I am writing to highlight a severe, systemic security risk for Telegram users in authoritarian countries, and to suggest a crucial onboarding change to protect their lives and data.
The Vulnerability: SMS Interception by State Actors
In countries without free speech or privacy laws (such as China +86, Russia +7, Iran +98), the government has absolute control over telecom operators. For these state actors, intercepting SMS verification codes (via SS7 exploits or direct telecom compliance) is trivial. SMS is inherently unencrypted and insecure.
The Current Flaw: Users are Unprotected by Default
Currently, a user can register for Telegram using only an SMS code. Telegram does not mandate, nor does it strongly emphasize, the creation of a Two-Step Verification (Cloud Password) during the initial setup. Because of this, the vast majority of users in these high-risk regions are completely exposed. If the government intercepts their SMS, they can instantly log in, download the entire chat history, and identify the user's network.
The Solution: Proactive Protection for High-Risk Country Codes
Telegram prides itself on resisting state surveillance. To truly protect vulnerable users, Telegram must change its default behavior for specific country codes:
Mandatory 2FA Prompt: During registration or immediately after the first login for users with high-risk prefixes (+86, +7, +98, etc.), Telegram must display a severe security warning about SMS interception.
Forced Setup: Strongly require (or make it extremely prominent to opt-out) the setup of a Two-Step Verification (Cloud Password) before allowing full access to chats.
Leaving SMS as the single point of failure in authoritarian regimes contradicts Telegram’s core mission of safe, uncensored communication. Please implement proactive 2FA prompts to stop state-sponsored account takeovers.