Live data from Hacker News

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

ndss-symposium.org

121–130 of 206 posts

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#121
post #114

Earlier quoted context omitted.

It is not a federated protocol. It is an app that has some internally developed protocol, which makes it hardly more than an app, really. As long as one for-profit company decides how it changes and evolves, it's nothing more than that.

Maybe I'm missing something. What do you understand by federated protocol? As I understand it, Matrix seems to be an open protocol that supports federation. The open protocol part is evident by the extense documentation of the protocol specification that I linked in my previous message and by the fact that anyone can propose a change in the spec: https://spec.matrix.org/unstable/proposals/ You can see how the protoco…

by an open federated protocol I understand the likes of email or xmpp, or TCP, for that matter. Standardized and developed by an independent entity, for better or worse. Where the power of any single developer is checked by other developers and the standards body. Currently, matrix.org owners can unilaterally change the protocol in any way they like, upgrading their server that hosts the vast majority of users, and all the other independent implementations would be left in the dust.

Until this is possible, it is not really a protocol, it's more like a private API available on multiple instances.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#122

Earlier quoted context omitted.

You need a migration path and backwards compatibility. They can't kill all the apps which used the old system.

They can just lie to the old apps. Tell them they're getting the full list when the API is called.

Privacy Guard in Cyanogenmod used to do this I think, at least to fake the list to be empty. It somehow still broke a tiny number of apps (unintentionally, i.e. the app owners didn't purposefully add code to annoy those users) so there seems to have been some flaw between 'empty list with permission granted' and 'empty list with permission not granted'. Regardless, I'm not sure why this didn't become mainline Android aside from that it would come with no benefits to the main developer of Android.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#123
post #114

Earlier quoted context omitted.

Maybe I'm missing something. What do you understand by federated protocol? As I understand it, Matrix seems to be an open protocol that supports federation. The open protocol part is evident by the extense documentation of the protocol specification that I linked in my previous message and by the fact that anyone can propose a change in the spec: https://spec.matrix.org/unstable/proposals/ You can see how the protoco…

by an open federated protocol I understand the likes of email or xmpp, or TCP, for that matter. Standardized and developed by an independent entity, for better or worse. Where the power of any single developer is checked by other developers and the standards body. Currently, matrix.org owners can unilaterally change the protocol in any way they like, upgrading their server that hosts the vast majority of users, and a…

So if all goes well, it will become an "open federated protocol", according to your definition, in a few years when it is more stable, mature and multiple interests (companies) are governing its direction?

Sounds like a fair position to have.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#124
post #84
post #78

Earlier quoted context omitted.

Wire is massively underrated in general. It’s got a slick UI that’s easy for non techies, it’s got native clients on all major platforms, and it has everything you really need from an e2e IM without the fluff. I’m surprised it doesn’t come up more in these discussions and people just “settle” for Signal or another service that needs your phone number etc.

I also like wire and just by chance found it to message my kids on their iDevices that don’t have a phone number like iPads and iPods. It works great and has all the main features. I’m even happier now that you guys inform me it’s secure also.

If they’re Apple devices, why don’t you just use iMessage?

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#125
Every time I open the Snapchat Android app it prompts me with a Snapchat-styled (not the system) dialog to share my contacts. Every time I hit "Don't allow". Every time it prompts me again.

This is an inexcusable dark pattern. Two things need to happen:

1. The operating system needs to provide a "screw you, never" option for any permissions.

2. We as engineers need to say "screw you, never" to requests to implement behavior like this. Sure, this could be a bug, but I see the same behavior with Venmo and location access.

Personally I'm rather disillusioned with where we've found ourselves. This sort of adversarial relationship in which people are property of a platform and treated as such is winning.

Edit: Venmo had been set to "Only while using the app" and was prompting to enable location services on the device, not for permission. That's my own fault.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#126
post #106
post #78

Earlier quoted context omitted.

Wire is massively underrated in general. It’s got a slick UI that’s easy for non techies, it’s got native clients on all major platforms, and it has everything you really need from an e2e IM without the fluff. I’m surprised it doesn’t come up more in these discussions and people just “settle” for Signal or another service that needs your phone number etc.

