Telegram Messenger’s newest update

You might have heard that Telegram has released arguably their biggest update of the year this week. While the backend of the messaging platform remains proprietary, the source code of the mobile and desktop clients is open source.

The big new feature is Message Translations, which allows to translate the text of messages within the app. What is interesting is how this is implemented in the official Android app.

How the Telegram Android app circumvents the official Google Cloud Translate API

Undocumented Google Translate API endpoint

If you check the official Cloud Translate REST API documentation, you will see that the official API uses a versioned API path (e.g. /language/translate/v2), and human readable query parameters, which importantly include the API key key. However, if we check Telegram’s implementation, we will notice a few things in the fetchTranslation method:

They use another path, and also seem to intentionally split up the request path with multiple string joins (perhaps for obscurity / avoid detection in the Play Store review process?):

uri = "https://translate.goo";
uri += "gleapis.com/transl";
uri += "ate_a";
uri += "/singl";
uri += "e?client=gtx&sl=" + Uri.encode(fromLanguage) + "&tl=" + Uri.encode(toLanguage) + "&dt=t" + "&ie=UTF-8&oe=UTF-8&otf=1&ssel=0&tsel=0&kc=7&dt=at&dt=bd&dt=ex&dt=ld&dt=md&dt=qca&dt=rw&dt=rm&dt=ss&q=";
uri += Uri.encode(text.toString());

We can deduce from the query string that:

• client is some kind of client caller specifier (e.g. webapp / native app?)
• sl and tl are source and target