234

TL;DR: No, Telegram is not secure. I'd like to ignore the comparison to WhatsApp because WhatsApp does not advertise itself as a "secure" messaging option. I'd like to instead focus on whether Telegram is secure. Telegram's security is built around their home spun MTProto protocol. We all know that the first rule of Cryptography is Don't Roll Your Own ...


98

tl;dr No, this completely falls within the realms of fiction! The longer explanation For something like this to work, Alice would need to find an exploit in the camera of Bob, which would then prevent Bob from taking a picture. The only ways of Alice to exploit Bob's camera is for her to send some kind of information to it. Possible ways for her to do ...


72

TLDR: There are several categories of security you must consider when looking for a phone. The main advice, though, is to get a newer phone with the latest security features, and from a manufacturer that has a good reputation of providing updates. Security against other people (peers, police/government) Look for newer devices with full disk encryption, ...


72

Unless you have secrets on that phone that someone would pay a lot of money to uncover, you don't need to go overboard. A factory reset would work just fine. To decrease the chances someone would still recover something, point the camera out of the window and let it record until it fills up all memory. Repeat if you want. Doing that will overwrite almost ...


68

By just passing (potentially malicious) traffic through, it is very unlikely. After all, routers on the Internet are relaying tons of malicious traffic everyday without getting compromised themselves. However the danger begins when your computer itself gets compromised from a malicious file downloaded via torrents, and from there the malware on your ...


64

Has the security of the basic phone call changed much, in the last 10 years ? So, do smartphones utilise anything new [purely in] the initiation and connection of just the phone call itself ? Yes. There are new technologies used to establish phone calls in cellular networks. Those new technologies mitigate some attacks which were possible due to flaws ...


59

One of the key aspects to consider for this is the support/patching policy of your mobile device vendor. If you're planning to keep the phone for say 2-3 years you don't want it to go out of support after 18 months. Unfortunately this can be quite tricky information to come across with many vendors not providing published support lifecycles. Also ...


49

Under the assumption that you have a somewhat recent phone (Android 6+ installed from factory, I don't know for Apple but read something about from iPhone 6 on): Wipe the phone/do a factory reset (assuming the phone is still working) Modern devices always encrypt all the data and only delete the key for this encryption if you wipe it. This makes it ...


43

There is nothing stopping an attacker from putting a powerline ethernet transceiver as well as a USB-enabled microcontroller into a USB charger. This would allow them to communicate with the charger in the hope to offload some malware onto a smartphone plugged into that port. However, such a device would need to be highly specialized and specifically ...


41

I don't understand why you don't want a password manager that works on both? Your non-tech friends that don't use a password manager yet are too limited by your requirements. You seem to be running in paranoid mode. Your friends want something that is convenient. If you can get them to move to Lastpass, that will be a huge improvement over their current ...


37

The other answers regarding encryption are great. I'm going to approach this question from the tinfoil / dissident angle, as I believe it's valid for nearly every scenario... but I still want to explain my reasoning, and how I came to these conclusions. All of the problems I'll discuss are routinely exploited by criminals, and repressive governments. In ...


33

Data dealers often buy data from multiple sources and aggregate it to generate an all-compassing user-profile from it. For example: xyz company sold your telephone number and what the conversation was about. social network which asks for your phone number for password recovery sold your telephone number and your ip address at some point in time. ...


32

When your phone is acting as a hotspot it's basically just a router connecting two protocols together (802.11 and either LTE or GSM). It's not actually interpreting any of the data passing though, as that would use a lot more CPU and memory. It's literally just passing data back and forth at OSI Layers 2 and 3. That said, it's no different than other ...


27

If you have a phone with a removable main battery, you can try this: Disable the cellular network, GPS, WiFi, Bluetooth etc on your phone by turning them off manually and then putting the phone into flight mode. Make a note of the current time shown on the phone and on your PC by writing it down on paper. Shut down the phone, remove the main battery and the ...


22

Case in point: Snowden uses a feature phone (i.e. 'dumb phone). A few people would like to attack his phone, but even if they succeed, it's a very limited reward. OpenMOKO is an example of such a phone. An attacker will likely need a good working knowledge of the system he is trying to penetrate, and android is easy to persist on once in. Harder to persist ...


