4 ms·

> Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. No, not really _hacked_. You give your phone unlocked to th

by orphea 4y ago

> Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. No, not really _hacked_. You give your phone unlocked to the police, and they access your Telegram account. You can't refuse, and you probably can imagine why.

consumer451 4y ago
https://www.wired.com/story/the-kremlin-has-entered-the-chat/ https://www.wired.com/story/the-kremlin-has-entered-the-chat...
- anonymoose33282 4y ago
  I actually wrote to Telegram’s support team to get more info about this, and it seems the article has a lot of errors. The support rep linked me to this, https://telegra.ph/Wired-Errors https://telegra.ph/Wired-Errors which is Telegram’s response to all of it.
  - pshirshov 4y ago
    > as no app can defend against direct access to a device. Of course you can't protect the local data from all the possible attacks but there are many ways to prevent some attacks and complicate others. So this article isn't honest. I kinda don't understand why people trust telegram. Regular messages aren't even encrypted. SMS authentication. Contact harvesting. Mandatory background run permissions (the app would constantly complain if it can't run its background tasks). Then some strange people selling users' metadata. One time I've purchased my location history for ~30 euros in TRX and it was accurate.
entropyneur 4y ago
Actually really hacked. What you said also happens of course, but hacks are routine as well. Happened to 2 people I know personally. They do it by intercepting the sms code at the cell operator level.
- chinathrow 4y ago
  I do not use Telegram: what SMS code?
  - tough 4y ago
    the Two Factor auth to validate is really you after guessing/knowing your pass from a previous leak
    - entropyneur 4y ago
      It's worse. 2FA is optional and SMS code is the first (and default) auth method.
      - super256 4y ago
        > It's worse. 2FA is optional and SMS code is the first (and default) auth method. This will be changed on Saturday. Got the following message about API changes last week: https://telegra.ph/Telegram-API-Changes-02-16 https://telegra.ph/Telegram-API-Changes-02-16
        entropyneur 4y ago
        That announcement seems to be concerned with unofficial clients only. But it does sound like the change is a part of some bigger package.
        anonymoose33282 4y ago
        But given the choice, isn't SMS a stronger first authentication factor? It's temporary and randomized, whereas users don't change passwords that frequently. So a password is much more susceptible to keyloggers/malware/brute-force than an SMS code.
  - entropyneur 4y ago
    The default authentication method is 5-digit login code received via SMS. You can enable 2FA with password being the second method, but you have to know how to do it. Worse there are 2 things called "password" there: the "cloud password" which is the 2FA password and the "password code" (that's what it's called in Russian, maybe the English interface uses a better name) which is merely a pin code for locking the Telegram app on your device. So some less tech-savvy people after hearing they need to set up a password set the latter and falsely assume they are now safe.
sangnoir 4y ago
> No, not really _hacked_. I see a number of comments similar to yours on HN, and I am legitimately curious and do not mean to offend: Why did you think Belarusian police do not hack phones? Was your comment based on any source or personal experience, or did it feel right? I ask because I have observed a number of times where HN comments are wrong on things (on have personal or professional experience in) but get upvoted because the comments look reasonable, but the correct comment gets downvoted. It's an interesting failure mode of HN discussions. I thought I'd ask you because the topic is not contentious, and hopefully this comment does not cone across as underhanded.
- proxysna 4y ago
  Because to beat up someone and order them to unlock their phone is faster, does not require trained staff, can be done anywhere and is fun for the cops. In some cases they use israeli hardware (forgot the name of the company), if you are fooled into giving your phone away for some period of time, like entering a police building, where they have a "no-phone zone" for visitors.
  - anonym29 4y ago
    Obligatory XKCD: https://xkcd.com/538/ https://xkcd.com/538/ Cellebrite and GrayKey are prominent providers of cellular DFIR hardware used by government agencies.
  - sangnoir 4y ago
    > Because to beat up someone and order them to unlock their phone is faster, does not require trained staff, can be done anywhere and is fun for the cops. The implicit assumption is that the states always go for the faster solution. I'd argue that intercepting an SMS/call is easier/faster for nation-states, than arrest and torture; most carriers worldwide have interception capabilities mandated by law: using the secret police to subvert those capabilities is not rocket science - especially when coordinating with hacking-as-a-service companies like "Team Jorge". What really grinds my gears, when someone confidently state their thought experiment/"derivation from (idealized) first principles" as a rebuttal to empirical evidence. Incidentally, the wording is sometimes absolute, which cloaks the speculative (and wrong) nature of such comments ("No, not really hacked." Implying hacking doesn't happen, and yet it does). I've seen such 'truthy' but wrong comments voted to the top on HN, because the up-voters share the same blindspot and think "Yeah, that sounds right"

by orphea 4y ago

consumer451 4y ago

https://www.wired.com/story/the-kremlin-has-entered-the-chat/ https://www.wired.com/story/the-kremlin-has-entered-the-chat...

