Is Telegram bot phone number sharing feature a sufficient way to authenticate a user?

Question

I need to integrate web application into Telegram using telegram bot. I need to do an authentication for client, and the web application authenticating user with his phone number + password. I've found interesting method of obtaining user's phone number through special button

This method seems to be quite sufficient to do authentication without user's password, since user cannot send nobody's except his phone number, and all the authentication already done by Telegram. But it's a little embarrassing for me, since I don't know how the phone sharing feature works, and how hard is it, to bypass or cheat on it.

*As the precaution, I think to do only authentication (may be even identification) through Telegram bot. And for sensitive actions will require additional authorization (but I don't know how, for now))

Answer 1

OK, it can seem insecure at first sight, but, if bot will perform user check right, it'll give 100% confidence in authenticity of user's phone number. And it's authenticity is proved by Telegram authentication mechanism (which is SMS verifcation).

As ximaera commented:

Be careful to check whether the id of the user you're communicating with matches user_id value of the contact you've received

Any telegram app sending any contact as object with first name, last name and phone number properties. There's no other ways that Telegram API allowing to do it. And the bot receiving this object with user_id appended by telegram server. This additional property equals to chat_id of user with this phone number. So, it appears that it's enough to compare user_id from contact with chat_id of user, who sent this contact.

K.B. said:

Phone numbers are pretty easily spoofed

Our webapp uses SMS-verification of phone-number during registration. The same is done by Telegram. Hence, our authentication mechanism isn't safer that Telegram's.

If the user's device is stolen/lost/otherwise compromised, the token can be revoked

If the phone is stolen/lost, and not protected with PIN/fingerprint/other, the new phone owner will have all the resources to regain control on any user's account.

Of cource, security measures are not superfluous, especially when extending the zone of trust to a third-party service. But, I think that Telegram's security way ahead of ordinary application's security, so, once integrated, it can be further used even as authorization mechanism, instead of SMS verification codes.

Answer 2

I don't have any experience with telegram specifically, but in general:

• Phone numbers are pretty easily spoofed. So using that for authentication is pretty weak.
• Requiring just a phone number would be single-factor authentication in general, not good if you're potentially dealing with any sort of sensitive/valuable data.

A better approach (and again, I don't know if this is doable in your specific instance) is to have the user authenticate with phone#/username/password once, then give the application a token it can use to authenticate in the future. This gives the benefits:

• User doesn't have to enter password each time.
• Attacker that can spoof phone number can't access user's account, they would have to have the token which is stored on the user's device.
• If the user's device is stolen/lost/otherwise compromised, the token can be revoked.
• Tokens cannot be stolen in transit as long as you're using SSL.