Bugs and Suggestions

> If you fear about being found or recognized using your phone numbers, just turn on your privacy settings ("Who can see my phone number?" and "Who can find me by my number?").
Additionally, Telegram has never shared a single byte of data to third parties or governments. Unless you are a terrorist, you should not worry about that.

Governments can force telegram to hand over the phone number of the owner. You say that Telegram does not share that information, but that's not how it should work. Why should I trust Telegram? How can I really prove that it was never shared? I can't. So the only solution to be really sure is simply not give even Telegram that information

s0ph0s ✊🏿🇭🇰🌻🏳️‍🌈 Dec 30, 2020

Telegram has not *yet* shared a single byte of data to third parties or governments. You've misjudged my primary reasoning here, I want this feature because it protects protesters in places like Hong Kong, where the CCP actually believes that they are terrorists, even though the protesters are speaking up to protect their rights. Telegram has already played a central role in the protests in HK, and [sadly not in a positive way](https://www.zdnet.com/article/hong-kong-protesters-warn-of-telegram-feature-that-can-disclose-their-identities/). Being able to create an account that is not tied to a phone number would have protected those protesters. And yes, I know there are now privacy settings that control who can find you by your phone number, and I've upvoted the other suggestions which expand on its functionality. But someday, there will be a government threat that Telegram can't ignore, and when that day comes, there needs to be a way for users to protect themselves.

Nayeem Ahmed Dec 30, 2020

Once I was travelling to another country and I had to reset my phone for some reason. I couldn't login to Telegram because of login code sent to my mobile number that I didn't have access to at that time in a foreign country.

So, it would be awesome if there any second way to get the login verification code like email or backup codes (That Gmail gives when 2FA using authenticator app is enabled)

And why not give the option to login using phone number and a password for already registered users?

Nayeem Ahmed

I think you are moving away from the initial proposal. The initial proposal wants that the telephone number should never be entered, neither during registration nor during login. Mixed registration and login solutions can be proposed, they are fine, but this proposal is clear: a registration and authentication method that does not require a telephone number as a requirement at any time, as the telephone number can lead to identification of the person

Deleted Account Dec 30, 2020

...

As mentioned in the FAQ (https://telegram.org/faq#q-do-you-process-data-requests), Telegram uses a distributed infrastructure. No single government or block of like-minded countries can force Telegram to disclose users data. Telegram can be forced to give up data ONLY if an issue is grave and universal enough (i.e. global terrorism) to pass the scrutiny of several different legal systems around the world.

It does not work like that. Just like you are connected to only a server when you are using Telegram, Telegram has your phone number in that server. Datas can be splitted, encrypted, whatever, but as some point those data needs to be retrieved and decrypted: in that precise moment, governement can access to server and read data.

"Cloud chat data is stored in multiple data centers around the globe that are controlled by different legal entities spread across different jurisdictions. The relevant decryption keys are split into parts and are never kept in the same place as the data they protect. As a result, several court orders from different jurisdictions are required to force us to give up any data." (Telegram FAQ)

Telegram's uses a client-server encryption using a 2048-bit key shared by the client device and the server. The key is created upon user registration directly on the client device by exchanging Diffie-Hellman keys, and never transmitted over a network. (https://core.telegram.org/mtproto/description#authorization-key-auth-key)

This makes impossible for the government or other entities to intercept & access your data, unless you give them access to your device for some mysterious reason.

You can check how Telegram's custom protocol works (https://core.telegram.org/mtproto) and, if you doubt it's secure and think that someone can intercept & successfully decrypt your messages, just let Telegram know.

You don't seems to understand. We are not talking about intercepting network traffic. We are talking about simply accessing a telegram server, by going directly and phisically to it. Those servers need to have at some moments the plaintext of your number, or else how could they send it to you?

MTProto is a protocol, as its name suggests, and it works for describing how data are transfered, we are talking about something completely different: a government can simply going phisically to telegram servers to read data

All data not covered by end-to-end encryption (everything except secret chats) is split and shared between Telegram's distributed infrastructure. Servers are located in multiple data centers around the globe and they cannot be accessed directly & phisically without warrants / court orders from multiple governments.

Also, these data centers are located in countries where freedom of speech is guaranteed (and even there Telegram doesn't take it for granted).

It's not a matter of how complicated the process of obtaining the phone number, and so the identitiy of the person, is. It's about that it's possible. It should be impossible. Do you know how to make it impossible? By simply not giving telegram the phone number. If the phone
number does not "exist", then it can't be retrieved

Show next 93 comments

Use Cases

Workaround

30614 Cards

Log In