4 ms·
Telegram's security is a joke. They show the first and last letter of your password and the length (the number of asterisks they put in the middle changes) when
by gant 9y ago
Telegram's security is a joke. They show the first and last letter of your password and the length (the number of asterisks they put in the middle changes) when you sign in. Next to some pretty bad implications (do they store the password in cleatext or just the length and two letters?) , that password is down to about 1/5 of its original entropy. Told them a year ago, they don't seem to care.
EDIT: Yes, Telegram uses passwords if you enable them. This is what the questionable query looks like: https://i.imgur.com/BAnddlg.png https://i.imgur.com/BAnddlg.png
- welder 9y agoTelegram doesn't use passwords...
- gant 9y agoFine. They call it a passcode: https://telegram.wiki/desktop/tdesktoppasscode https://telegram.wiki/desktop/tdesktoppasscode
- CiPHPerCoder 9y agoWait, how are they turning the passcode into a 2048-bit key? Is this an RSA key? How do they ensure it's not factorable, etc.?
- StavrosK 9y agoThey probably just create the key and then encrypt it with the pass code, as people usually do in these cases.
- tomsmeding 9y agoThey do? On which login do they show that information? I've only seen the kind-of two-factor one where you have to enter a code sent in a text message or with a telegram message to a different device.
- gant 9y agoTook a while for me to reinstall it, this is what it looks like (just after SMS auth): https://i.imgur.com/BAnddlg.png https://i.imgur.com/BAnddlg.png I counted the asterisks, they do in fact reveal the length of the password.
- epiceric 9y agoIsn't that a user-defined hint? Mine shows text that I manually entered the last time I changed my password.
- kozlovsky 9y agoHint is a text field that you fill in when creating a new cloud password. The hint text is generated based on password if you did not fill it yourself.
- X-Istence 9y ago> The hint text is generated based on password if you did not fill it yourself. That... is a problem.