Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

ndss-symposium.org

Post reply on HN
Print view View original

31–40 of 206 posts

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#31

Post by zeitg3ist »

walterbell wrote: post #5
zeitg3ist wrote: post #4

Earlier quoted context omitted.

I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).

For those who want end-to-end encrypted messages, it's a feature that the server doesn't have a persistent archive of message history. Wire messages are on the server for a few weeks, long enough to relay those messages to transiently offline devices. Telegram is great at what it does, different use case from Wire.

Yeah, I guess it’s just a different use case, but it was a behavior I didn’t expect (maybe I didn’t read the “fine print”) and it turned me off using it for long-term stuff. It’s a pity because I liked the interface and features.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#33

Post by anthropodie »

I will criticize how Contacts are implemented on Android for this.

For example, I don't want any person who I interact with once or twice a month to have access to my WhatsApp or any other social media app. But I can't do this in Android because once you add contact every damn app has access to that contact list. It's full access or no access if app uses permissions. I need something where I can label contacts to not appear in main contact list.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#34

Post by hiq »

dotandimet wrote: post #8
random5634 wrote: post #3

100% of signal scrapped - ugh

Just as insecure as Whatsapp, just far fewer users.

> Just as insecure as Whatsapp

From the paper:

> With its focus on privacy, Signal excels in exposing almost no information about registered users, apart from their phone number. In contrast, WhatsApp exposes profile pictures and the About text for registered numbers, and requires users to opt-out of sharing this data by changing the default settings.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#35

Post by eythian »

hansel_der wrote: post #17
Jonnax wrote: post #12

There needs to be two lists of contacts. One which I allow to be shared with apps And another which are my contacts I use with my dialer. People don't need their messenger apps knowing the phone number of their doctor

on ios if one does not grant addressbook permission for the app: * telegram uses an "internal" contact list for which one can add contacts via the desktop client and then works as expected. * whatsapp let's the user freely initiate contact by phone numbers, but then only shows the number (no name). don't know about signal.

As far as I can tell, on Android, whatsapp requires adding a person to your contacts before you can message them at all. I find this very annoying when I'm going to be messaging someone for a brief period only. If there's a way to not do this, I'd like to know it.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#36

Post by hiq »

blorange wrote: post #19

"Interestingly, if the number provided by Hushed was previously registered by another user, the WhatsApp account is "inherited", including group memberships. A non-negligible percentage of the accounts we registered had been in active use, with personal and/or group messages arriving after account takeover." Did not know that taking over a WhatsApp account is that easy.

You can set a pin which I think would reset your account eventually if you want to register the same number but fail to provide the correct pin, and the previous owner of the phone number does not use WhatsApp in some time.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#37

Post by oauea »

zeitg3ist wrote: post #4
walterbell wrote: post #2

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).

So you want them to just hold on to your messages on their servers indefinitely? I realize this is the norm nowadays, but is this really what you actually want?

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#38

Post by hiq »

jillesvangurp wrote: post #18

The practical consequence of this is that your phone number + name is public information. Almost as if it were listed in a phone book. That was pretty much the case already so it's not really a new threat. Of course people with unlisted numbers will be a bit annoyed by this. Likewise, your email address probably is part of numerous databases, including those owned by spammers/scammers. I'm not saying this is good. Bu…

> The practical consequence of this is that your phone number + name is public information.

From the paper:

> With its focus on privacy, Signal excels in exposing almost no information about registered users, apart from their phone number. In contrast, WhatsApp exposes profile pictures and the About text for registered numbers, and requires users to opt-out of sharing this data by changing the default settings.

So if you only use Signal you don't leak the connection between your profile (which could contain your name) and your phone number, at least not until you accept a message from an attacker.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#39

Post by Arathorn »

walterbell wrote: post #15
ajconway wrote: post #10

Earlier quoted context omitted.

Matrix does have end-to-end encrypted persistent history.

Yes, it's possible. Depending on your threat model, it may or may not be a good idea to have a long-term archive of encrypted data be subject to legal process. Matrix has plans to support IETF MLS, which is a necessary precursor to messenger interoperability.

Matrix lets you configure the history retention on a per-server or per-room basis, fwiw: https://github.com/matrix-org/synapse/blob/develop/docs/mess.... From a metadata perspective, we're working on P2P to avoid metadata accumulating on servers. In terms of the OP here (address-book based contact discovery), https://github.com/matrix-org/matrix-doc/blob/hs/hash-identi... is how Matrix optionally implements it while trying to preserve privacy.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#40

Post by vbezhenar »

strogonoff wrote: post #26
hansel_der wrote: post #17

Earlier quoted context omitted.

on ios if one does not grant addressbook permission for the app: * telegram uses an "internal" contact list for which one can add contacts via the desktop client and then works as expected. * whatsapp let's the user freely initiate contact by phone numbers, but then only shows the number (no name). don't know about signal.

WhatsApp on iOS cripples user experience without access to OS contact list. You cannot create groups, and cannot initiate a chat with anyone, even by phone number. It works if someone else messages you first or adds you to a group.

https://wa.me/phonenumber

Very intuitive, I know.

Post reply on HN