Telegram offers premium subscription in exchange for the chance to send OTP using your number

ReportMarch 28, 2024Editorial DepartmentTechnology/Data Privacy

In June 2017, a study of more than 3,000 Massachusetts Institute of Technology (MIT) students released by the National Bureau of Economic Research (NBER) found that 98% were willing to give up a friend’s email address in exchange for free pizza.

“While people say they care about privacy, they readily give up private data when incentivized,” the study noted, pointing to the so-called privacy paradox.

Now, nearly seven years later, Telegram has launched a new feature that offers some users a free premium membership in exchange for allowing the popular messaging app to use their phone numbers as a relay to send one-time passwords to other users ( OTP). Trying to log in to the platform.

This feature is called Peer-to-Peer Login (P2PL) and is currently being tested for Telegram’s Android users in selected countries. It was first discovered by tginfo in February 2024 (via @AssembleDebug).

According to Telegram’s terms of service, the phone number will be used to send no more than 150 OTP SMS messages per month (including international SMS), and the user’s mobile carrier or service provider will charge a fee.

That said, the popular messaging app notes that it “cannot prevent OTP recipients from seeing your phone number after receiving your text message” and that it “cannot prevent OTP recipients from taking unnecessary, unauthorized or illegal actions.” We are not responsible for any inconvenience, harassment or harm caused by the actions of users who know your phone number through P2PL. “

To make matters worse, the mechanism (which relies heavily on the honor system) does not prohibit users from contacting strangers to whom the OTP authentication text message was sent, or vice versa, which could lead to an increase in spam calls and text messages.

Telegram said it reserves the right to unilaterally terminate P2PL program accounts if participants are found to have shared recipients’ personal information. It also warns users not to contact any OTP recipients or reply to them, even if they send them messages.

As of March 2024, Telegram has more than 900 million monthly active users. It launched a premium subscription plan in June 2022 that allows users to unlock additional features such as 4 GB file uploads, faster downloads, and exclusive stickers and reactions.

Since online services still rely on phone numbers to authenticate users, it’s worth keeping in mind the privacy and security risks that may arise from participating in experiments.

Metadata in the legal crosshairs of intercepting Snapchat traffic

At the same time, newly made public court documents in the United States claim that Meta launched a secret project called Ghostbusters, which aims to intercept and decrypt the network traffic of users using Snapchat, YouTube and Amazon to help it understand user behavior and better understand user behavior. compete with competitors.

This is accomplished through a custom application that utilizes a VPN service called Onavo. Facebook acquired the service in 2013 and shut it down in 2019 as it came under scrutiny for using its products to track users’ online activity in relation to competitors and secretly paying teenagers to capture their information. Internet browsing mode.

The data-blocking program has been described as a “middle-middle” approach, in which Facebook essentially pays people between the ages of 13 and 35 up to $20 a month, plus referral fees for installing market research apps and giving them boosts. The right to inspect network traffic and analyze its network usage.

The strategy relies on creating “fake digital certificates to impersonate trusted Snapchat, YouTube, and Amazon analytics servers to redirect and decrypt secure traffic from these applications for Facebook’s strategic analysis.”

The apps were distributed through beta testing services such as Applause, BetaBound and uTest to conceal Facebook’s involvement. The program came to be known as the In-App Action Panel (IAAP) and ran from 2016 to 2018.

Meta said in response that there was no criminal or fraudulent conduct and that “Snapchat’s own advertising witnesses confirmed that Snap was unable to identify any of the ad sales.” [it] Meta suffered losses as a result of its use of user research products, and it is not known whether other competitors collected similar information or whether any of Meta’s research provided Meta with a competitive advantage. “