Telegram Quetly Fixes Account Takeover Bug

For the longest time, there was an one-click account takeover bug in Telegram. We knew it existed, and I know some of the victims.

But it was not publicly acknowledged, and everyone at Telegram just pretended it did not exist.

Now we know how it worked, and how little effort it took to take anyone's account, or more. The sneaky bastards quetly fixed the bug, they did not even mention in the release notes. Super classy.

Of course, my mitigation for this is well known: don't use Telegram. Telegram is a privacy nightmare, with or without critical vulnerabilities. They are storing all your group messages unencrypted, and your account is connected to your phone number. With servers all over the world, it is guaranteed that all governments and agencies have a pretty nice portfolio on you. If you think that you have nothing to hide, then think again.

If you ask me, my suggestion is that you close your telegram account.

If you want to pretend that you have important business there, so you can't, then at least mitigate the risk:

• Don't use the desktop or the mobile app.
• Log in from a browser window.
• Even better, log in from a browser that runs in a disposable VM in Qubes OS.

Please take tare of your privacy online. Soon I will launch my own community where you can learn how to do it in a pragmatic and practical way.