This is as bad as a breach
Hackers accessed Telegram messaging accounts in Iran – researchers
21–30 of 66 posts
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#22Anything that involves SMS, SS7 and the legacy PSTN phone network cannot be relied upon for anything crypto related... Sending auth keys/codes by SMS, really? I understand it was a decision made to have the system be easy to use, but it's foolish in my opinion.
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#23Anything that involves SMS, SS7 and the legacy PSTN phone network cannot be relied upon for anything crypto related... Sending auth keys/codes by SMS, really? I understand it was a decision made to have the system be easy to use, but it's foolish in my opinion.
If the crypto is solid the transport is irrelevant. This points to deeper vulnerabilities. IP networks are no safer than SMS.
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#24Earlier quoted context omitted.
Facebook relies on SMS. Whatsapp relies on SMS. VK relies on SMS. Viber relis on SMS. Are we going to say that all of those have been breached too?
Potentially. Of course, you won't see it too often in the headlines..
I know that some people here are suspicious of Telegram because they use their own encryption mechanism, but it's like there's an active campaign against it by the media. In my country the media has been calling it the "ISIS chatting app".
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#25Telegram has had 2FA since years!
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#26Earlier quoted context omitted.
Well, a lot of MFA is done through SMS. I believe sides like Tumblr and Twitter do that? At least I am asked to do SMS authentication for those sites. Maybe it's a setting I checked off.
NIST says SMS is not secure enough for 2FA http://www.cnet.com/news/nist-set-to-ban-sms-based-two-facto...
Thanks. This is a good reference I can share with folks internally.
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#27Earlier quoted context omitted.
Potentially. Of course, you won't see it too often in the headlines..
I know that some people here are suspicious of Telegram because they use their own encryption mechanism, but it's like there's an active campaign against it by the media. In my country the media has been calling it the "ISIS chatting app".
Nothing to do with that. Authentication is an essential pillar of a security app, and the ability to effectively authenticate is an important component of opsec. If SMS is compromised (and it is not hard to imagine given how protective govt is about SMS exploits/sigint) then the authentication aspect of any app that relies on SMS is also potentially compromised. Weakest link and all that...
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#28Anything that involves SMS, SS7 and the legacy PSTN phone network cannot be relied upon for anything crypto related... Sending auth keys/codes by SMS, really? I understand it was a decision made to have the system be easy to use, but it's foolish in my opinion.
If the crypto is solid the transport is irrelevant. This points to deeper vulnerabilities. IP networks are no safer than SMS.
I realize this was a use of sending short authentication codes by SMS, but at 160 characters the crypto can't be solid, if somebody decided to implement proper public/private key over it. So the transport is definitely a problem.
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#29Earlier quoted context omitted.
You mean Two Factor yeah? Because telegram already relies on two step.
SMS is the first factor in the case of Telegram. The 2-step authentication Telegram provides is through email.
Nope, the second factor is a password you must type in after inserting the sms code.
Re: Hackers accessed Telegram messaging accounts in Iran – researchers
#30Earlier quoted context omitted.
Facebook relies on SMS. Whatsapp relies on SMS. VK relies on SMS. Viber relis on SMS. Are we going to say that all of those have been breached too?
Potentially. Of course, you won't see it too often in the headlines..
Ah, yes. Then let's add the cardiovascular system since humans rely on it to press screens or keys to use telegram. What else has been potentially hacked ? The moon ?