A session key that never leaves the browser
the problem
Reading the channels an account follows needs a real Telegram session, and a session string is as good as the account itself. Parking one on a server makes the reader a target worth attacking.
what I did
The session is created and kept in the browser, and the sign-in screen says so plainly rather than quietly. There is no account store to breach, and the warning is part of the interface, not buried in a policy page.
