Telegram Login for Websites

Re:Telegram Login for Websites by gant on Wednesday February 07, 2018 @11:37AM (#16325647)

Telegram's security is a joke. They show the first and last letter of your password and the length (the number of asterisks they put in the middle changes) when you sign in. Next to some pretty bad implications (do they store the password in cleatext or just the length and two letters?) , that password is down to about 1/5 of its original entropy. Told them a year ago, they don't seem to care.

EDIT: Yes, Telegram uses passwords if you enable them. This is what the questionable query looks like: https://i.imgur.com/BAnddlg.png

[ Parent | on HN ]

Re:Telegram Login for Websites by tomsmeding on Wednesday February 07, 2018 @11:53AM (#16325837)

They do? On which login do they show that information? I've only seen the kind-of two-factor one where you have to enter a code sent in a text message or with a telegram message to a different device.

[ Parent | on HN ]

Re:Telegram Login for Websites by gant on Wednesday February 07, 2018 @12:08PM (#16325988)

Took a while for me to reinstall it, this is what it looks like (just after SMS auth):

https://i.imgur.com/BAnddlg.png

I counted the asterisks, they do in fact reveal the length of the password.

[ Parent | on HN ]

Re:Telegram Login for Websites by epiceric on Wednesday February 07, 2018 @01:06PM (#16326574)

Isn't that a user-defined hint? Mine shows text that I manually entered the last time I changed my password.

[ Parent | on HN ]

Re:Telegram Login for Websites by kozlovsky on Wednesday February 07, 2018 @01:12PM (#16326629)

Hint is a text field that you fill in when creating a new cloud password. The hint text is generated based on password if you did not fill it yourself.

[ Parent | on HN ]

Re:Telegram Login for Websites by X-Istence on Wednesday February 07, 2018 @02:04PM (#16327077)

> The hint text is generated based on password if you did not fill it yourself.

That... is a problem.

[ Parent | on HN ]

Re:Telegram Login for Websites by welder on Wednesday February 07, 2018 @11:53AM (#16325825)

Telegram doesn't use passwords...

[ Parent | on HN ]

Re:Telegram Login for Websites by gant on Wednesday February 07, 2018 @12:04PM (#16325954)

Fine. They call it a passcode:

https://telegram.wiki/desktop/tdesktoppasscode

[ Parent | on HN ]

Re:Telegram Login for Websites by CiPHPerCoder on Wednesday February 07, 2018 @12:16PM (#16326078)

Wait, how are they turning the passcode into a 2048-bit key? Is this an RSA key? How do they ensure it's not factorable, etc.?

[ Parent | on HN ]

Re:Telegram Login for Websites by StavrosK on Wednesday February 07, 2018 @11:25PM (#16330160)

They probably just create the key and then encrypt it with the pass code, as people usually do in these cases.

[ Parent | on HN ]