Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Telegram bug that disclose phone numbers of any users in public groups

docs.google.com

Post reply on HN
Print view View original

11–20 of 63 posts

Re: A Telegram bug that disclose phone numbers of any users in public groups

#11

Post by interfixus »

22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

We are not really supposed to talk ill of the holy Signal here on HN, and we usually get severely trounced if we do. But of course you are absolutely right - this has been one gaping hole in Signal privacy since forever.

Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardware habits.

A third stunt it likes is to make it non-obvious what actually happens when you set up groups. One friend did, believing it to be just a personal way of organising contacts, thereby of course immediately exposing parts of his contact list to the rest of us and vice versa.

Also terrible user experience (like using heavily license restricted software). I no longer use the thing.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#12

Post by johnnycab »

This appears to be a similar attack vector, to the one which might have been used for scamming Swiss Revolut customers, by determining legitimate users via the phone number range, in order to deliver fraudulent SMS messages.

https://www.reddit.com/r/Revolut/comments/cu07cv/revolut_sca...

Re: A Telegram bug that disclose phone numbers of any users in public groups

#13

Post by marcinzm »

hmnom wrote: post #3

It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.

>If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.

If you're a state actor probably pretty easy. Get a couple thousand rooted remote controllable android devices (which you probably already have for other projects) and have them automatically add 10k phones numbers each. Then have them join public telegraph lists and check for matches. Now you have gone through 10 million phone numbers. Run it in a loop 10 times and you have 100 million. Might take a few days to setup and run.

I don't see why this is infeasible in any way to do if you have a moderate budget (ie: state actor).

edit: And if your target is in your jurisdiction then you probably have a good mapping of names to phone numbers already.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#14

Post by tapoxi »

interfixus wrote: post #11
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

We are not really supposed to talk ill of the holy Signal here on HN, and we usually get severely trounced if we do. But of course you are absolutely right - this has been one gaping hole in Signal privacy since forever. Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardw…

> Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardware habits.

This is a security feature to ensure you're talking to the same person. Phone numbers are terrifyingly easy to port to another account.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#16

Post by paulcarroty »

22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

Does Signal still use Google API? It's the epic fail for messenger who declared privacy too.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#17

Post by sha666sum »

NateEag wrote: post #15
techntoke wrote: post #10

Earlier quoted context omitted.

Nah man, you can thank the FCC for that.

s/FCC/human nature/

I live in $civilized_country and have gotten one unsolicited phone call ever. It was from an Indian, so either it was a scam or someone who doesn't adhere to telemarketing blocklists.

Do not blame USA's inadequacies on human nature.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#18

Post by tialaramex »

22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof).

Your goal is to set up little fun secret decoder ring groups each silo'd with a handful of people so you can pretend to be spies or whatever. For this goal it's important that each silo you set up doesn't know about the others. Signal just wants to end-to-end encrypt all the messages sent between all phones. These goals conflict, and, frankly I think your goal is stupid and should lose.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#19

Post by tialaramex »

paulcarroty wrote: post #16
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

Does Signal still use Google API? It's the epic fail for messenger who declared privacy too.

Using Google to deliver notifications to Android phones achieves Do Not Stand Out, an important property that it would be an "epic fail" not to offer.

If you insist, you can install a version of Signal that doesn't use this service, whereupon you will stand out, or more specifically your notifications will stand out from everything else.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#20

Post by exocron »

22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof).

I agree that there are some contacts that I would rather not know that I was on Signal, but, unfortunately, this is an impossible problem to solve when the goal is to create an end-to-end encrypted messaging platform where your identifier is your phone number. The server has to know when a number is not a user so the app can fall back to sending unencrypted SMS (although why Signal falls back to SMS is a mystery to me) and it also has to carry the current public key for each user so that you can be sure that you're talking to who you think you're talking to.

Put another way, even if Signal didn't advertise that, "So-and-so is on Signal, say hey!" you could still theoretically determine whether or not a given number is on signal by sending a message to that number. If it fails, you know they aren't. And if it succeeds, well, then you know they are.

Post reply on HN