Thread by @cburniske

1/ If you haven’t done so already, make sure your @telegram has a password. It’s not a default requirement.

If you don’t, you’re vulnerable to an account compromise, a growing trend that’s in its early days but likely to become an epidemic in crypto (similar to SIM swapping).

@telegram 2/ I learned this the hard way. I also learned SIM swapping the hard way in 2016, and then watched it sweep like a digital plague through crypto in the following years.

https://twitter.com/cburniske/status/1177747319426621440?s=20

@telegram 3/ @ohmstone helped me immeasurably through this process and also pointed out @telegram’s lack of a “compromised account recovery process” is an embarrassment, as is its lack of default requiring a password.

@telegram @ohmstone 4/ I appreciate the help @telegram gave me, but sit in a privileged position in crypto, and fear others will not be able to pull the same strings when they need it.

@telegram @ohmstone 5/ I implore @durov and his @telegram team to get on top of 1) protecting users from these attacks 2) helping users recover compromised accounts.

*Especially* if there are to be #cryptoassets with irrevocable transactions tied to these accounts (e.g., $TON)

@telegram @ohmstone @durov 6/ Things got weird on my end as the hacker called me numerous times, and confessed he performed the attack through session hijacking: owasp.org/index.php/Sess…

But my understanding is there are a variety of ways to compromise TG accounts if there’s no password.

@telegram @ohmstone @durov 7/ Sure, some of you will call me an idiot user, and that’s fair. But a platform should protect its users against their idiocy. Right now, @telegram is not doing a great job of protecting its users.