2 ms·

The default authentication method is 5-digit login code received via SMS. You can enable 2FA with password being the second method, but you have to know how to

The default authentication method is 5-digit login code received via SMS. You can enable 2FA with password being the second method, but you have to know how to do it. Worse there are 2 things called "password" there: the "cloud password" which is the 2FA password and the "password code" (that's what it's called in Russian, maybe the English interface uses a better name) which is merely a pin code for locking the Telegram app on your device. So some less tech-savvy people after hearing they need to set up a password set the latter and falsely assume they are now safe.

lloeki 4y ago
Only if you have one device: once you have authenticated on two devices the code is sent over Telegram to other devices you have. In that case there is no option to fall back to SMS when authenticating. I think if you lose all your devices then you're locked out, unless you have a recovery email set up. In addition, if login succeeds, an authentication warning that a new device has connected is sent to every other device, and contrary to other Telegram chat messages cannot be deleted from another device, even previously authenticated ones. The message does not show up on the new device anyway, and it has to be deleted manually, once per other device. So an attacker that would gain access cannot hide its tracks unless it has access to all Telegram-known devices simultaneously.
- entropyneur 4y ago
  > In that case there is no option to fall back to SMS when authenticating. That's not true. The option is there. (Edit: at least for now, some changes in that area are upcoming) > In that case there is no option to fall back to SMS when authenticating. The attack usually happens at night. By the time you wake up, all your chat histories are already downloaded and the secret police is on its way.
  - lloeki 4y ago
    > That's not true. The option is there. I tried it before I wrote the comment to be 100% sure, the option was not there, and it still is not. I am not sure why it is the case but I am quite sure it was the case way before as I was making sure of this back then.

lloeki 4y ago

Only if you have one device: once you have authenticated on two devices the code is sent over Telegram to other devices you have. In that case there is no option to fall back to SMS when authenticating. I think if you lose all your devices then you're locked out, unless you have a recovery email set up. In addition, if login succeeds, an authentication warning that a new device has connected is sent to every other device, and contrary to other Telegram chat messages cannot be deleted from another device, even previously authenticated ones. The message does not show up on the new device anyway, and it has to be deleted manually, once per other device. So an attacker that would gain access cannot hide its tracks unless it has access to all Telegram-known devices simultaneously.

entropyneur 4y ago
> In that case there is no option to fall back to SMS when authenticating. That's not true. The option is there. (Edit: at least for now, some changes in that area are upcoming) > In that case there is no option to fall back to SMS when authenticating. The attack usually happens at night. By the time you wake up, all your chat histories are already downloaded and the secret police is on its way.
- lloeki 4y ago
  > That's not true. The option is there. I tried it before I wrote the comment to be 100% sure, the option was not there, and it still is not. I am not sure why it is the case but I am quite sure it was the case way before as I was making sure of this back then.