Telegram offers a new way to get a premium subscription for free. To do so, you just need to voluntarily provide your phone number to send one-time passwords (OTPs) to other users. While this may look appealing, at first glance, it’s not really a good idea — especially for a messaging service that is based on privacy.
In Telegram’s terms of service, there is a section that describes a new program called Peer-to-Peer Login (P2PL). It is currently only available on Android and in certain (unspecified) territories. By participating in the program, a user authorizes Telegram to use their phone number to send up to 150 OTP text messages to other users who are logged into their accounts. Each month, when the number is used to send the minimum number of one-time passwords, the user receives a gift code for a one-month premium subscription.
What could go wrong ?
Source
• https://t.co/xgEtXj5qq5
• https://t.co/TkSI0VJcxB
Users in some countries are receiving this feature and the only good thing about it is that it's opt-in. #telegram pic.twitter.com/R1ptjGLJp7— AssembleDebug (@AssembleDebug) March 24, 2024
This program has several privacy issues. Every time the number is used to send an OTP, it is visible to the recipient. And if something unpleasant happens as a result of this, Telegram’s terms and conditions clearly state that it is the user’s own responsibility:
«Accordingly, you understand and agree that Telegram is not responsible for any inconvenience, harassment, or damage caused by unwanted, unauthorized, or illegal actions taken by users who have learned your phone number through P2PL».
Next. Once a one-time password is sent from a user’s number, the recipient can simply reply with a text message. People participating in the P2PL program are told not to send text messages to recipients of one-time passwords, even if they sent the message first. Telegram cannot prevent people from replying to a one-time password text and cannot influence this in any way.
Telegram says it offers this program to make receiving passcodes via SMS more reliable in certain regions. In reality, though, it looks like the company is trying to avoid fees for sending codes via SMS — a step from the X (Twitter) playbook. At the same time, Telegram is not responsible if your operator charges you for sending access codes.
Overall, it seems like a very big risk to save $5 per month on a premium subscription.
Source: The Verge