even if you have a password in Telegram as a second factor, Telegram can bypass it anyways; and the user isn't even asked