14 ms·
‘I will show you how safe Telegram is’
- brink 4y agoYou can put a password on your telegram account.
- lallysingh 4y ago.. can you reset that password? Using a text message?
- guitarlimeo 4y agoYou actually can't, if you forget the password, the account will remain indefinitely locked (and deleted after 6 months of inactivity if you haven't changed the default time).
- DoctorMckay101 4y agoTechnically yes but it takes 1 more step. afaik (maybe I'm wrong) you can only reset a Telegram cloud password with a recovery email address. And you can maybe access that email address through a SMS based recovery. Having your Telegram account with a cloud password and the recovery email locked with a safe 2FA method "should be safe".
- dxuh 4y agoThe other answer to your comment says that you can't, so it's possible the the feature is broken or something? But you can configure a recovery email, which is supposed to be used, if you forget your password. But I have not used it yet.
- ShowalkKama 4y agoYou can but it takes 7 days and it's really noisy Steps to pwn assuming you don't have access to their email: 1) insert phone number (victim receives code via telegram) 2) ask code via sms 3) intercept sms and login 4) click "reset password" on the 2fa prompt (victim receives message stating that they requested a password reset and they have 7 days to confirm their phone number (via sms) or their account will be reset) 5) wait 7 days 6) repeat steps 1-3 7) click "reset password" 8) confirm reset 9) yey you logged in as the victim, all the chat history is permanently deleted and the old sessions are invalidated kicking out the victim
- anonymoose33282 4y agoNo, you can only reset it with an email (that you add when setting up the password) or using an already-active device.
- T3OU-736 4y agoSo, the twitter post alludes to SS7, but it is not clear how it is (ab)used to do the Telegram-related exploitation. Presumably, SS7's design flaws are being used intercept Telegram's registration verification messages, placing the resulting Telegram accounts under control of the bad actors while appearing to be real, independent users (and so aiding in establishing their credibility, which leads to other things), but that is a bit... handwave-y.
- super256 4y agoTelegram allows logins per SMS code (they will be rolling out changes in two days). So as long as you knew the number of your victim and have the ability to re-route SMS, you were able to login to other people’s accounts. Of course this can be easily mitigated by setting a “cloud password”, but I guess most people don’t do that.
- rakoo 4y agoIf this is true, then Signal should be subject to the same weakness no ?
- input_sh 4y agoNope. First of all, everything's end-to-end encrypted and no chat logs are stored, so even if someone did do that they wouldn't have access to your chat history. Second of all, if someone tries to impersonate you, your contact gets a notification that your encryption keys have changed, ideally making the recepient slightly more vigilant. Finally, Signal has built-in (optional and not on by default) protection for these types of attacks which require a PIN after activating the number on a new device, making SIM swap attacks useless without PIN as the second factor: https://support.signal.org/hc/en-us/articles/360007059792-Signal-PIN#manage_registration_lock https://support.signal.org/hc/en-us/articles/360007059792-Si...
- rakoo 4y agoIndeed, you're right: the worst that can happen is that chat recipients would see a "your security number has changed". But nothing will happen when talking to a whole new person, or when you join a group you've never been in before.
- mellosouls 4y agoBetter to link to the actual story (Guardian in partnership with a few others): https://www.theguardian.com/world/2023/feb/15/revealed-disinformation-team-jorge-claim-meddling-elections-tal-hanan https://www.theguardian.com/world/2023/feb/15/revealed-disin... Covered already on HN: https://news.ycombinator.com/item?id=34800157 https://news.ycombinator.com/item?id=34800157 https://news.ycombinator.com/item?id=34803779 https://news.ycombinator.com/item?id=34803779 Etc
- sdiacom 4y agoSpeaking of the actual story, how come they put all of this effort into unmasking this guy, discussing the consequences of his actions to the integrity of democracies... but then he says "I hack into Telegram accounts by using an SS7 vulnerability", and they just copy and paste that verbatim into the story, not even bothering to explain it in the slightest? Obviously it's because they themselves don't know what it means, so it just gets filtered by their brain as nonsense tech words. But is it really that hard for them to reach out to a tech person and ask them "hey, what does it mean that they use an SS7 vulnerability to hack into Telegram accounts?", so that they can explain "Oh, that means they're impersonating your phone number, so that when Telegram sends you an SMS to verify that it's you, they receive that SMS on your behalf and can log in to your Telegram account"? It baffles me, because it would take so little effort for them to provide this additional context into how the actual hacking is done, in a way that is understandable and interesting for the average non-tech person, and yet... they just don't bother to? Somehow this seems to only be acceptable for tech stuff. If when they found out that this guy was involved in the Nigerian elections, the reporter shrugged and said "Huh, Nigeria. I wonder what a Nigeria is. Anyway, not worth Googling it or checking whether it has any relevance to the story whatsoever" then everyone would agree he's doing a disservice to the story and to the public. Yet somehow this is routinely done with technical terms, the public is worse off because basic things are hidden to them behind inscrutable acronyms by lazy reporters, and no one bats an eye.
