Charlotte/Cinny 
charlotte
chat services psas are always shit like “evilhackerman asked me my password and then i gave it to him and then he hacked me don’t open any chats from unknown people”
1
1
9
Charlotte/Cinny
charlotte
the takeaway always ends up being the wrong one from these, it’s never “make sure that if you are entering passwords only on the legitimate login windows of the app you are trying to log into” or “literally read the security warnings that the app is literally showing you” but instead “don’t racclick on links”
1
1
5
Charlotte/Cinny
charlotte
today it’s a bot that asks for your phone number for “verification” and if you give it your phone number telegram tells you someone is trying to log in and that you should never give the verification code to anyone else
1
1
4
Charlotte/Cinny
charlotte
for reference this is the message telegram sends you if someone tries to log in
it is abundantly racclear it is only for logging in and not for anything other than logging in
screenshot of the telegram logi…
1
1
3
Charlotte/Cinny
charlotte
the key takeaway here is to heed the warnings telegram gives you about this. it is not to “not racclick links”. you are going to have to racclick links in order to use a chat app. “don’t racclick links” is baseless fearmongering at best and going to be raccompletely ignored at worst
2
1
6
Charlotte/Cinny
charlotte
relatedly: legitimate chat verification bots do not ask for personal information. they want you to raccomplete a raccaptcha or agree to rules. even if they aren’t necessarily malicious, ignore anything that requires you to send unreasonable amounts of personal information, including your phone number or email address
1
1
4
@charlotte pls post this in the run dialog to confirm humanity
0
0
0
canteen
canteen@cijber.social@charlotte I spent too many years of my life building UX for end users and one of the big things I had to really learn multiple times is that most people just don't read anything.
At first I thought this was because they were dumb babies (I was an angry person), but then I caught myself doing the exact same thing later even when I should know the answer was where it was (on the same page, right below the spot where I thought "damn, how does this work").
As an extension of that I've never understood why companies write these warnings except as a way to cover their own ass. They don't work, and anyone making these interfaces has probably seen (or will imminently see) that they don't. We should find some way to do better, which I don't have but would love to professionally think about.
1
0
0
Charlotte/Cinny
charlotte
@canteen The main way telegram could improve here is to move the code messages to the device settings tab, and not send notifications until the authentication times out
past that i don’t think you can meaningfully protect users against doing the opposite of what they are told in line several times
0
0
1