Telegram is privacy nightmare (personal number leak and OTP hijack)

Super late to this party. I only became aware of it a couple of months ago through a friend who ran into this issue and asked for my help.

Telegram is charging for SMS verification in some regions, and that’s unacceptable. The fact that the way they do it is by using your phone number as a relay for SMS login codes makes it even worse.

The Telegram subreddit is filled with posts complaining about this SMS Fee.

So far the regions I’ve seen affected by this include the US, some European countries, some Asian countries, and the Middle East.

WORKAROUND:

The only working workaround I’ve seen reported is to install an older version of Telegram on Android, specifically v.11.7.3. However, I’ve read that for some people it’s no longer working. I don’t think there are any workarounds for iPhone since I don’t think you can download an older version of an app on a new device if a new one exists.

THINGS I DON’T GET:

  1. If Signal can afford SMS verification in “expensive” countries, why can’t Telegram?

The way I see it, Telegram is punishing people who live in poorer countries, which I am guessing is a huge chunk of their user base.

  1. Why is SMS verification required when you are logged to another device?

This issue doesn’t just affect people who are signing up to Telegram for the first time. It also affects all existing users who want to log in on a new device, specifically a new phone. Unlike Signal, Telegram allows you to use their app on multiple phones. Although logging in on other types of secondary or third device will not require SMS verification, doing it on a second phone will. Even though I have mixed feelings about this, one could argue this measure is sensible.

  1. Why is SMS verification required when you are logged on other devices and have 2FA enabled?

Telegram allows you to enable 2FA with a password and email address. When you enable it, you won’t be able to log into a new device without them. It doesn’t make sense to me to force users who have 2FA on to pay for verification via SMS when they have other means to verify themselves.

And those who don’t have 2FA on but are already logged into at least one device, should be able to enable it and avoid the SMS verification.

  1. Why does SMS verification require an email, and why are some email providers blocked?

From what I heard, some people, regardless of if they have 2FA enabled or not, are required to provide an email address to receive a code for SMS verification. However, for a lot of email domains, although the code is received, it is not accepted when it is entered. For others, it is. It makes zero sense. Even when the code is accepted, you are presented with the screen asking you to pay for SMS verification.

  1. Why is the only way to pay for SMS verification via P2P?

TELEGRAM DOESN’T CARE ABOUT PRIVACY:

This is terrible for privacy and terrible implementation on Telegram’s part. They are an awful company. There’s a part of me that hates them more than WhatsApp because at least WhatsApp users are more aware that their data is being exploited. Telegram and its founder, Pavel Durov, have a cult grip on their users. I don’t know what it will take to break the curse.

1 Like