this post was submitted on 26 Sep 2023
188 points (92.3% liked)
Technology
59174 readers
2122 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Telegram has open source their client code. Not their server code. It's even on f Droid.
But it's starting to get worse. Now they won't send you an SMS code for registration unless you are using official build of the app. Even chat app under libre licence must connect with something...
This actually is not a bad thing. If an unofficial client MITM the whole registration process, it's much harder for the true account owner to prove that he/she is the legit one.
Also, it doesn't really require a client to register; Telegram can be accessed from a browser.
If unofficial app can MITM registration, it can the same way MITM login later.
And browser version of Telegram does not allow registering new accounts also.
Compared to login, MITM on registration means the culprit knows the IP address and the time of the registration, which is usually significant on claiming the account back.
I don't have a spare number to test, but I'm pretty sure entering a phone number in the web sends a SMS code. Do you have concrete evidence that it really doesn't work?
Unfortunetly not, I must test it also.