Main mistakes
Sending link and password same way
Users often send link and password in one message
Example:
Link: https://... Password: 123456 — all in one Telegram message
Risk:
If channel is compromised, attacker gets both link and password
Solution:
Use different channels: link in messenger, password by phone
Too long TTL
Setting TTL for weeks or months instead of minutes or hours
Example:
TTL = 30 days for one-time password needed for 10 minutes
Risk:
Increases vulnerability window for attacks
Solution:
Set minimum necessary time: passwords — minutes, documents — hours
Public link sharing
Sending links in group chats or public channels
Example:
Link with confidential data in general work chat
Risk:
Unintended people get access to data
Solution:
Send links only in private messages to specific recipient
No receipt confirmation
Don't check if important data reached recipient
Example:
Sent link with bank password and didn't verify colleague received it
Risk:
Data may be lost or not delivered
Solution:
Always ask to confirm receipt of important information