Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

ndss-symposium.org

Post reply on HN
Print view View original

71–80 of 206 posts

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#71

Post by Ar-Curunir »

Andrew_nenakhov wrote: post #58

This scientifically-looking paper could have been written by Captain Obvious himself. It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. If users' behaviour has shown us anything, it's that they love it. And for all the dangers of their privacy loss, they happily trade it for the co…

> This scientifically-looking paper could have been written by Captain Obvious himself

Why didn’t you write it then? It’s easy to dismiss the work of others, not so easy to do the work yourself.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#72

Post by duckfang »

kome wrote: post #66
Andrew_nenakhov wrote: post #58

This scientifically-looking paper could have been written by Captain Obvious himself. It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. If users' behaviour has shown us anything, it's that they love it. And for all the dangers of their privacy loss, they happily trade it for the co…

> It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. Mass uploading contacts should be limited, like Telgram rightfully implemented. Signal should do the same. Also, for signal you have to give the list of your contacts. And you don't have with Telegram (and I didn't).

With Signal, it means your friends can rat you out by them sharing their address book.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#73

Post by api »

zeitg3ist wrote: post #4
walterbell wrote: post #2

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).

This is one of those replies that should be put in some kind of HN canon. It perfectly shows why there are so few privacy or security respecting options. They did the correct thing for security and you switched.

As I've observed for a long time: UX is more powerful than anything else except maybe cost, and even then one driver for user preference for "free" apps is not having to dig out a card... so cost is also UX.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#74

Post by Andrew_nenakhov »

kome wrote: post #66
Andrew_nenakhov wrote: post #58

This scientifically-looking paper could have been written by Captain Obvious himself. It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. If users' behaviour has shown us anything, it's that they love it. And for all the dangers of their privacy loss, they happily trade it for the co…

> It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. Mass uploading contacts should be limited, like Telgram rightfully implemented. Signal should do the same. Also, for signal you have to give the list of your contacts. And you don't have with Telegram (and I didn't).

Actually, the general love for Signal on HN is puzzling to me. It's nothing more than yet another centralised silo not owned by the users. End-to-end encryption? I'd take federation over it any day.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#75

Post by Zambyte »

zeitg3ist wrote: post #4
walterbell wrote: post #2

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).

Uh, just FYI this is alao a feature on Telegram that can't be disabled (only extended up to a year).

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#76

Post by criley2 »

norcux wrote: post #70
ThermalCube wrote: post #54

Earlier quoted context omitted.

You can pay by Wire transfer, MasterCard, Visa, PayPal or even Bitcoin[1] so there is at least one anonymous payment option available 1: https://shop.threema.ch/terms

Who said Bitcoin is anonymous?

There is no such thing as an anonymous transaction, for a fully informed definition of anonymous.

Bitcoin isn't... neither is cash in hand. Neither is a drop. Someone knows.

A discussion of 'anonymity' in this context is one of increasing the difficulty of discovery, not thinking that the discovery is impossible. If a major world government is after you, good luck with "anonymous"

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#77

Post by _0ffh »

norcux wrote: post #70
ThermalCube wrote: post #54

Earlier quoted context omitted.

You can pay by Wire transfer, MasterCard, Visa, PayPal or even Bitcoin[1] so there is at least one anonymous payment option available 1: https://shop.threema.ch/terms

Who said Bitcoin is anonymous?

If you can acquire BTC anonymously, then you can pay anonymously.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#78

Post by sen »

walterbell wrote: post #2

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

Wire is massively underrated in general. It’s got a slick UI that’s easy for non techies, it’s got native clients on all major platforms, and it has everything you really need from an e2e IM without the fluff. I’m surprised it doesn’t come up more in these discussions and people just “settle” for Signal or another service that needs your phone number etc.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#79

Post by c0wb0yc0d3r »

ReptileMan wrote: post #52
qwertox wrote: post #24

Earlier quoted context omitted.

Threema also does not require your phone number.

It requires payment - so google account or your paypal/credit card are on record.

FWIW, your threema identity isn't tied to your license key.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#80

Post by egberts1 »

Andrew_nenakhov wrote: post #74
kome wrote: post #66

Earlier quoted context omitted.

> It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. Mass uploading contacts should be limited, like Telgram rightfully implemented. Signal should do the same. Also, for signal you have to give the list of your contacts. And you don't have with Telegram (and I didn't).

Actually, the general love for Signal on HN is puzzling to me. It's nothing more than yet another centralised silo not owned by the users. End-to-end encryption? I'd take federation over it any day.

there is always Matrix app.

Some may argue that Matrix still a centralized server by the virtue of seeding your group info somewhere. But this seeding can be done via paper-only thereby it is still a true decentralized messaging server.

Post reply on HN