- googlryas 4y agoThe SS7 might just be a cover for a basic spear phishing attack. Otherwise I'm not sure why to demo it you wouldn't hack the actual politician's phone, instead of just doing his assistant.
- unyttigfjelltol 4y agoIronic to see a thread on Twitter (of all platforms) complaining about "political activity happens on a handful of platforms [sic] makes the tooling for political manipulation really interoperable."
- deleted 4y ago[deleted]
- throwaway13337 4y agoIsn't this a weakness in all SMS based verification? If you can reroute SMS auth codes, it's game over. It's too bad that most 2FA rely on this method (or use it as a fallback). I don't see how it is directly related to telegram, though.
- lxgr 4y agoThe only thing worse than SMS-2FA is SMS-1FA, which I believe is Telegram‘s default.
- chinathrow 4y agoWell, what is WhatsApps default then?
- lxgr 4y agoWhat does WhatsApp‘s authentication model have to do with whether Telegram‘s is secure or not? Additionally, if you take over somebody‘s WhatsApp account, you can send and receive new messages in their name and very visibly kick them out of their account themselves. With Telegram, the legitimate owner stays logged in (so you can see what they write and read in addition to sending your own messages), and you get their entire chat history on top of that.
- grishka 4y agoIt's the default but you can set up a password as your second factor. You should really do that if your Telegram account is important to you.
- b4je7d7wb 4y agoHow can you not see how bad security practise of Telegram is not directly related to Telegram? Do not let sms 2fa slide for anyone.
- foul 4y agoSince some months, it's more a users' bad sec practice: Telegram offers on sale virtual numbers[1] with a crypto dumbery, you can buy a virtual number for 40-something $ and then log in with their wallet. Should be safer than having the SMS code rerouted but I can't say how much safer that way would be. [1]: https://fragment.com/numbers?sort=price_asc&filter=sale https://fragment.com/numbers?sort=price_asc&filter=sale
- vbezhenar 4y agoI monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally just use one time keys and xor everything. Can do it with pen and paper. Signal might be safe, but I think it's a honeypot.
- deleted 4y ago[deleted]
- golergka 4y agoBefore doing anything related to security, you should always understand what your threat profile is. If you don't have a real probability that a state actor will go after you, most likely your threat model will include scams and criminals. And unless you're a wealthy individuals, most of these scams will be automated, not hand-tailored.
- ShowalkKama 4y agotelegram isn't e2e encrypted (unless you use secret chats which nobody does (and those do not support more than 2 participants))
- tapoxi 4y agoNot only that but they've made suspicious ties with the Kremlin that resulted in it being unblocked in Russia and have a mysterious source of funding after TON collapsed.
- throwaway13337 4y agoI'd love to hear more about this. I thought Pavel Durov (founder) isn't really welcome in Russia. He seems to have a left a lot of money on the table with his previous company (VK) to get out of there. The interpretation of events with telegram I've always heard has been that Russia tried to block telegram but doing so blocked most of the rest of useful services as telegram was hosted on e.g. AWS. This meant that real work was slowed. In the end, they gave up because continuing the block would mean crippling their access to the internet. I have found it weird that pro-putin russians still use telegram. But it seems like a lack of discipline which is quite the plague of russian military. I'd genuinely love to get good information on this as I use telegram as it is a great piece of technology and wouldn't if it were collaborating with russian government. I think a lot of rumors do not distinguish between russian people and russian government. And that's pretty damaging.
- NayamAmarshe 4y agoSmoke and mirrors, this post. Maybe replace Telegram with SS7 and it would make more sense.
- lxgr 4y agoIf a service uses a known insecure authentication method, how is that the fault of the authentication and not the service?
- jeroenhd 4y agoMost serfkces use insecure authentication methods, especially in the messenger space. They're almost exclusively built around your phone number being the guiding proof of your identity.
