[treeform]

I am not even a security novice, but isn't getting root on the devices basically a game over? The suggestions the author hard to encrypt the stuff in memory and on disk would just add a extra step for the attacker to find the key? If they key had to be entered by the user every time the attack can just wait until the user does so? If thats too hard... just monitor the user. With root you can just wait and take screen shots... (as the author shows) which would work for any thing the user does ever and is simpler?

[theonewolf]

Precisely. Also perhaps why Telegram didn't respond.

This is an OS-/device-level attack---not an app exploit/attack.