Hacker News Reader

Comment by mtgx | Hacker News Reader

But doesn't this mean you're really logging in with your phone?

It's 2018. Why are we still trusting the phone network for anything related to authentication? Surely companies like Telegram can't use the excuse that they didn't know how horribly insecure SMS and the phone network in general is, no?

I don't know how Telegram does it, but it keeps picking the wrong security options. It's like a gift they have.

View on HN

No, in Telegram the phone number is used only as a sort of username. You can login to Telegram just with a password and the 2FA token gets to you inside the appp itself. Not SMS.

If you don't have a 2FA password enabled and you're not online on another device you can login with your phone number.

A majority of banking, at least in Europe, depends on SMS as authentificiation. As well as most other 2fa services depend on it as last resort fallback.

It's 2018 but this problem is far from solved.

(there is a lengthy rant about that somewhere in my post history)

My bank in NL requires 2 factor using a handheld chip reader that you have to feed your PIN number followed by a random number from the website.

It then calculates a second number that you send back to the bank. No SMS at all!

Telegram can layer a password on top of your mobile number in a sort of reverse-two-factor way, but it's kind of a bad joke as I've mentioned above.

I think the main motivation is making it harder to create (many) fake accounts. A phone number is probably the best trade-off between usabilty and verifiability.

Reply on news.ycombinator.com