Live data from Hacker News

Telegram publishes users' locations online

blog.ahmed.nyc

51–60 of 241 posts

Re: Telegram publishes users' locations online

#51

Earlier quoted context omitted.

I’ve heard other folks say WhatsApp is insecure. Do you (or anyone else) have specific examples or concerns?

Like... Facebook can read all your messages? The encryption only protects you from entities that are not Facebook. With that out of the door, it's not really worth it to even consider other angles of attack, since you now depend on the goodwill of a billion dollar company whose sole purpose and reason for existence is to extract and monetize your data. WhatsApp is a nice chat tool, but it's nothing you should ever us…

> Facebook can read all your messages?

Whatsapp still does E2E encryption. (Same as Signal) Facebook can't read your messages. (There's still the scenario of you getting a special version of the app with that functionality disabled of course) You can also enable notification for changed signatures, which I do see changing as people replace their phones.

Re: Telegram publishes users' locations online

#52

So in the article, the author was able to find the x- and y- coordinates of the other user. What if the target user lives in a high rise building, is there any technique you can get the height of the said user? Makes me wonder how the law enforcement is able to tri-angulate the suspect's exact location.

Author here. No, that is called z-coordinate. It's not possible to get z-coordinate by just finding the distance between me and the user.

Re: Telegram publishes users' locations online

#53
post #30

On the "People Nearby" page in the Telegram app it specifically says Quickly add people nearby who are also viewing this section ... If a user is not specifically on that page, they are not listed in the section. The user most likely wants the world (or strangers) to know his position. This case shows precise localization can be a double-edge sword. But instead of fuzzing the returned location, we should educate the…

> If a user is not specifically on that page, they are not listed in the section.

I'm consistently seeing some of the people nearby across multiple times opening the page, some of which weeks apart.

Re: Telegram publishes users' locations online

#54
post #41

It's a shame that people still use Telegram when Signal is so much better, and has better credentials all around.

Signal is terrible. I use the app still, but it’s horribly buggy. The disappearing messages, a hallmark feature, is fundamentally broken in some way that I can’t fully comprehend. Totally unreliable. Telegram is better in every way... except security.

And honestly the security is "good enough" for what I do, which is chat with friends and family on it.

Re: Telegram publishes users' locations online

#55
post #6

>[Line] fixed it by adding a random number to the user's destination This is a imperfect solution. There's two possibilities: the offset (aka "random number") is dynamic, or it's fixed. If it's the former all you have to do is sample enough times to get through the noise. If it's the latter, it's not vulnerable to the previous attack, but if you have a known point of reference (so you can deduce what the offset is),…

Map cells are the best solution available for 90% of locations, but they don't help with the 10% that's close to map borders. If an user randomly jumps between two map cells you know they live at the boundary. Generally there is often noise in GPS signals so it's likely that person will jump around.

Furthermore, if a person uses multiple services, and each service has its own cell layout, you can check all services a user is member of and then find the intersection. Ideally services would standardize to one single cell layout. So Apple's idea of doing this cell partitioning at the OS level is really good.

I think the boundary concern can be resolved by some inertia system, so a person doesn't switch cells unless they are deeply enough in the new cell, at which point they won't switch back unless they have moved back deeply enough.

Re: Telegram publishes users' locations online

#57

Telegram has so many anti features and dark patterns that I really wish it was less popular. I honestly use WhatsApp over Telegram because at least I know WhatsApp is insecure while people sometimes act like Telegram is a secure platform.

This is a common wrong understanding.

WhatsApp is end-to-end encrypted by default (using same protocol as Signal) and there’s no way to disable encryption.

On the other hand Telegram chats are by default unencrypted ... you have to specifically start a “Secret Chat” to benefit from end-to-end encryption.

Re: Telegram publishes users' locations online

#59

Telegram has so many anti features and dark patterns that I really wish it was less popular. I honestly use WhatsApp over Telegram because at least I know WhatsApp is insecure while people sometimes act like Telegram is a secure platform.

The rich irony here is that Telegram, in fact, way less secure than WhatsApp, yet, it's users (wrongly) perceive it to be magically more secure.

The reason why WhatsApp is more secure is simple: it uses e2ee for all chats, and consequently has issues with multudevice usage and chats syncing, while Telegram just stores all chats in its servers, sans so-called "Secure chats". (I'm yet to see one person who is using them to contact me)

Re: Telegram publishes users' locations online

#60
post #41

It's a shame that people still use Telegram when Signal is so much better, and has better credentials all around.

Signal is terrible. I use the app still, but it’s horribly buggy. The disappearing messages, a hallmark feature, is fundamentally broken in some way that I can’t fully comprehend. Totally unreliable. Telegram is better in every way... except security.

> Telegram is better in every way... except security.

Which is why anyone bothers with these type apps in the first place, I'd like to say I'm dissapointed with the sentiment towards Signal, especially given how many here work in tech and understand how leaky these apps are designed to be and how hard development can be with a bare bones team (I experienced this first hand), but it never fails to bank on the notion that convenience will always win against security. regardless of expectation(s).

Shrug... I like Signal more: and I think Telegram has many useless features that are not of any interest to me and only create needless bloat at the expense of security/privacy which is untenable, so while I hope some bugs get sorted in Signal as I run both I know why I side with Signal.

I also understand that Signal runs on a thin donation based hacker budget and Moxie Marlinspike's podcast on Joe Rogan is a really cool watch that made it clear to me it's just a hacker project that scaled really well and is in need of funding and staff. I think Joe revealed himself to be a part of the money-centric Corpo class to Moxie's dismay when he refused to have that rock, paper, scissor match and you could see the disappointment in his eyes when Joe reacted almost offended at the idea that Moxie had anything worth his stake and could so quickly ascribe a dollar value to it.

It reminded me that it's okay to care about the messenger (guest) that his podcast attracts rather than Joe or the brand he's created around himself, even though I agree with may of his points I struggle to think its nothing more than hook or gimmick most times. I don't really enjoy any of his standup and find a lot of his quips to be childish and immature reactions to what seem like feckless attention grabbing that can derail a guest's conversation or train of thought, much like uninvited fart jokes would amongst otherwise fascinating discussion and in depth arguments: then again he is a comedian first and foremost.

With all that said, donate to help get those fixes on Signal sorted here [0]!

0: https://signal.org/donate/

Post reply on HN