The new Telegram function “People nearby” presents a security risk

The new Telegram “People Nearby” feature a list of other nearby users and their approximate proximity to you, allowing you to create group chats based on geographic location. The feature is disabled by default and must be manually enabled by the user, but it is an idiosyncratic addition to an application that is marketed as a private end-to-end encrypted messaging service – and, according to security researcher Ahmed Hassan, is a major security risk.

Users can falsify their geographical location in Telegram by opening them to possible scams. “Many scammers keep their location and try to sell fake bitcoin investments, hacking tools, SSNs used for unemployment fraud and so on. The amount of illegal activity I saw there makes Silkroad look like amateurs drove it, ”Hassan explained. into the a recent blog post.

Even worse, Hassan identified a flaw in the nearby People function that could leave bad actors triangulate the exact location of other application users by using two accounts with false addresses.

This opens users up to hacks, stalking or worse – and Telegram as it has not announced any plans to solve the problem. Hassan reported the vulnerability to Telegram, but the company says it will not be repaired. In fact, Telegram told Hassan that discovering a user’s specific location is an “expected” result of the Nearby People feature in some cases. The answer has no character for an encrypted messaging application that sells on it privacy features. Even adding a more detailed warning that other users might find the exact location would be helpful, but it doesn’t look like it will.

To be fair, Telegram is generally more secure than other chat applicationsand because Nearby People are disabled by default, this it may not seem like a serious thing problem. However, users may accidentally activate the feature, thinking that they are simply conveying their general closeness to someone else and not their exact location. If You value your privacy, no use the Telegram’s People Near function.

[TechRadar]