Partnered With:

Best security practices for Telegram and Discord.

Read this article in 12 Minutes

How to minimize security risks when using Telegram and Discord?

Original Title: "Telegram & Discord Security Best Practices"

Original Author: officercia.eth, Threat Intelligence Researcher

Translation: Bob, BlockBeats

Recently, there have been frequent large-scale theft incidents in the encryption field. CoinEx, a cryptocurrency trading platform, has confirmed a loss of $54 million in the hacking incident. Stake.com has lost a total of 9615.29 ETH. Retool, a software company, published an article today revealing details of 27 encrypted customer accounts being hacked, including the theft of $15 million worth of cryptocurrency from Fortress Trust. To maximize the avoidance of security risks when using Telegram and Discord, threat intelligence researcher officercia.eth has summarized the operational guidelines. BlockBeats has compiled them as follows:

Hello! In this message, I will give you some simple advice to help you sleep better at night.

Telegram and Discord are two applications that are often used for work and communication, so it is natural that scammers and hackers will also look for victims here. Let's find out how to avoid becoming a victim.

· Reading: here

Today I want to focus on basic settings. Let's get started.

I - Telegram

Some Basic Tips

Beware of impersonators (carefully check the Telegram profile, as scammers may insert any nickname into their profile and leave their own nickname blank), be cautious of fake notifications about logging into Telegram (carefully check, they should appear in the official Telegram news and tips channel), and fake bots (yes, bots - not user accounts - may send private messages first) and so on.

None of the chats in Telegram are end-to-end encrypted, whether it's one-on-one or group chats - only TLS encryption is used. Only secret chats are end-to-end encrypted, if I remember correctly!

Settings

· Telephone number - Who can see my telephone number - No one.

· Data and Storage - Automatic Media Download - Turn Off

· Telephone number - Who can find me through my number - My contacts.

· Last online time - Who can see my timestamp - No one.

· Personal profile photo - Who can see my personal profile photo?

- My contacts.

· Call - Who can call me - My contacts (or no one, if you prefer).

· Call - Point-to-Point - My Contacts (or No One, if you don't want to share your IP address with your chat partner).

· When you start a call, you will see four emoticons in the upper right corner. Please ask the person you are calling to name them and compare them to yours (they should be the same as yours). This is protection against MitM.

· Forwarded message — Who can add a link to my account when forwarding my message to my contacts.

· Do not add contacts to Telegram (if any - delete them), and always use V/P/N.

· Group and Channel - Who can add me - My Contacts.

· Set up 2FA (cloud password)!

· Disable loop animation of patches! Animation patches are a risk.

· Disable automatic downloads (Wi-Fi and cellular network): Privacy and Security - Data Settings!

· Disable P2P calls for everyone, as it may expose your IP address! Secret chats are the same! End-to-end encryption means that your IP address will be known to the person you are chatting with. And vice versa.

· Disable link and image previews in secret chats (scroll down to "Privacy and Security" section!)

· Disable autoplay of GIFs!

· Never activate (via /start) any Telegram bots! Don't even touch Telegram bots (only public chat bots are considered safe, and you can operate them through commands in public chats). Never DM Telegram bots! (Any button may contain SQLi vulnerabilities, or even worse)!

II - Discord

· See here.

But later, a prankster appeared and began to track her on social media, posting hurtful comments, etc. He extended cyberbullying to other employees in Jane's company, causing pain to the victims.

Even at this stage, the attack has caused enough damage to potentially disrupt the company's open culture. Employees may stop sharing personal information or speaking candidly about issues out of fear of ridicule or retaliation.

Jane continues to silently endure the attacks of this prankster. If Jane blocks the prankster's account, he will create another one. If he knows her address, there may be multiple pizzas suddenly delivered to her doorstep. This kind of life is really unbearable.

Of course, he knows the way. The Savior Knight and the evil prankster are actually the same person. The prankster's trick is to establish an emotional support relationship with someone who is experiencing pain.

John created a condition that makes Jane more likely to follow John's seemingly harmless advice. She may click on a URL link or open a file sent to her. She may even come out to meet John.

For Jane, this story may end in a bad way. The potential scam for John should have been stopped at the recruitment stage - that is, at the target recruitment stage.

Are there any good guidelines that can help us avoid falling into Jane's situation?

1. The advice of "don't let strong emotions affect your actions" applies to both stock investment and choosing life partners. In the playground of the digital world, it can become your first rule.

2. If you are scammed, don't lose heart. One thing that victims often tell us after being cheated is, "I can't believe I was so foolish." Scams happen to the best of us. Evolutionary psychology tells us that evolution has made us trust other humans for survival. That's why any exploitation of this strong evolutionary adaptation is particularly painful for us.

3. If you hold a managerial position, please ensure that your employees are not sick, tired, or hungry while working. When employees are physically or emotionally weak, they are more susceptible to psychological influences.

4. If you frequently handle files, especially PDF files, you can use these protective measures or dangerzone.rocks!

5. Although you may be wary of third-party attempts to steal your information, you should also be cautious of internal threats, such as careless employees and disgruntled employees.

6. We recommend that you follow these 25 rules to protect yourself from malicious internet scammers.

For scammers, using emotions such as love or anger occurs less frequently because scammers need to maintain a psychological connection with their victims, which requires skill, time, and familiarity with the target. In our case, the scammer exploited the victim's fear. Moreover, for this type of attack to be successful, the victim must feel coerced.

A skilled social engineer will not give the victim too much time to think and will always emphasize urgency. This is the first point to note - if you are urged to provide sensitive information (or any information), now is a good time to stop and think.

The second point to note is that when you find yourself in a similar situation, do not try to solve the problem on your own. Seek help from friends, frequent contributors to your favorite Discord server, or administrators of any well-known DAO. Kind people are willing to offer help. Seek the opinions of others.

Sometimes, scammers just want to collect information about the victim or reveal the target's identity. However, in most cases, complex cyber attacks may be accompanied by malware injection, phishing attacks, or other unexpected situations.