- lxgr 4y agoTrue, but in most of them, you can‘t recover past conversations using SMS-OTP alone. Authentication should be proportional to what it‘s protecting.
- washadjeffmad 4y ago"Here he is demoing access to the #Gmail of a purported key political insider in #Kenya just days before the election." Odd choice of title when the subject of the thread is exposing compromise of elections using vulnerabilities not necessarily native to Gmail or Telegram.
- est 4y agoTelegram's idea of binding phones is really strange. Perhaps it's a measurement against spam?
- thehonest 4y agoAnyone who share’s twitter links, should be kindly asked not to.
- prhrb 4y agoIts scary
- rejectfinite 4y agoBy default Telegram is not E2E encrypted.
- VincentEvans 4y ago[flagged]
- kamranjon 4y ago"Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting." - https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- VincentEvans 4y agoIt appears that frustration with twitter threads is too common to be interesting. Not unexpected.
- dang 4y agoThat's correct. The reason we don't want such comments isn't that they're unjustified, it's that they're repetitive.
- morjom 4y agoIf only for this twitter thread, you can comment with "unroll" on twitter to get one of these https://threadreaderapp.com/thread/1625719023081082880.html https://threadreaderapp.com/thread/1625719023081082880.html
- VincentEvans 4y agoI don’t have a twitter account. I just followed a link because the linked content seems interesting. But thank you for the tip!
- Rebelgecko 4y agohttps://www.theguardian.com/world/2023/feb/15/revealed-disinformation-team-jorge-claim-meddling-elections-tal-hanan https://www.theguardian.com/world/2023/feb/15/revealed-disin...
- skrowl 4y ago[dead]
- jedberg 4y agoThe biggest risk of any encrypted chat is that the op-sec of the recipient isn't as good as yours. No matter what steps you take, you can't prevent the other person from being dumb.
- jcelerier 4y agoAll fine and dandy but so far I have lost entire conversations on signal, whatsapp and matrix while this never happened to me on telegram, which is the number one thing that matters to me.
- sangnoir 4y agoRetrieving the victim's entire chat history is also the number one thing that matters to hackers.
- wkat4242 4y agoThe guy mentioned SS7 and SMS hacks, coincidentally I got a message from telegram yesterday that they are deprecating SMS confirmation.
- kozak 4y agoFor me personally, the main argument against Telegram is that its development and operations team is physically located in Russia. This means that they can very easily be bribed and/or intimidated into any type of collaboration with their state.
- stiltzkin 4y agoNow you can buy phone numbers as NFTs, no SMS authentication required.
- dredmorbius 4y agoThere's a broader question I've been raising for a number of years now, about how major online service providers address the brownshirt threat. I'd first raised that in 2016 on the now-defunct Google+, entirely coincidentally on the anniversary of Kristallnacht: <https://web.archive.org/web/20170604101018/https://plus.google.com/104092656004159577193/posts/foKDxbyhYUF https://web.archive.org/web/20170604101018/https://plus.goog...> Telegram seems to either have turned or been compromised from the start. Given transitions closer to HN's home, Twitter's userpation by an alt-right zottanaire would be another case in point. Ironically, Yonatan Zunger and Lea Kissner (to whom I'd addressed much of that post's message) were both at Twitter when Musk acquired it, though both have since left. (Zunger was G+'s chief architect, Kissner lead a security team there. For all its various faults, G+ had relatively little co-option by fascists, something I had an opportunity to assess during the site's shutdown, by way of the 8-million-odd Communities that existed, some with clearly white nationalist / antisemitic, or other bents, virtually all of which were inactive for years by the time I looked at them (late 2018 / early 2019), whilst at the same time legitimate use of terms such as "Aryan" in an Indian/Hindu context were generally active. Google+ managed to avoid the Scunthorpe Problem. Mediated communications, particular the electronic / digital / AI variants ... are seeming increasingly fraught. The Telegram story is a bump on that node. Thought as I write this: Telegram's namesake, the original telegraph, was itself notably used to intercept and alter communications back in the day, notably news of the outcome at Waterloo and by agents of Standard Oil.
- celestialpeasan 4y agoI'm in China, and I just see people learning about this the very hard way. There were many unusual unrests and crackdowns recently. SMS is definitely a weak spot without a second thought. The state actor can easily analyse and reroute then pull off a massive list of names straight to gulag.