21

You are right in that one of the ways an attacker could intercept the code is to hack your phone. An attacker could also: Clone your phone's sim, and request a banking code to be sent to your phone's number. they could also possibly clone a non-sim phone as well Steal your phone. Once they have your phone they could perform transactions Perform a man in the ...


21

Yes, it's possible. A malware can simply utilize the SMS functionality in your phone to transmit formatted data from and to your phone. Heck, it might even use DTMF. Update: After your edits, your question turned from acceptable to really bad. In any case, the most plausible scenario here is via Bluetooth. However, I think you're just very paranoid and/or ...


20

Look at the authentication methods for unlocking phones. On my galaxy S4, there are: Swipe (no security) Face Unlock (low security) Face and Voice (low security) Pattern (medium security) PIN (medium to high) Password (high) From personal experience, the face unlock is kind of hard. You have to train it, and then you have to stick your face in the right ...


19

By disabling WiFi and mobile data, you shut down some attack paths. That means that your system is more secure, and probably immune to most "script kiddies" attacks. However, the telephony part will still be active. It is certainly harder to exploit, but a smartphone is far from a 1960s telephone, and even the telephony part has interaction with the phone's ...


17

As the Telegram FAQ mentions, there is a 'secret chat' option that does not store chats on their servers. As for the underlying question of, "does storing chats lower their security?" then that is something to consider. Chats being stored on the server does mean that copies can be made on the server for decryption later. This increases the exposure of the ...


17

TL;DR: By December 6th, 2018, Google stopped serving Nearby Notifications. Android users won't receiving this kind of notifications. How were they able to push a notification? As @Martin Fürholz pointed out, that was came from Google Maps notification service. Specifically, from Nearby Notifications feature that being developing by Google for the last ...


16

Trying to avoid recommendations, to keep your phone safe an secure I will break it down into 3 levels: Applications When looking for applications to place on your phone you need to look at the permissions they ask for and ask yourself, Does this chess game really need access to my contacts, bluetooth and internet? NO it does not, an app to me is suspicious ...


16

Under the assumption you do not trade state secrets I would: Wipe the phone/do a factory reset (assuming the phone is still working) Remove the SD Card (keep it for later use) (does not apply to the iPhone5, since it has none) Open the phone Locate the motherboard (the largest piece of printed circuit board) Unseat or destroy the following chips as possible ...


15

You aren't hacked. Well, not by this link anyway. I opened the link you provided on a cloud instance and proxied the connection through Burp Suite so I could track exactly what happened with the redirects. Turns out it is a grabify.link link. Grabify offers url shortening and provides some level of detailed information about who follows the link. This ...


14

You've already done enough research to see that facial recognition on android is easily circumvented. I've read (although I cannot find the link now) that researchers were able to defeat it by using picture of a similar looking person, not even the actual person. When you think about it expecting facial recognition to work on a device with limited resources, ...


14

You're trying to take away communications capabilities from a tool designed to communicate. It's probably not the best choice of devices. You can start by setting the phone into "airplane mode", which is intended to shut off the radios. Because of the way RF works, that means it shuts off both transmitting and receiving. It should keep you safe, but of ...


14

You don't mention what sort of service it's for, but as a user the least irritating auth method on phones for me is SSO. I'm already signed into Google & Facebook anyway, so typically it's just a case of pressing "Yes" and we're all done.


13

There are other two options that come to mind: text messages caching of information Text messages was shown by Georgia Weidman back in 2011. The botnet comms ran through SMS. So you can imagine it can be quite easy to spread information by SMS. The other option would be to store the information you used and upload it the next time you have an internet ...


13

You cannot reach 42 bits of entropy with a regular android unlock pattern. The 3x3 grid is limited to 389,112 distinct patterns, giving you an entropy of 18.57 bits. This is less than you might assume since a dot cannot be selected twice and you cannot skip intermediate dots on a straight line. Additionally, research has shown that many actual patterns are ...


13

This is not doable. Unless hacked, your smartphone doesn't communicate with other smartphones around it. It doesn't even know if someone is taking pictures. There's no way it could possibly block someone taking a photo of you. In the clip you've linked, A explains that he can do "whatever he wants", like "altering the Internet connection". He's implicitly ...


Only top voted, non community-wiki answers of a minimum length are eligible