anonymoose33282 4y ago
I actually wrote to Telegram’s support team to get more info about this, and it seems the article has a lot of errors. The support rep linked me to this, https://telegra.ph/Wired-Errors https://telegra.ph/Wired-Errors which is Telegram’s response to all of it.
- pshirshov 4y ago
  > as no app can defend against direct access to a device. Of course you can't protect the local data from all the possible attacks but there are many ways to prevent some attacks and complicate others. So this article isn't honest. I kinda don't understand why people trust telegram. Regular messages aren't even encrypted. SMS authentication. Contact harvesting. Mandatory background run permissions (the app would constantly complain if it can't run its background tasks). Then some strange people selling users' metadata. One time I've purchased my location history for ~30 euros in TRX and it was accurate.

entropyneur 4y ago

Actually really hacked. What you said also happens of course, but hacks are routine as well. Happened to 2 people I know personally. They do it by intercepting the sms code at the cell operator level.

chinathrow 4y ago
I do not use Telegram: what SMS code?
- tough 4y ago
  the Two Factor auth to validate is really you after guessing/knowing your pass from a previous leak
  - entropyneur 4y ago
    It's worse. 2FA is optional and SMS code is the first (and default) auth method.
    - super256 4y ago
      > It's worse. 2FA is optional and SMS code is the first (and default) auth method. This will be changed on Saturday. Got the following message about API changes last week: https://telegra.ph/Telegram-API-Changes-02-16 https://telegra.ph/Telegram-API-Changes-02-16
      - entropyneur 4y ago
        That announcement seems to be concerned with unofficial clients only. But it does sound like the change is a part of some bigger package.
      - anonymoose33282 4y ago
        But given the choice, isn't SMS a stronger first authentication factor? It's temporary and randomized, whereas users don't change passwords that frequently. So a password is much more susceptible to keyloggers/malware/brute-force than an SMS code.
- entropyneur 4y ago
  The default authentication method is 5-digit login code received via SMS. You can enable 2FA with password being the second method, but you have to know how to do it. Worse there are 2 things called "password" there: the "cloud password" which is the 2FA password and the "password code" (that's what it's called in Russian, maybe the English interface uses a better name) which is merely a pin code for locking the Telegram app on your device. So some less tech-savvy people after hearing they need to set up a password set the latter and falsely assume they are now safe.

sangnoir 4y ago

> No, not really _hacked_. I see a number of comments similar to yours on HN, and I am legitimately curious and do not mean to offend: Why did you think Belarusian police do not hack phones? Was your comment based on any source or personal experience, or did it feel right? I ask because I have observed a number of times where HN comments are wrong on things (on have personal or professional experience in) but get upvoted because the comments look reasonable, but the correct comment gets downvoted. It's an interesting failure mode of HN discussions. I thought I'd ask you because the topic is not contentious, and hopefully this comment does not cone across as underhanded.

proxysna 4y ago
Because to beat up someone and order them to unlock their phone is faster, does not require trained staff, can be done anywhere and is fun for the cops. In some cases they use israeli hardware (forgot the name of the company), if you are fooled into giving your phone away for some period of time, like entering a police building, where they have a "no-phone zone" for visitors.
- anonym29 4y ago
  Obligatory XKCD: https://xkcd.com/538/ https://xkcd.com/538/ Cellebrite and GrayKey are prominent providers of cellular DFIR hardware used by government agencies.
- sangnoir 4y ago
  > Because to beat up someone and order them to unlock their phone is faster, does not require trained staff, can be done anywhere and is fun for the cops. The implicit assumption is that the states always go for the faster solution. I'd argue that intercepting an SMS/call is easier/faster for nation-states, than arrest and torture; most carriers worldwide have interception capabilities mandated by law: using the secret police to subvert those capabilities is not rocket science - especially when coordinating with hacking-as-a-service companies like "Team Jorge". What really grinds my gears, when someone confidently state their thought experiment/"derivation from (idealized) first principles" as a rebuttal to empirical evidence. Incidentally, the wording is sometimes absolute, which cloaks the speculative (and wrong) nature of such comments ("No, not really hacked." Implying hacking doesn't happen, and yet it does). I've seen such 'truthy' but wrong comments voted to the top on HN, because the up-voters share the same blindspot and think "Yeah, that sounds right"