Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram publishes users' locations online

blog.ahmed.nyc

Post reply on HN
Print view View original

71–80 of 241 posts

Re: Telegram publishes users' locations online

#71

Post by [deleted] »

est31 wrote: post #55
gruez wrote: post #6

>[Line] fixed it by adding a random number to the user's destination This is a imperfect solution. There's two possibilities: the offset (aka "random number") is dynamic, or it's fixed. If it's the former all you have to do is sample enough times to get through the noise. If it's the latter, it's not vulnerable to the previous attack, but if you have a known point of reference (so you can deduce what the offset is),…

Map cells are the best solution available for 90% of locations, but they don't help with the 10% that's close to map borders. If an user randomly jumps between two map cells you know they live at the boundary. Generally there is often noise in GPS signals so it's likely that person will jump around. Furthermore, if a person uses multiple services, and each service has its own cell layout, you can check all services a…

[deleted]

Re: Telegram publishes users' locations online

#72

Post by taneq »

3PercentMan wrote: post #36

So in the article, the author was able to find the x- and y- coordinates of the other user. What if the target user lives in a high rise building, is there any technique you can get the height of the said user? Makes me wonder how the law enforcement is able to tri-angulate the suspect's exact location.

You can certainly triangulate in three dimensions, IF the distance displayed is the 3-dimensional distance rather than just the distance between two lat/long locations. You just need to sample an additional point that's not collinear with the first two.

Re: Telegram publishes users' locations online

#73

Post by peteretep »

ROARosen wrote: post #67
ve55 wrote: post #8

The ability to find user locations via triangulation is overlooked in a lot of products - it's easy to not think twice when showing a user the distance between themselves and someone else. In my own products I fix this by aggressively rounding/adding noise before the distance calculation is performed, and then rounding again afterwards, or quantizing into ranges (e.g. '0-10 miles'). Other solutions can be storing loc…

Doesn't this triangulation assume the other user is in one location the entire time of manually going to these places to triangulate them?

You don’t need to go to a location to tell an app you’re in that location and want to know the distance to your target.

Re: Telegram publishes users' locations online

#74

Post by hombre_fatal »

ROARosen wrote: post #67
ve55 wrote: post #8

The ability to find user locations via triangulation is overlooked in a lot of products - it's easy to not think twice when showing a user the distance between themselves and someone else. In my own products I fix this by aggressively rounding/adding noise before the distance calculation is performed, and then rounding again afterwards, or quantizing into ranges (e.g. '0-10 miles'). Other solutions can be storing loc…

Doesn't this triangulation assume the other user is in one location the entire time of manually going to these places to triangulate them?

It's not much of an assumption. People go the same places every day (work, cafe) and then go to the same home to sleep in the same bed.

Re: Telegram publishes users' locations online

#75

Post by hombre_fatal »

gotem wrote: post #2

It’s a good first step but not enough. I was scammed a while back on Telegram and wish I had been able to also see the persons real identity to recover my money. Location is not enough to go on. Perhaps TG should publish an API to allow people to see any users government ID if they are scammed.

This is like choosing to deal with cash and then complaining that you can't do a chargeback.

You didn't learn your lesson. The lesson wasn't that Telegram should require a government ID (then nobody would use it much less the scammer who scammed you). The lesson was that you need to consider the impact of being scammed when you're open to using a channel with no recourse.

Re: Telegram publishes users' locations online

#77

Post by taneq »

isodev wrote: post #68

A user does not show up in “People nearby” unless they enable the function. Doing so triggers a warning from Telegram informing you your location is about to be published and it may lead to undesired attention so it really can’t happen by accident. I’m also using the app on iOS, the operating system asks periodically if I want to continue sharing location in the background (in case I forget to turn it off) or I can j…

Yeah, it seems pretty explicit that you're making your location public when you press this button. I'd say the 'bug' is in people not realising that pushing their location to a 'show users near me' function inherently reveals their location to some degree of accuracy.

Re: Telegram publishes users' locations online

#78

Post by taneq »

ROARosen wrote: post #67
ve55 wrote: post #8

The ability to find user locations via triangulation is overlooked in a lot of products - it's easy to not think twice when showing a user the distance between themselves and someone else. In my own products I fix this by aggressively rounding/adding noise before the distance calculation is performed, and then rounding again afterwards, or quantizing into ranges (e.g. '0-10 miles'). Other solutions can be storing loc…

Doesn't this triangulation assume the other user is in one location the entire time of manually going to these places to triangulate them?

It does, but you can keep trying until you get an accurate location. In the simplest version you can just watch the distance and play warmer/colder until you physically track them down.

Re: Telegram publishes users' locations online

#79

Post by ShakataGaNai »

More systems need to truncate location data. It is relatively "easy" to solve this particular issue by just not returning highly specific data. Instead of saying "896m", return "You can also truncate the data you have on users. 2 digits of Decimal_degrees precision is +/- 1KM. If you're doing an Uber-like service, knowing where a user is down to a few feet makes a different (which side of the street). But if you're just concerned with "Hey people nearby you are using this app too" (which is all too common).. Do you really need to know/save/keep where a user is beyond 1 sq km? No, you don't.

Yes, Apple has a coarse data that does something like this, but take it that one step farther. Don't need the info? Don't collect it (your app doesn't need to send it) and don't store it.

Re: Telegram publishes users' locations online

#80

Post by Nullslash »

kelt wrote: post #14

After going into the 'People nearby' I do not see any option to disable. I do see 'Make myself visible' option and a list of nearby users. (on iPhone) I wonder if this will be sufficient?

Your location will be shared on the map if you make yourself visible. Otherwise, you're safe. Disable location sharing for the whole app.
Post reply on HN