21–30 of 206 posts
Isn't this a weakness in all SMS based verification? If you can reroute SMS auth codes, it's game over. It's too bad that most 2FA rely on this method (or use it as a fallback). I don't see how it is directly related to telegram, though.
Do not let sms 2fa slide for anyone.
Earlier quoted context omitted.
Nope. First of all, everything's end-to-end encrypted and no chat logs are stored, so even if someone did do that they wouldn't have access to your chat history. Second of all, if someone tries to impersonate you, your contact gets a notification that your encryption keys have changed, ideally making the recepient slightly more vigilant. Finally, Signal has built-in (optional and not on by default) protection for the…
In Telegram the first is available opt-in, an equivalent to the second is available opt-in (key change = shows up as a different chat), and the third is equally true.
Earlier quoted context omitted.
If this is true, then Signal should be subject to the same weakness no ?
Yes it is. It’s worse for Telegram though because it gives the attacker access to the chat history too. Telegram does however send a message to all devices when a new device is logging in, so at least you would know. Signal does not do that but your contacts will get a message that your security code changed if they have the option for that enabled, but people generally ignore this message. Both services offer to set…
Because it's noisy. You get that message whenever your conversation partner switches phones or re-installs Signal. The reaction on seeing that message is more "enjoy the new phone, what did you get?" than "have you been hacked?"
Telegram accounts of opposition were hacked by belarus police as well. It's known and documented.
My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally just use one time keys and xor everything. Can do it with pen and paper.
Signal might be safe, but I think it's a honeypot.
I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…
I monitor Russian war channels and some people there insist on using Telegram only for Russian military people. If you use Whatsapp, Ukrainian officers will get all chats from NATO. Telegram accounts of opposition were hacked by belarus police as well. It's known and documented. My takeaway is that for truly private chat one should write his own software using simple crypto without all those fancy clients. Ideally ju…
Earlier quoted context omitted.
In Telegram the first is available opt-in, an equivalent to the second is available opt-in (key change = shows up as a different chat), and the third is equally true.
We know from experience that most users never change defaults. For that reason alone, Telegram‘s "secure chat" is anything but.
Earlier quoted context omitted.
If this is true, then Signal should be subject to the same weakness no ?
Yes it is. It’s worse for Telegram though because it gives the attacker access to the chat history too. Telegram does however send a message to all devices when a new device is logging in, so at least you would know. Signal does not do that but your contacts will get a message that your security code changed if they have the option for that enabled, but people generally ignore this message. Both services offer to set…
You can put a password on your telegram account.
.. can you reset that password? Using a text message?
Steps to pwn assuming you don't have access to their email:
1) insert phone number (victim receives code via telegram)
2) ask code via sms
3) intercept sms and login
4) click "reset password" on the 2fa prompt (victim receives message stating that they requested a password reset and they have 7 days to confirm their phone number (via sms) or their account will be reset)
5) wait 7 days
6) repeat steps 1-3
7) click "reset password"
8) confirm reset
9) yey you logged in as the victim, all the chat history is permanently deleted and the old sessions are invalidated kicking out the victim
Earlier quoted context omitted.
Nope. First of all, everything's end-to-end encrypted and no chat logs are stored, so even if someone did do that they wouldn't have access to your chat history. Second of all, if someone tries to impersonate you, your contact gets a notification that your encryption keys have changed, ideally making the recepient slightly more vigilant. Finally, Signal has built-in (optional and not on by default) protection for the…
Cool. But are they still closed-source?