This proposal does not want to replace Telegram's current session protection. The goal would be to extend it by providing users with an optional long-term trust anchor for account recovery and session management.
After the initial 24-hour protection period for newly created sessions, every active session gains the same authority over session management. If an attacker manages to log into a new device and keeps access long enough, that device can eventually remove every other session, including the legitimate user's own session.
Telegram already protects newly created sessions for a limited time, but once that protection expires there is nothing further to protect from takeovers.
What I'm proposing is the introduction of a "Primary Session" or "Super Session" with more authority over the account compared to a simple session.
This practically means:
You can upgrade a session to its "Primary" status through additional verification (2FA password, OTP sent to the mail address previously set for the 2FA) or from an alredy upgraded session
The upgraded session cannot be terminated by any non-primary session, while being able to terminate any other session on its own
The upgraded session can downgrade and upgrade other sessions
Removing the status should require the same type of verification needed for the upgrade or a security waiting period (e.g. 7 days as per the reset of the 2FA passord) if the device is unavailable
This upgraded status drastically reduces the impact of account takeover.
A brief explanation:
Any attacker logs in and can use telegram normally
They cannot kick you out of your own session because they do not have access to your recovery mail and cannot either upgrade their session to "primary" nor "downgrade" yours
The legitimate owner can always recover control from the "Primary" Sessions
Without this protection, an attacker who keeps access long enough may eventually gain equal privileges over session management.
Of course I think that this feature should be optional, maybe for the ones who prioritize security the most can enable it.
If the only Primary Session is lost the user can sign in on a new device and complete the ulterior verification procedure to promote the status of the newer session. This will allow the user terminate the old one.
If there's no way to acces or remember the 2FA password and the mail address the user will have to wait a security delay before upgrading.
This should prevent accidental lockouts while maintaning strong security.
Here is a concrete example of what I'm proposing:
Alice (the user) owns only a Primary Session which is her phone.
An attacker somehow gains access to a login code and signs in on another device.
The attacker can use Telegram, but cannot terminate Alice's Primary Session or promote their own session without completing additional verification.
Alice still has a trusted point from which she can review active sessions and remove the attacker's device.