Unusual use bot for Telegram and a security check Telegram

Some time ago I told about your project don't call!, where when you add your phone number to the registry you must confirm that is your number.

Standard methods of confirmation — SMS or call pretty good, but not free. Have used us SMS.ru for example, one SMS costs 1.5 ruble ("SMS for 25 cents," said they on the main is a lie, such a rate is not).

What are free ways of confirming numbers? I came up with the following:

the
1. ask the user to send us SMS with your number. Find free Russian number who would accept SMS and send them via email failed (previously, this option was Zadarma). The use of non-Russian numbers — would deter users. An alternative solution — personal number, android app and type SMS Gateway — does not inspire confidence in terms of reliability and throughput.
the
2. ask the user to call us with your number. Even more difficult to implement option.
the
3. Check via Telegram.

The last option seemed interesting. How does it work? The bot asks the user to choose the site for authentication, and then requests the phone number of the user. If the user your phone number is reported, then the bot confirms the phone number at the selected site.

In Telegram Bot API, you can request user phone number:

the

>>> contact_keyboard = telegram.Keyboardbutton to(text="send_contact", request_contact=True)
>>> custom_keyboard = [[ contact_keyboard ]]
>>> reply_markup = telegram.ReplyKeyboardMarkup(custom_keyboard)
>>> bot.send_Message(chat_id=chat_id, 
... text="Would you mind sharing your contact with me?", 
... reply_markup=reply_markup)

If the user agrees to pay the bot with your phone number, then the bot receives the following:

the

{
"update_id": 912872664,
"message": {
"message_id": 57,
"from": {
"id": 777777,
"first_name": "Ne Dimon",
"last_name": "On vam",
"username": "onvamnedimon"
},
"chat": {
"id": 777777,
"first_name": "Ne Dimon",
"last_name": "On vam",
"username": "onvamnedimon",
"type": "private"
},
"date": 1492274787,
"contact": {
"phone_number": "79160000001",
"first_name": "Ne Dimon",
"last_name": "On vam",
"user_id": 777777
}
}
}

If a user can not send your phone number? Can. The user instead so the bot can send any other contact from your phonebook. But contact/user_id in this case will not be equal to from,/id, and the bot finds out that he sent someone else's contact.

I was interested in the question, is it possible using a modified client Telegram to send someone else's phone number with his id. @BotSupport Telegram claims that it can be done (maybe have check on the server). But they (especially Russian-language support) is not particularly trust, suggest a challenge — to confirm the number (916) 000-00-01 on our website (checked on this number "caller not available", I think it doesn't exist). To do this, go to bot link and request number to send to it the number of (916) 000-00-01 with your id.
Ongoing Bug Bounty programme at the Telegram, as I understand it, does not exist, because the one who will do it, nothing will receive. Although, you can some information about someone to obtain, for example, in the bot Bank ;).

Article based on information from habrahabr.ru