The clients are not actually native, at least on desktop it's just Electron and the mobile clients (Android, iOS) don't feel fast either, but frankly rough edges like these are my only real complaint. Features are available and work everywhere (unlike Signal which has a dumbed-down desktop client and no web client at all), it does everything you generally need and the search is actually superb (better than Telegram e…

Element does encrypted search fine on desktop, fwiw.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#127

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

Matrix tools like Element is decentralised which is preferred, wire is not. The company keeps a list of all the users you contact until you delete your account. Source: https://archive.fo/ARZe4#im

It is federated, not decentralized. You need to use a server, which will have access to your contacts and the rest of the metadata such as how often you talk to them etc (and all message content that is not E2EE). You are only safe from third party if both you and people you talk to run their own servers.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#128
post #56

Earlier quoted context omitted.

That is a very odd take away. The first method is good to have for apps you trust, and requires permission from the user. https://developer.android.com/guide/topics/permissions/overv... The second method is what you want with apps you don't yet fully trust or for some other reason don't want to give direct access to your contacts. https://developer.android.com/training/permissions/evaluatin...

Why would an app developer ever think their own app should use the method reserved for untrustworthy apps? All incentives suggest the developer should prevent using the app without full permissions being given (basically force the user into giving permission) and only implement the first method.

Because it would be easier for the users and allow some customization you can't otherwise have?

Sure it can be abused, but there are also legit use cases

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#129
post #12

There needs to be two lists of contacts. One which I allow to be shared with apps And another which are my contacts I use with my dialer. People don't need their messenger apps knowing the phone number of their doctor

In time I expect all OSes (mobile and desktop) will provide a "give false data" option. So Sandboxed+false inputs, sort of a digital Descartes deceiver.

Because you know the slimy app developers will refuse to work if you don't hand over your full contact list. and people will just accept that.

So the end game is a completely adversarial relationship, even on your own device.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#130
post #113
post #106

Earlier quoted context omitted.

The clients are not actually native, at least on desktop it's just Electron and the mobile clients (Android, iOS) don't feel fast either, but frankly rough edges like these are my only real complaint. Features are available and work everywhere (unlike Signal which has a dumbed-down desktop client and no web client at all), it does everything you generally need and the search is actually superb (better than Telegram e…

> dumbed-down desktop client That used to be true, but now the desktop client has almost all the feature of the mobile clients. Which feature do you miss there? > Signal clearly has more users (while being worse on privacy) I assume you're talking about the phone number requirement? This is fair criticism, but what about the rest? Signal leaks way less metadata than Wire, which is more similar to WhatsApp in that reg…

For metadata you just have to trust them. Sealed sender doesn't solve that[1], even if it's better than nothing. It's also better than nothing to require no phone number in the first place (Wire), or not to require a payment (like Threema does) which is roughly as hard to make anonymous as getting an anonymous phone number. But either way, they can track everything you send, it's a matter of wanting to. The only way to avoid that is by not sending personal data to semi-/untrusted parties at all (Matrix).

Since centralized services are currently also the convenient ones and neither Wire nor Signal show any sign of wanting to use a decentralized protocol, those that can't be bothered to use inconvenient services have to trust that their centralized service is ethical about what they do with your data.

The privacy differences are very minimal by comparison when they're all missing one basic feature or other like message editing (Signal), a desktop client (Threema[2]), cross-chat searching (Wire), searching a chat at all (Element), any usable encryption (Telegram), etc. If you're going to use an end-to-end encrypted messenger where the server can't read any contents, the privacy differences are just not that large when you trust them all equally. The only thing that you can objectively compare is what the client sends, since that's something they can minimize and you can actually check.

[1] "clients derive a 96-bit delivery token from their profile key and register it with the service. The service requires clients to prove knowledge of the delivery token for a user in order to transmit “sealed sender” messages to that user". It's a bit opaque so in regular English: my Signal client sends something like deliveryKey = H(profileKey, currentTime) to Signal, where my profileKey is something only my contacts and I know. Great, so my contacts only specify the deliveryKey and not who's sending, so you send anonymously! But wait, those contacts connect to Signal with an IP address and are doing other things like updating their profile or registering their delivery keys for their account from that same IP address. 1+1=2 and you know who is sending messages to whom.

[2] They have it, but your phone plays Chinese Whispers with your computer and every time your laptop or phone reconnects to wifi/mobile data you need to open the app on your phone and navigate two menus to re-enable it.

Post reply on HN