Hacker News Reader

> It's worse. 2FA is optional and SMS code is the first (and default) auth method.

This will be changed on Saturday.

Got the following message about API changes last week: https://telegra.ph/Telegram-API-Changes-02-16

But given the choice, isn't SMS a stronger first authentication factor? It's temporary and randomized, whereas users don't change passwords that frequently. So a password is much more susceptible to keyloggers/malware/brute-force than an SMS code.

That announcement seems to be concerned with unofficial clients only. But it does sound like the change is a part of some bigger package.

Reply on news.ycombinator.com