Re:Why I won't recommend Signal anymore
by haffenloher on Saturday November 05, 2016 @09:39PM
(#12882976)
I think tptacek was talking about actual takeovers of Telegram accounts. AFAIK there have been documented cases of this in Iran and Russia. See e.g. https://www.fredericjacobs.com/blog/2016/01/14/sms-login/
Nothing in that article proves that the accounts were actually directly hacked or mentions whether they had 2FA enabled or not.
Re:Why I won't recommend Signal anymore
by codedokode on Saturday November 05, 2016 @09:49PM
(#12883015)
Then it is a serious problem for Telegram and any app that relies on SMS or some phone identity to restore access to an account.
Telegram sends activation code to known devices, no sms (and I don't remember when it happened, maybe 4 years ago, probably for all other competitors). Also creators of telegram told everyone to use secret chats if conversations are secret to ensure p2p and forward secrecy. And to check key fingerprints to identify peers.
As usual, security threads consist of ancient beliefs, non-users and stories of low-conscious people using high-tech software. And there is always someone who mentions whatsapp as an alternative. Things like wickr are not even mentioned here.
Not a problem for Telegram, as you can protect your account with a password.
I just wanted to add some details: someone checked the Iranian phone numbers range at Telegram servers and learned which of them are registred with Telegram. Message contents or contact lists were not obtained.
I guess this attack could be done with other apps that use phone numbers and phone contact lists for identification.