not that it’s safe.
3. **Rotate proxies.** Do not rely on a single proxy for weeks. Use the repo’s list to switch regularly.
4. **Prefer proxies with a longer footprint.** A proxy that has been listed reliably for days is less likely to be a honeypot than one that appeared two hours ago.
5. **Consider using a VPN upstream.** If you are in a high-risk region (China, Iran), a VPN provides a different trust model (encryption of all traffic). You can run MTProto on top of a VPN for defense in depth. See the related post on [MTProto proxies for mobile](https://dev.to/humja_jaan_fca09049ae97d5/mtproto-proxies-for-mobile-battery-data-and-the-real-cost-of-staying-connec-5g39) for battery and data trade-offs.
---
Repo as a Transparent Source
The free-mtproto-proxies repository (https://github.com/dubblebyte/free-mtproto-proxies) does not hide where proxies come from. It scrapes public Telegram channels and publishes the results with metadata: proxy IP, port, secret, Fake-TLS status, and last seen time. You can run the scraper yourself. The code is simple Python.
But **transparency does not equal safety**. It means you can audit the list, check the code, and make your own risk assessment. That’s better than a black-box proxy list where you have no idea who added the entry.
---
Practical Tip: Use the tg:// Link to Add a Proxy Safely
When you find a proxy you want to try, use the official Telegram intent link format instead of manually entering secrets:
tg://proxy?server=1.2.3.4&port=443&secret=ee0000...
Telegram will open, and you can confirm the connection in one tap. This avoids copy-paste errors that could expose a typo-squatted secret. The repo’s live page provides these links for each proxy.
For more on how these proxies behave across the world’s toughest censorship zones, see the earlier post at [https://telegra.ph/free-mtproto-proxies-07-24](https://telegra.ph/free-mtproto-proxies-07-24) which covers regional blocking patterns.
---
Final Word
Free MTProto proxies are a necessity in censored regions, but they are not a security product. Treat them as a connectivity tool, not a privacy shield. Use transparent sources like the free-mtproto-proxies repo, verify every proxy, rotate frequently, and never assume the operator has your best interests at heart.
Your Telegram messages are encrypted. Your metadata is not. Act accordingly.