4 ms·

Isn't this a weakness in all SMS based verification? If you can reroute SMS auth codes, it's game over. It's too bad that most 2FA rely on this method (or use

Isn't this a weakness in all SMS based verification? If you can reroute SMS auth codes, it's game over. It's too bad that most 2FA rely on this method (or use it as a fallback). I don't see how it is directly related to telegram, though.

lxgr 4y ago
The only thing worse than SMS-2FA is SMS-1FA, which I believe is Telegram‘s default.
- chinathrow 4y ago
  Well, what is WhatsApps default then?
  - lxgr 4y ago
    What does WhatsApp‘s authentication model have to do with whether Telegram‘s is secure or not? Additionally, if you take over somebody‘s WhatsApp account, you can send and receive new messages in their name and very visibly kick them out of their account themselves. With Telegram, the legitimate owner stays logged in (so you can see what they write and read in addition to sending your own messages), and you get their entire chat history on top of that.
- grishka 4y ago
  It's the default but you can set up a password as your second factor. You should really do that if your Telegram account is important to you.
b4je7d7wb 4y ago
How can you not see how bad security practise of Telegram is not directly related to Telegram? Do not let sms 2fa slide for anyone.
- foul 4y ago
  Since some months, it's more a users' bad sec practice: Telegram offers on sale virtual numbers[1] with a crypto dumbery, you can buy a virtual number for 40-something $ and then log in with their wallet. Should be safer than having the SMS code rerouted but I can't say how much safer that way would be. [1]: https://fragment.com/numbers?sort=price_asc&filter=sale https://fragment.com/numbers?sort=price_asc&filter=sale
valdiorn 4y ago
> If you can reroute SMS auth codes, it's game over. Except it's absolutely trivial to do so, just bribe a low ranking employee of the phone company, and it's done. This has been done thousands/millions of times, usually targeting Bitcoin holders. Just google "Simjacking" I absolutely loathe when companies make me use SMS as 2FA. I flat out refuse to use the service if they force SMS for account recovery, because at that point you might as well just be sending plaintext passwords over the internet, because you clearly don't care about your customers safety. Oh, and the amount of hoops you have to jump through to make Gmail NOT use SMS for account recovery is insane.
- jamespo 4y ago
  millions of times?
  - Lalabadie 4y ago
    It's a routine operation for even small-time groups. One million requires: 10 000 contacts spread across phone operators around the whole world, each enabling 100 sim swaps over time. I suspect this doesn't take so long to fulfill.
- jeroenhd 4y ago
  Telegram actually uses SMS as the first factor. You can set a password as well, but that's an optional second factor. That said, Telegram isn't very secure at all. You can make it secure by sacrificing all kinds of conveniences (i.e. not taking part in group chats) but the platform is just too unreliable. It's a shame their apps work so well because the underlying protocol and security are behind on all of their competitors. From iMessage to WhatsApp and from FB Messenger to XMPP, encrypted group chats can be enabled easily. Only SMS/MMS is a less secure way to group chat.
- tialaramex 4y ago
  > Oh, and the amount of hoops you have to jump through to make Gmail NOT use SMS for account recovery is insane. GMail is as I understand it just your Google account, and so simply telling Google not to use the Phone for account recovery, by deleting that option if present, or not adding it when Google suggests you might want it, ought to be enough. Does that not work ?
notdang 4y ago
From what I've heard from my Russian colleagues quite a lot of people have an alternative number they register telegram with. The SIM card is never stored in the main phone. Also it was popular to buy a phone number in countries like Finland and keep it alive by making small payments. Obviously you never use this number directly in Russia. The was a method to read the SMS messages online.

lxgr 4y ago

The only thing worse than SMS-2FA is SMS-1FA, which I believe is Telegram‘s default.

chinathrow 4y ago
Well, what is WhatsApps default then?
- lxgr 4y ago
  What does WhatsApp‘s authentication model have to do with whether Telegram‘s is secure or not? Additionally, if you take over somebody‘s WhatsApp account, you can send and receive new messages in their name and very visibly kick them out of their account themselves. With Telegram, the legitimate owner stays logged in (so you can see what they write and read in addition to sending your own messages), and you get their entire chat history on top of that.
grishka 4y ago
It's the default but you can set up a password as your second factor. You should really do that if your Telegram account is important to you.

b4je7d7wb 4y ago

How can you not see how bad security practise of Telegram is not directly related to Telegram? Do not let sms 2fa slide for anyone.

foul 4y ago
Since some months, it's more a users' bad sec practice: Telegram offers on sale virtual numbers[1] with a crypto dumbery, you can buy a virtual number for 40-something $ and then log in with their wallet. Should be safer than having the SMS code rerouted but I can't say how much safer that way would be. [1]: https://fragment.com/numbers?sort=price_asc&filter=sale https://fragment.com/numbers?sort=price_asc&filter=sale

valdiorn 4y ago

> If you can reroute SMS auth codes, it's game over. Except it's absolutely trivial to do so, just bribe a low ranking employee of the phone company, and it's done. This has been done thousands/millions of times, usually targeting Bitcoin holders. Just google "Simjacking" I absolutely loathe when companies make me use SMS as 2FA. I flat out refuse to use the service if they force SMS for account recovery, because at that point you might as well just be sending plaintext passwords over the internet, because you clearly don't care about your customers safety. Oh, and the amount of hoops you have to jump through to make Gmail NOT use SMS for account recovery is insane.

jamespo 4y ago
millions of times?
- Lalabadie 4y ago
  It's a routine operation for even small-time groups. One million requires: 10 000 contacts spread across phone operators around the whole world, each enabling 100 sim swaps over time. I suspect this doesn't take so long to fulfill.
jeroenhd 4y ago
Telegram actually uses SMS as the first factor. You can set a password as well, but that's an optional second factor. That said, Telegram isn't very secure at all. You can make it secure by sacrificing all kinds of conveniences (i.e. not taking part in group chats) but the platform is just too unreliable. It's a shame their apps work so well because the underlying protocol and security are behind on all of their competitors. From iMessage to WhatsApp and from FB Messenger to XMPP, encrypted group chats can be enabled easily. Only SMS/MMS is a less secure way to group chat.
tialaramex 4y ago
> Oh, and the amount of hoops you have to jump through to make Gmail NOT use SMS for account recovery is insane. GMail is as I understand it just your Google account, and so simply telling Google not to use the Phone for account recovery, by deleting that option if present, or not adding it when Google suggests you might want it, ought to be enough. Does that not work ?

notdang 4y ago

From what I've heard from my Russian colleagues quite a lot of people have an alternative number they register telegram with. The SIM card is never stored in the main phone. Also it was popular to buy a phone number in countries like Finland and keep it alive by making small payments. Obviously you never use this number directly in Russia. The was a method to read the SMS messages online.