4 ms·
When you add a device, you do get notified a new device was added, and if you have an existing telegram device, all future devices won't use SMS as the authoris
by spoiler 10y ago
When you add a device, you do get notified a new device was added, and if you have an existing telegram device, all future devices won't use SMS as the authorisation channel. I think the problem here is that the attackers added a device before the "original" person did.
However, allowing for a reverse-lookup of a phone numbers through its API is a privacy—and security—problem Telegram is directly responsible for, IMHO.
- MichaelGG 10y agoYeah didn't Signal spend a bit of work trying to avoid exposing users? If you have an existing Telegram device (registered before target registered), then how do they register? And wouldn't both devices get notified? Also how would they know which numbers to register? Just fundamentally seems like the software can notify you of how many devices have access, and make that visible on any change and when installing on a device. Perhaps even offering to kill existing devices.
- djiwie 10y agoAnd the brute forcing of Telegram's API shouldn't have gone unnoticed (and apparently it was, I mean, 15 million telephone numbers brute forced?)