Telegram's 24-hour session rule, explained: why a hijacker can't kick you out (and why you can't kick them from a new phone)

#telegram #security #python #api

If you have ever tried to tap "Terminate all other sessions" in Telegram right after logging in on a new device, you have probably seen a refusal along the lines of "unavailable for security reasons". Most people read this as "Telegram protects fresh sessions from being closed". It is the other way around, and once you understand which way the rule points, a lot of Telegram account-security advice suddenly makes sense.

A session is a key, not a login

When a Telegram client logs in, it negotiates a 2048-bit authorization key with the server. After that, every request is encrypted with that key, and the server treats whoever holds it as you. No SMS code, no cloud password, nothing else is asked again. Each row in Settings → Devices is one such key.

That has an uncomfortable consequence: if an infostealer copies the tdata folder of Telegram Desktop, or someone gets hold of a .session file from a script you once ran, they do not need your code or your password. They simply continue an existing, already-authorized session.

Listing your sessions from code

Everything the Devices screen shows is available through the MTProto API method account.getAuthorizations. With Telethon:

import asyncio
from telethon import TelegramClient, functions

API_ID = 12345          # your own app id from my.telegram.org
API_HASH = "your_hash"  # never commit this

async def main():
    async with TelegramClient("me", API_ID, API_HASH) as client:
        result = await client(functions.account.GetAuthorizationsRequest())
        for a in result.authorizations:
            print(a.current, a.app_name, a.device_model, a.country,
                  a.date_created, a.date_active, a.password_pending)

asyncio.run(main())

Two fields are worth knowing. date_created is what the 24-hour rule is measured against. password_pending means someone entered a correct login code but is stuck at the cloud password step. If you ever see that flag on a session you don't recognize, your login code has already leaked.

What the 24-hour rule actually says

There are two methods for kicking sessions: account.resetAuthorization (one session by its hash) and auth.resetAuthorizations (everything except the current one). Both document the same error, FRESH_RESET_AUTHORISATION_FORBIDDEN: "You can't logout other sessions if less than 24 hours have passed since you logged on the current session."

Note the word current. The restriction applies to the session you are calling from, not to the session you are trying to close. So:

A hijacker who just logged in cannot kick you out for 24 hours. Their session is fresh, so the reset methods refuse.
You, on an old device, can kick them out immediately. Your session is older than a day, so the restriction doesn't apply to you.

The first day after a takeover is the owner's window. The flip side: if your only phone is lost and you log in on a new one, you are now the fresh session and have to wait a day before you can close anything. The practical lesson is boring but real: stay logged in on at least two devices you control.

The same idea protects your channels

Transferring channel ownership (channels.editCreator) requires the cloud password and fails with SESSION_TOO_FRESH if the session is under 24 hours old, and with PASSWORD_TOO_FRESH if the password was changed less than 24 hours ago. An attacker who logs in and immediately changes your password still cannot walk away with your channels in the same minute.

What 2FA does not do

The cloud password only guards the creation of new sessions. It does nothing to sessions that already exist. If a stealer grabbed your session before you enabled 2FA, enabling it now won't revoke anything. You have to terminate the session explicitly.

A short checklist

Review Settings → Devices weekly, from an old, long-authorized device.
Enable the cloud password and attach a recovery email.
Treat any "password pending" session as a leaked code: change the password now.
Never rely on a single logged-in device.

For one account this takes two minutes by hand. With many accounts it stops being realistic, which is why we ended up automating the routine check-and-terminate loop for our own accounts and later turned it into a tool. The page is in Russian for now: a session monitor for Telegram accounts.

DEV Community