The default authentication method is 5-digit login code received via SMS. You can enable 2FA with password being the second method, but you have to know how to do it. Worse there are 2 things called "password" there: the "cloud password" which is the 2FA password and the "password code" (that's what it's called in Russian, maybe the English interface uses a better name) which is merely a pin code for locking the Telegram app on your device. So some less tech-savvy people after hearing they need to set up a password set the latter and falsely assume they are now safe.

Only if you have one device: once you have authenticated on two devices the code is sent over Telegram to other devices you have. In that case there is no option to fall back to SMS when authenticating. I think if you lose all your devices then you're locked out, unless you have a recovery email set up.

In addition, if login succeeds, an authentication warning that a new device has connected is sent to every other device, and contrary to other Telegram chat messages cannot be deleted from another device, even previously authenticated ones. The message does not show up on the new device anyway, and it has to be deleted manually, once per other device. So an attacker that would gain access cannot hide its tracks unless it has access to all Telegram-known devices simultaneously.

> In that case there is no option to fall back to SMS when authenticating.

That's not true. The option is there. (Edit: at least for now, some changes in that area are upcoming)

> In that case there is no option to fall back to SMS when authenticating.

The attack usually happens at night. By the time you wake up, all your chat histories are already downloaded and the secret police is on its way.

> That's not true. The option is there.

I tried it before I wrote the comment to be 100% sure, the option was not there, and it still is not.

I am not sure why it is the case but I am quite sure it was the case way before as I was making sure of this back then.

the Two Factor auth to validate is really you after guessing/knowing your pass from a previous leak

It's worse. 2FA is optional and SMS code is the first (and default) auth method.

> It's worse. 2FA is optional and SMS code is the first (and default) auth method.

This will be changed on Saturday.

Got the following message about API changes last week: https://telegra.ph/Telegram-API-Changes-02-16

That announcement seems to be concerned with unofficial clients only. But it does sound like the change is a part of some bigger package.

But given the choice, isn't SMS a stronger first authentication factor? It's temporary and randomized, whereas users don't change passwords that frequently. So a password is much more susceptible to keyloggers/malware/brute-force than an SMS code.