Live data from Hacker News

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

ndss-symposium.org

181–190 of 206 posts

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#181

I was wondering, what would happen, if I would add all the phone numbers from the Facebook leak to my contacts. Did anybody try something like this? What is the upper contact limit?

> What is the upper contact limit?

answer is in the paper

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#182

Earlier quoted context omitted.

That’s a bit unfair. I value privacy for some things but for other things I value more not losing my message history. Telegram is not as secure as other options by default, but for me it strikes a good balance between convenience/usability and privacy, as I can optionally open a self-destroying secret chat when I need it.

With Matrix you get privacy with message history.

Thanks for the suggestion, I will try it out.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#183
post #109

Earlier quoted context omitted.

If you can acquire BTC anonymously, then you can acquire prepaid virtual credit cards anonymously. Most localbitcoins exchangers will happily do bank transfers for you without asking any questions either. There's not many kinds of payments which aren't fairly easy to do anonymously.

Any recommendation on prepaid virtual credit cards which are accepted in EU?

Ezzocard has many. Exchange rates are bad, but it's a small price to pay for privacy.

These guys must be making insane amounts of money, would love to build a competitor.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#184

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

I'm amazed that they still don't have any kind of 2FA after nearly four years. https://github.com/wireapp/wire/issues/85

Perhaps this comment is why my email has blown up over the past day. It's interesting to see this issue pick up steam every now and then.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#185

Earlier quoted context omitted.

The system does have a "screw you, never" option for all permissions. The issue is that Snapchat (in your case, as I don't have this happen on v11.23.3.36) is told that they wont get the permission and wont be able to ask for it either. And so they perform their own inhouse permission request to you. There is nothing that can be done from the system's point of view for that.

> v11.23.3.36 v11.25.0.29 Beta for me > in house permission request That's what I had feared. I'd expand the scope of "the system" to include Play store rules.

It would change the ecosystem, for the better, if Google would uphold and enforce their policies as fiercly as Apple does. It would surely reduce the amount dark pattern predatory apps on the market place, and overall just pull the quality up a few notches.

Why they haven't done so already is a mystery to me.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#186

Earlier quoted context omitted.

So you think if a notorious terrorist or whatever moved millions of dollars through Monero to fund a terror attack, American or other intelligence agencies wouldn't be able to identify the transaction? It could be done truly anonymously when up against the full weight and might of US, Western, Israeli etc intelligence budgets and methods?

Well the sender, receiver and the amounts are all hidden, so yes. I should still note that it isn't a magic bullet, and that things you do in connection to the monero blockchain can obviously still give the authorities an idea of what you are doing.

Would it still be hidden if a government identified servers hosting the network, seized them and forensically analyzed them including having access to potential zero days in encryption tools, backdoors in algorithms, and supercomputers?

Etc etc. My point is that anonymous is an ideal, not a absolutist reality.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#187

Every time I open the Snapchat Android app it prompts me with a Snapchat-styled (not the system) dialog to share my contacts. Every time I hit "Don't allow". Every time it prompts me again. This is an inexcusable dark pattern. Two things need to happen: 1. The operating system needs to provide a "screw you, never" option for any permissions. 2. We as engineers need to say "screw you, never" to requests to implement b…

This dark pattern is called the ratchet. https://news.ycombinator.com/item?id=16689663

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#188

Earlier quoted context omitted.

> In time I expect all OSes (mobile and desktop) How much time? This has been a thing in one form or another since j2me. Some j2me platforms actually supported this kind of behavior, but that was all lost once Android and iOS came along. Same with fine-grained permissions over network access (eg, user having complete control over what networks/etc an app can access). We /had/ all of this in the days of BlackBerry, an…

I didn't know that (Blackberry). I would like to know about it, if you have any links.

All current info is about BB os 10, which did not provide this policy; but I can attest to it as a former owner and app developer for their their java-based OS (through 7.1). Whenever an application attempted to access a network, you would be given a prompt to approve/always approve/deny; and you had pretty fine-grained controls beyond that.

This link has some screenshots and gives an idea of the capabilities. Adblock recommended:

https://crackberry.com/blackberry-101-application-permission...

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#189

Earlier quoted context omitted.

Matrix is no app. Matrix an open protocol for decentralized communication that works through federation. Further, there is a alternative server implementation: Conduit. What main selling point are you talking about?

If you make a device (say, wireless walkie-talkie) that can communicate with other devices of this type, it is not yet an open standard protocol. It's just your proprietary thingy that you do with some communication properties. Same thing here. It's a product of one commercial company, which fully decides how it works. Conduit is not finished, and, given the monolytic nature of matrix protocol (as opposed to XMPP, by…

> If you make a device (say, wireless walkie-talkie) that can communicate with other devices of this type, it is not yet an open standard protocol. It's just your proprietary thingy that you do with some communication properties.

True, but this isn't the case. The device you are talking about is Element, which uses the protocol. Here you can find the protocol: https://spec.matrix.org/unstable/

It is an open standard.

> Same thing here. It's a product of one commercial company, which fully decides how it works.

You, again, conflate Matrix with Element, which btw. does not fully decide how it works. Read more about that here: https://matrix.org/foundation/

> Conduit is not finished, and, given the monolytic nature of matrix protocol (as opposed to XMPP, by the way) it will likely never be finished. Even on it's GitHub page it writes with big big letters: DO NOT RELY ON IT.

Conduit is a server of a competing entity. I didn't claim it was finished or will ever be finished in the way that there won't be any development any more.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#190

Earlier quoted context omitted.

mind explaining how Matrix is not decentralized?

What they mean is that there is a client/server separation. Truly decentralised systems don't have this distinction and only have communicating nodes. Though this is coming to Matrix too.

Seems arbitrary as clearly Matrix is decentralized despite having client/server separation.
Post reply on HN