4 ms·
But doesn't this mean you're really logging in with your phone? It's 2018. Why are we still trusting the phone network for anything related to authentication?
by mtgx 9y ago
But doesn't this mean you're really logging in with your phone?
It's 2018. Why are we still trusting the phone network for anything related to authentication? Surely companies like Telegram can't use the excuse that they didn't know how horribly insecure SMS and the phone network in general is, no?
I don't know how Telegram does it, but it keeps picking the wrong security options. It's like a gift they have.
- blauditore 9y agoI think the main motivation is making it harder to create (many) fake accounts. A phone number is probably the best trade-off between usabilty and verifiability.
- gant 9y agoTelegram can layer a password on top of your mobile number in a sort of reverse-two-factor way, but it's kind of a bad joke as I've mentioned above.
- fwdpropaganda 9y agoNo, in Telegram the phone number is used only as a sort of username. You can login to Telegram just with a password and the 2FA token gets to you inside the appp itself. Not SMS.
- gant 9y agoIf you don't have a 2FA password enabled and you're not online on another device you can login with your phone number.
- herbst 9y agoA majority of banking, at least in Europe, depends on SMS as authentificiation. As well as most other 2fa services depend on it as last resort fallback. It's 2018 but this problem is far from solved. (there is a lengthy rant about that somewhere in my post history)
- X-Istence 9y agoMy bank in NL requires 2 factor using a handheld chip reader that you have to feed your PIN number followed by a random number from the website. It then calculates a second number that you send back to the bank. No SMS at all!