3

I need to integrate web application into Telegram using telegram bot. I need to do an authentication for client, and the web application authenticating user with his phone number + password. I've found interesting method of obtaining user's phone number through special button

This method seems to be quite sufficient to do authentication without user's password, since user cannot send nobody's except his phone number, and all the authentication already done by Telegram. But it's a little embarrassing for me, since I don't know how the phone sharing feature works, and how hard is it, to bypass or cheat on it.

*As the precaution, I think to do only authentication (may be even identification) through Telegram bot. And for sensitive actions will require additional authorization (but I don't know how, for now))

Maxim
  • 206
  • 2
  • 5
  • It all comes down to one question: in that particular case, is a Telegram app sends user's contact, or Telegram server? – Maxim Jan 25 '18 at 15:42
  • It's a little bit harder than you think. The server sends the contact, not a client, but it's worth checking whether a malicious user can decline the request (in a way your bot won't notice) and then send another contact himself (like a user can do using the contact sharing feature) with a spoofed `phone_number`. I'm too lazy to check myself. – ximaera Jan 25 '18 at 16:53
  • *Also*, I don't know whether `phone_number` could be spoofed, but the whole `Contact` object itself definitely could be. Be careful to check whether the `id` of the user you're communicating with matches `user_id` value of the contact you've received. – ximaera Jan 25 '18 at 16:55

2 Answers2

2

OK, it can seem insecure at first sight, but, if bot will perform user check right, it'll give 100% confidence in authenticity of user's phone number. And it's authenticity is proved by Telegram authentication mechanism (which is SMS verifcation).

As ximaera commented:

Be careful to check whether the id of the user you're communicating with matches user_id value of the contact you've received

Any telegram app sending any contact as object with first name, last name and phone number properties. There's no other ways that Telegram API allowing to do it. And the bot receiving this object with user_id appended by telegram server. This additional property equals to chat_id of user with this phone number. So, it appears that it's enough to compare user_id from contact with chat_id of user, who sent this contact.

K.B. said:

Phone numbers are pretty easily spoofed

Our webapp uses SMS-verification of phone-number during registration. The same is done by Telegram. Hence, our authentication mechanism isn't safer that Telegram's.

If the user's device is stolen/lost/otherwise compromised, the token can be revoked

If the phone is stolen/lost, and not protected with PIN/fingerprint/other, the new phone owner will have all the resources to regain control on any user's account.

Of cource, security measures are not superfluous, especially when extending the zone of trust to a third-party service. But, I think that Telegram's security way ahead of ordinary application's security, so, once integrated, it can be further used even as authorization mechanism, instead of SMS verification codes.

Maxim
  • 206
  • 2
  • 5
0

I don't have any experience with telegram specifically, but in general:

  • Phone numbers are pretty easily spoofed. So using that for authentication is pretty weak.
  • Requiring just a phone number would be single-factor authentication in general, not good if you're potentially dealing with any sort of sensitive/valuable data.

A better approach (and again, I don't know if this is doable in your specific instance) is to have the user authenticate with phone#/username/password once, then give the application a token it can use to authenticate in the future. This gives the benefits:

  • User doesn't have to enter password each time.
  • Attacker that can spoof phone number can't access user's account, they would have to have the token which is stored on the user's device.
  • If the user's device is stolen/lost/otherwise compromised, the token can be revoked.
  • Tokens cannot be stolen in transit as long as you're using SSL.
K.B.
  • 667
  • 4
  • 6
  • This is not the case. Telegram servers verify phone numbers themselves, you don't need to check the authenticity of a number on your side. – ximaera Jan 25 '18 at 16:09
  • How does it verify though? Getting your phone to appear as a different phone number is really easy, and in most jurisdictions the technology to do so isn't illegal. – K.B. Jan 25 '18 at 16:42
  • As far as I remember, an SMS code is sent to the number user has specified. – ximaera Jan 25 '18 at 16:44
  • I see, that would be better - the documentation linked in OP doesn't mention that, just that it sends the phone number. Still not brilliant as spoofing the receiving end (getting SMS of someone else) is still possible, though harder and more illegal. – K.B. Jan 25 '18 at 16:55
  • They have [2FA](https://security.stackexchange.com/questions/177526/security-and-privacy-issues-with-telegram/177546#177546) for that. Whether a user you're communicating with uses 2FA or not is a mystery though. – ximaera Jan 25 '18 at 16:59
  • Yeah, that would be my recommendation to the OP use 2FA, as he's using this to authenticate a secondary app if I'm reading that correctly. – K.B. Jan 25 '18 at 17:07