Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Telegram publishes users' locations online

blog.ahmed.nyc

Post reply on HN
Print view View original

121–130 of 241 posts

Re: Telegram publishes users' locations online

#121

Post by Nullslash »

isodev wrote: post #68

A user does not show up in “People nearby” unless they enable the function. Doing so triggers a warning from Telegram informing you your location is about to be published and it may lead to undesired attention so it really can’t happen by accident. I’m also using the app on iOS, the operating system asks periodically if I want to continue sharing location in the background (in case I forget to turn it off) or I can j…

it's a privacy issue. Users who enable the feature don't understand that are basically publishing thier latitude longitude online. Which can be resolved into a home address.

Re: Telegram publishes users' locations online

#122

Post by chipsa »

solarkraft wrote: post #105
arthurcolle wrote: post #7

It's a shame that people still use Telegram when Signal is so much better, and has better credentials all around.

Except it's not. Telegram has clients for every imaginable platform while AFAIK Signal only works on phones (and that's just one issue).

https://www.engadget.com/2019-11-29-signal-ipad.html

Works on tablets and desktops too. Just set it up as a linked device.

Re: Telegram publishes users' locations online

#123

Post by ganafagol »

jessaustin wrote: post #116
andreareina wrote: post #63

Earlier quoted context omitted.

Offset as function of user and location?

Where is this function stored?

As a random secret in the reporting device. The secret can then be used with a cryptographic hash to produce a deterministic but unpredictable offset, based on the current location.

Something like:

reported_position = true_position + hash(secret + true_position)

Re: Telegram publishes users' locations online

#124

Post by jlelse »

op03 wrote: post #109
cwhiz wrote: post #41

Earlier quoted context omitted.

Signal is terrible. I use the app still, but it’s horribly buggy. The disappearing messages, a hallmark feature, is fundamentally broken in some way that I can’t fully comprehend. Totally unreliable. Telegram is better in every way... except security.

Telegram is a business. Ads are coming this year. Signal is basically a non profit (so far). Thats all I need to know to make a choice given the track record of the robotic buffoon class that believe everything that momentarily scales up needs to be monetized asap to shit out one mindless billionaire here and there.

Ads are only coming to public channels were channel owners already publish ad messages. Signal is located in USA, so it's quite easy for NSA et al to pressure Signal to implement backdoors.

Re: Telegram publishes users' locations online

#125

Post by ganafagol »

ganafagol wrote: post #123
jessaustin wrote: post #116

Earlier quoted context omitted.

Where is this function stored?

As a random secret in the reporting device. The secret can then be used with a cryptographic hash to produce a deterministic but unpredictable offset, based on the current location. Something like: reported_position = true_position + hash(secret + true_position)

Hm that will essentially behave like random noise though, assuming that the position is sufficiently high resolution. So you'll need to round it in any case, and once you do that heavily enough, there is no need for this crypto magic.

Re: Telegram publishes users' locations online

#128

Post by circularfoyers »

solarkraft wrote: post #106
kop316 wrote: post #4

Hmm...So I have Telegram installed via F-Droid (so presumably without Google Play Services). I do NOT have the "People Nearby" feature. I am curious if that means my location is not published?

The F-Droid version unfortunately seems helplessly outdated.

I wouldn't call it helplessly outdated, at most it's a version behind. But there's a number of reasons for this. For starters Telegram themselves lag behind in releasing the source code for the app[1]. Then the volunteers who make the FOSS version[2] have to update their fork and make sure it works. Then finally it's submitted to F-Droid, where it's compiled by their build servers (of which the build process occasionally breaks and needs to be fixed).

I think the assurances that this offers (entirely FOSS, reproducible builds, better privacy and security[3]) outweighs being sometimes days or weeks behind the releases they upload to the Google Play Store.

[1] https://github.com/DrKLO/Telegram [2] https://github.com/Telegram-FOSS-Team/Telegram-FOSS [3] https://github.com/Telegram-FOSS-Team/Telegram-FOSS#changes

Re: Telegram publishes users' locations online

#129

Post by sneak »

gruez wrote: post #6

>[Line] fixed it by adding a random number to the user's destination This is a imperfect solution. There's two possibilities: the offset (aka "random number") is dynamic, or it's fixed. If it's the former all you have to do is sample enough times to get through the noise. If it's the latter, it's not vulnerable to the previous attack, but if you have a known point of reference (so you can deduce what the offset is),…

To use the approximate location feature on iOS, you have to have Location Services on in the first place, which divulges your (precise) location to Apple (via the wifi-mac-address location lookups to augment GPS).

We're right back to the neofeudalist setup: Apple will protect your privacy from everyone except Apple (and the US military, to whom they are legally obliged to provide the data without a warrant).

https://locusmag.com/2021/01/cory-doctorow-neofeudalism-and-...

Post reply on HN