2

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this:

  1. Grab the mobile number, generate an OTP, cache it and send it via SMS.
  2. When the user introduced the TOTP, check whether there's an account with matching mobile number, creating it if necessary. The user is now authenticated.

My question is, how is this as safe as "tradicional" registration/login with a fixed password? If I'd be to implement the same flow on an application of mine, what pitfalls should I watch out for? How can I guarantee that a user's account is not compromised by such flow?

Improve this question
4
  • TOTP = Timed One-Time Password. There is no reason for telegram to do that. I beleive you mean "simply" OTP (one-time password).
    – Stephane
    Commented Jun 25, 2015 at 11:40
  • There is no reason because TOTP adds complexity to a system that doesn't need it. TOTP is used for cases when you want repeated authorization with a single secure exchange. This isn't the case here: a simple random password is enough. Furthermore, I can't find any reference to any document indicating a 30-seconds validity (or any expiration, really) so you might want to provide some info (30 seconds is mighty short for SMS auth, BTW)
    – Stephane
    Commented Jun 25, 2015 at 11:52
  • The security you need is determined by your app. SMS-based systems rely on the security of the phone companies - who are not incented to, for example, have strong passwords for their users. (I would also add that I prefer not to give my cell number to companies that sell advertising as a business model.)
    – nowen
    Commented Jun 29, 2015 at 18:19
  • Coincidentally they have just tied your asserted identity to your mobile phone number.
    – symcbean
    Commented Sep 23, 2015 at 15:54

1 Answer 1

Reset to default
2

The question is not if it's "as safe as" traditional password: it's not meant to achieve the same thing.

For telegram, a "user" is a phone number: anyone having access to that phone number is, by definition, an authorized user. In other words, it delegates the security of you account to you and your phone company.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .