3 ms·

Seems like a security issue too. User could be phished from another user's number, or the user relaying messages can intercept OTP codes?

• gruez 3y ago
  > Seems like a security issue too. User could be phished from another user's number While this is an issue in theory, it's probably not that big of an issue in practice because you need to get lucky (ie. all of out of all the relays your phone has to be chosen). Depending how much telegram cares about security they can also implement countermeasures to frustrate this (eg. sending the codes in two parts from multiple numbers, so you need to get lucky twice rather than once; or switching to sending it themselves if too many codes are being requested and/or the login is otherwise high risk). > or the user relaying messages can intercept OTP codes? It definitely can be intercepted, especially if you have a rooted phone. Even barring that, at the very least you can intercept it at the cellular network level. This isn't as hard to pull off as you think, you don't need to set up a full blown MNVO, there are many IOT/M2M connectivity providers that allow you to set up a private network and arbitrarily route IP/SMS/voice.