Informer: A bot library that allows masquerading as real users on Telegram

[jhabdas]

This seems novel until one realizes public channels are already available on the web.[1] Also, I'm surprised Paul didn't go with Pyrogram for creating the user accounts (which have unlimited cloud storage and 1.5GB file limits btw).

[1] https://telegram.org/blog/privacy-discussions-web-bots#view-... [2] https://github.com/pyrogram/pyrogram

[ksangeelee]

The words 'mass surveillance' in the project title seem to me sensationalist. From his repository list, I suppose the author is involved in ads and marketing, which would figure.

Had I parsed Usenet feeds into a relational database, and called it 'mass surveillance', I'd have rightly been ridiculed.

Regardless, it can be useful to have message data in this format.

[KenanSulayman]

Sounds like a good old IRC channel logger.. but for Telegram. The title is some serious click bait.

That said, I haven’t checked deeper, if this bot is not actually using the bot API but MTProto, this is pretty significant as the bot appears like a normal user (and not as a bot, which are required to have a “-bot” suffix on Telegram).

[Robadob]

It states that it's using telethon.

That appears to be an MTProto library.

https://docs.telethon.dev/en/latest/concepts/botapi-vs-mtpro...

[wtmt]

What prevents anyone from doing the same with Signal or any messaging service that allows one to build a client? This program isn’t pretending to be a bot on Telegram, and it works as a normal user in every way (including the requirement for a working phone number, even if it’s a burner number).

[leppr]

You can't ever assume that clients aren't logging everything that goes through them, even if there's no official documentation/API for custom clients. If a human can read a message, for all intent and purpose assume that a machine can too. For instance, things like Snapchat self destructing messages rely more on social norm than technology.

[m12k]

Well, Signal comes with a system for verifying a person's identity, so you can be sure it's really someone you know and not an imposter. But sure, for semi-public channels that will let anyone in without verification, something like this would allow you to monitor it. Lesson: If you're using Signal to run a dissident network and organize protests, be sure to verify everyone before adding them to groups.

[riter]

This is effectively true, baseline it is indistinguishable from a "real" person, questioning the security model of openness and potential for mass social engineering. There is a reason why the hurdle of overcoming scaling the creation of a "real" phone number is difficult.

[kaens]

nothing aside from things that require actual human interaction, so basically nothing.

[juskrey]

This is not surveillance, this is just another channel crawler.

[jimws]

Yes, the project is disingenuous. It claims there is a bug but really it is just functioning as designed.

[EncryptEntropy]

I maintain some medium-sized TG channels and constantly have what we have deemed “surveillance” accounts join daily. One of the admins of the chan implemented a simple turing test bot which requires immediate 60 sec solving of a basic math equation or the account gets kicked. They were solving the “click this button to verify” but none at all seemingly know how to solve 6+4, or they can’t read English quickly enough.

[big_chungus]

A few discord groups I've joined use this bot to verify through re captcha (which I hate, but is still a potential solution): https://auttaja.io/

[riter]

Yes, the click button is on the todo. I have encountered these and the common one is the button click followed by the basic arithmetic. Solvable but anything beyond this would "defeat" it.

[Tepix]

Unrelated but I wish Telegram would support encrypted group chats like Signal does.

[Legogris]

And, at least as importantly, multi-device end-to-end encryption. E2E conversations on Telegram are almost as rare as on FB Messenger, IME.

[sschueller]

This is very cool. I wish there was something like this for whatsapp so I can forward my messages to another IM service.

[heroprotagonist]

Twilio has a WhatsApp integration. It's paid per message, but it's pretty cheap if you're just forwarding a single user's messages. Probably a bit expensive to do at scale though.

I'm not sure what kind of open source apps leverage it, but I would guess there is something.

[koalalorenzo]

Matrix?

[jhabdas]

Wait until EU gets their data portability laws ironed out.

[neiman]

Is there any positive ethical aspect of this tool?

[ArnoVW]

Eliminating information dissymmetry, by showing to the rest of the world what -given the simplicity- undoubtedly many other people have already found out (but have kept for themselves).

[yoavm]

Not a fan of Telegram, but as far I understand this only let's you scrape messages from public channels. People shouldn't really expect anything else when you write a message on a group with 100s of other people

[22c]

Sure, drawing attention to the weaknesses of Telegram.

Similar discussion from previous HN thread:

https://news.ycombinator.com/item?id=20776327

[hnarn]

The README clearly states:

>Potential Business Applications:

>Sock puppeteering to overthrow a despotic regime

>Brand monitoring and sentiment analysis

>Shilling cryptocurrency at a moments notice for financial gain

>Influencing sentiment on topical issues

>Getting in on price action early

>Running analysis of a telegram channel

While some of them are arguably unethical, some of them are almost certainly not.

[BickNowstrom]

Gathering intelligence on - and data from - bad actors.

Do a search for "site:telegram.me" including a keyword from any illegal activity, such as carding, and you'll find hundreds of channels with interesting behavior.

[kome]

I mean, it's a bot. Like a search engine bot. It works only for public groups or if it's allowed in a group...

I don't see any negative ethical aspect to be honest.

[ShorsHammer]

Depends who you think should be able to bomb people based on metadata I guess.

It's all relative.

[DagAgren]

Keeping an eye on cryptocurrency scammer channels?

[walrus01]

Exposing fundamental architectural flaws of Telegram?

[wk0]

Going to hijack this thread to plug some basic Telegram API tutorials I've written on Medium

* Send and Receive Messages with the Telegram API https://medium.com/@wk0/send-and-receive-messages-with-the-t...

* Running a Serverless Telegram Bot from AWS Lambda https://medium.com/@wk0/running-a-serverless-telegram-bot-fr...

* Integrating Your Serverless Telegram Bot with AWS API Gateway (published today) https://medium.com/@wk0/integrating-your-serverless-telegram...

[riter]

good on ya ;)

[captn3m0]

Looks great. I found out about https://docs.telethon.dev/en/latest/, which looks like a usable Python API for Telegram user accounts (not bot API).

I can finally build by telegram-to-rss project!

[Amir6]

It would be great if someone can do an opensource like that, as mentioned by others Telegram is not privacy friendly but having access to the content that spreads around in such platform can be very valuable

[riter]

Sweet! This point of this project was I found no boilerplate for one of the listed use cases so I just built it in 2 days and later shared it. I hope you do the same :)

[noxer]

This is so stupid. Public channels and Groups have a web frontend it doesn't even need a telegram account to see or crawl them. Example link: https://t.me/s/durov/110

[smashah]

Wow nice work. I'm sure Rukmini Callimachi will love this!

[HNLurker2]

>Callimachi left Romania during the communist regime with her mother and grandmother, for Switzerland and then the United States.

Inspiring actions

[thomasfl]

This makes it so much easier to keep track of the action on "The pump & dump cryptocurrency club" channel on Telegram.

[riter]

Hahaha.. yes, if you can't tell this was a boiler plate for tracking and analyzing the activity of the wonderful seedy world of crypto.

[riter]

TBH what I find most humorous is no one mentioning the obscure 90s reference :)

[jhabdas]

Yo snow the five-o came around looking for you the other day...

[surajs]

lemme just say ... ha-ha!