Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

ndss-symposium.org

Post reply on HN
Print view View original

111–120 of 206 posts

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#111

Post by Andrew_nenakhov »

galbar wrote: post #104
Andrew_nenakhov wrote: post #86

Earlier quoted context omitted.

No, there is always xmpp. Matrix is just an app, and we need a federated protocol. I think that Matrix will never have an alternative server implementation made by a competing party, which makes it's main selling point void.

Matrix is not an app. It is a protocol. You can find the specification here: https://matrix.org/docs/spec/ There are also multiple client and server implementations already. You can find them here: https://matrix.org/docs/projects/try-matrix-now/ There are also at least two companies offering homeserver hosting: https://matrix.org/hosting/

It is not a federated protocol. It is an app that has some internally developed protocol, which makes it hardly more than an app, really.

As long as one for-profit company decides how it changes and evolves, it's nothing more than that.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#112

Post by MiddleEndian »

viraptor wrote: post #55
anthropodie wrote: post #51

Earlier quoted context omitted.

My point remains valid. If OS is handling contacts it should have some sort of control over what's getting shared. Theirs no point of providing alternate ways if an app can access full list of contacts.

You need a migration path and backwards compatibility. They can't kill all the apps which used the old system.

They can just lie to the old apps. Tell them they're getting the full list when the API is called.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#113

Post by hiq »

lucb1e wrote: post #106
sen wrote: post #78

Earlier quoted context omitted.

Wire is massively underrated in general. It’s got a slick UI that’s easy for non techies, it’s got native clients on all major platforms, and it has everything you really need from an e2e IM without the fluff. I’m surprised it doesn’t come up more in these discussions and people just “settle” for Signal or another service that needs your phone number etc.

The clients are not actually native, at least on desktop it's just Electron and the mobile clients (Android, iOS) don't feel fast either, but frankly rough edges like these are my only real complaint. Features are available and work everywhere (unlike Signal which has a dumbed-down desktop client and no web client at all), it does everything you generally need and the search is actually superb (better than Telegram e…

> dumbed-down desktop client

That used to be true, but now the desktop client has almost all the feature of the mobile clients. Which feature do you miss there?

> Signal clearly has more users (while being worse on privacy)

I assume you're talking about the phone number requirement? This is fair criticism, but what about the rest? Signal leaks way less metadata than Wire, which is more similar to WhatsApp in that regard.

See also this comment: https://news.ycombinator.com/item?id=14069674

Some things might have changed, but it's not clear to which extent.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#114

Post by galbar »

Andrew_nenakhov wrote: post #111
galbar wrote: post #104

Earlier quoted context omitted.

Matrix is not an app. It is a protocol. You can find the specification here: https://matrix.org/docs/spec/ There are also multiple client and server implementations already. You can find them here: https://matrix.org/docs/projects/try-matrix-now/ There are also at least two companies offering homeserver hosting: https://matrix.org/hosting/

It is not a federated protocol. It is an app that has some internally developed protocol, which makes it hardly more than an app, really. As long as one for-profit company decides how it changes and evolves, it's nothing more than that.

Maybe I'm missing something.

What do you understand by federated protocol?

As I understand it, Matrix seems to be an open protocol that supports federation.

The open protocol part is evident by the extense documentation of the protocol specification that I linked in my previous message and by the fact that anyone can propose a change in the spec: https://spec.matrix.org/unstable/proposals/

You can see how the protocol supports federation here: https://matrix.org/docs/spec/server_server/r0.1.4

As for the organization governing the protocol, there is The Matrix.org Foundation: https://matrix.org/foundation/

In the foundation page it states it is "a non-profit UK Community Interest Company, incorporated to act as the neutral guardian of the standard on behalf of the whole Matrix community"

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#116

Post by LeifCarrotson »

zibzab wrote: post #56
anthropodie wrote: post #51

Earlier quoted context omitted.

My point remains valid. If OS is handling contacts it should have some sort of control over what's getting shared. Theirs no point of providing alternate ways if an app can access full list of contacts.

That is a very odd take away. The first method is good to have for apps you trust, and requires permission from the user. https://developer.android.com/guide/topics/permissions/overv... The second method is what you want with apps you don't yet fully trust or for some other reason don't want to give direct access to your contacts. https://developer.android.com/training/permissions/evaluatin...

Why would an app developer ever think their own app should use the method reserved for untrustworthy apps?

All incentives suggest the developer should prevent using the app without full permissions being given (basically force the user into giving permission) and only implement the first method.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#117

Post by LeifCarrotson »

MiddleEndian wrote: post #112
viraptor wrote: post #55

Earlier quoted context omitted.

You need a migration path and backwards compatibility. They can't kill all the apps which used the old system.

They can just lie to the old apps. Tell them they're getting the full list when the API is called.

"Yep, this user has exactly one contact, and gee, it happens to be the one they're calling now, how fortuitous! They had a different single contact yesterday, but apparently they've deleted that one and added this one."

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#118

Post by ratww »

TeMPOraL wrote: post #87
vbezhenar wrote: post #40

Earlier quoted context omitted.

https://wa.me/phonenumber Very intuitive, I know.

For people as confused as I was about the above link - after spending 5 minutes trying to figure out why visiting it gives me a 404 page, I eventually got out my phone and tried pushing that link to Android activity system, and then I discovered: it's meant to be wa.me/[an actual phone number goes here] - like wa.me/12345678912345. Not great indeed.

If you type https://wa.me/your_own_phone_number (replace your_own_phone_number with your number) you can get into a chat with yourself. Useful for misanthropes, introverts, or for having a place to store information.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#119

Post by eythian »

ffpip wrote: post #48
eythian wrote: post #35

Earlier quoted context omitted.

As far as I can tell, on Android, whatsapp requires adding a person to your contacts before you can message them at all. I find this very annoying when I'm going to be messaging someone for a brief period only. If there's a way to not do this, I'd like to know it.

You can message a person without adding them to your contacts, if you know their phone number. https://wa.me/their-phone-number-in-international-format . Type this link in the browser or in some chat. Long press, click open and it will open in whatsapp by default. You can start a chat with yourself in whatsapp, to send these links to yourself and easily click on them. (type wa.me/your-phone-number-in-international-fo…

Thanks, I'll remember that. It's an awkward workaround compared to pasting their number from an email into the app, but it'll have to do I guess.

Here it's pretty common for people to, for example, put a notice up in my apartment foyer "does anyone have xyz that I can borrow, please app me at +123456789" and having to create a contact is an annoying bit of overhead.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#120

Post by MauranKilom »

vbezhenar wrote: post #40
strogonoff wrote: post #26

Earlier quoted context omitted.

WhatsApp on iOS cripples user experience without access to OS contact list. You cannot create groups, and cannot initiate a chat with anyone, even by phone number. It works if someone else messages you first or adds you to a group.

https://wa.me/phonenumber Very intuitive, I know.

404 for me.
Post reply on HN