Live data from Hacker News

Telegram publishes users' locations online

blog.ahmed.nyc

191–200 of 241 posts

Re: Telegram publishes users' locations online

#191
post #153
post #55

Earlier quoted context omitted.

Map cells are the best solution available for 90% of locations, but they don't help with the 10% that's close to map borders. If an user randomly jumps between two map cells you know they live at the boundary. Generally there is often noise in GPS signals so it's likely that person will jump around. Furthermore, if a person uses multiple services, and each service has its own cell layout, you can check all services a…

Apple's solution to this seems pretty good, here's a snippet of the transcript from a WWDC 2020 talk: > It might be tempting to think that reduced accuracy locations are simply your true location with some noise added in. > But that is not the case. Simply adding some random noise on top of the user's true location is actually not that secure against someone who might wish to disambiguate the true location. Instead i…

> > The actual semantics of the quantization are intended to replicate what the user would expect to hear if they were to ask for an approximate answer to the question "Where am I"?

Cool!

Re: Telegram publishes users' locations online

#192
post #173

Clickbait. User explicitly shares location to all people nearby, discovers it is accessible to all people. Feature is disabled by default, and user must find this and enable it. They are not even prompted to enable it unless they seek it.

They also say you need root to software spoof your location, but I thought you could do this without root using Mock Locations in developer options. I'm not sure if that's just an oversight, but it makes me think they aren't exactly familiar with Android as a whole.

Re: Telegram publishes users' locations online

#193
post #189

It's a shame that people still use Telegram when Signal is so much better, and has better credentials all around.

It's a shame that every time that Telegram is mentioned, Signal advocates feels the need to let everybody else know how superior Signal is supposed to be compared to everything else. I don't have anything against Signal itself, but this aggressiveness and arrogance is really putting me off. Has this became some kind of religion? Do you people realize that you are not the exclusive bearer of Truth, and that maybe, jus…

Thanks!

Re: Telegram publishes users' locations online

#194
post #173

Clickbait. User explicitly shares location to all people nearby, discovers it is accessible to all people. Feature is disabled by default, and user must find this and enable it. They are not even prompted to enable it unless they seek it.

Most users will not conclude from "sharing how nearby" people are, that someone could pinpoint exactly where they live by triangulating.

Unless Telegram does some extra steps to prevent exact locations (see other threads here), they should name it "share my location" instead of "show nearby users".

Re: Telegram publishes users' locations online

#195
post #13

Earlier quoted context omitted.

I think they are being sarcastic.

Nope. I think they should probably ask for one at signup. Would also reduce their server load if people only used 1 account instead of making 2+

Yeah. Where I live people are already getting picked up for being in a WhatsApp group, for sharing something on WhatsApp or even being a WhatsApp group admin. Do you know how they are caught? Their phone number is kyc compliant so its a cake walk.

While I use telegram, I use it to only communicate essential stuff with family. Same for signal and other stuff.

Matrix is interesting as it does not require a phone number... To think a government ID card would be needed to talk to family....shudders

Re: Telegram publishes users' locations online

#196

Telegram has so many anti features and dark patterns that I really wish it was less popular. I honestly use WhatsApp over Telegram because at least I know WhatsApp is insecure while people sometimes act like Telegram is a secure platform.

The rich irony here is that Telegram, in fact, way less secure than WhatsApp, yet, it's users (wrongly) perceive it to be magically more secure. The reason why WhatsApp is more secure is simple: it uses e2ee for all chats, and consequently has issues with multudevice usage and chats syncing, while Telegram just stores all chats in its servers, sans so-called "Secure chats". (I'm yet to see one person who is using the…

My entire company and tg-part of a friend circle uses them when needed. E.g. to discuss issues that contain private/financial details or something personal that is undesirable to leak to "third parties who ruin parties". Otoh, I wouldn't mind if my mile-long chat with IT buddy went entirely public, because we mostly discuss Web-tech, BTC and other sick jokes there.

Personally I'd never bother to start a secret chat with a person that I don't trust enough anyway. Neither do I trust an e2e messenger that my country didn't even bother to "pucker" legally.

>users (wrongly) perceive it to be magically more secure

This is claimed often, but I'm yet to see these users. Do they really believe that, is it just tg opponent's agenda that became popular, or both?

Re: Telegram publishes users' locations online

#197
post #173

Clickbait. User explicitly shares location to all people nearby, discovers it is accessible to all people. Feature is disabled by default, and user must find this and enable it. They are not even prompted to enable it unless they seek it.

Most users will not conclude from "sharing how nearby" people are, that someone could pinpoint exactly where they live by triangulating. Unless Telegram does some extra steps to prevent exact locations (see other threads here), they should name it "share my location" instead of "show nearby users".

Apparently that's what they do, at least on iOS:

  People nearby.
  Quickly add people nearby who are also viewing this section and discover local group chats.
  Please allow on location access to enable this feature. 
  "Allow in settings" (a button)
Then you see a system location access dialog. iOS allows to choose between (always, when in use, nope) and optionally to turn off "high precision" setting (not sure how much, but it covers entire city when off).

Then you may tap another button named "Make myself visible". I didn't, but a list of nearby users/groups was populated regardless.

Re: Telegram publishes users' locations online

#198
I can confirm on Android it does not warn you people will/could know your precise location in anyway.

It implies it's only 'nearby' with a warning about people you don't know messaging you.

Claims the app warns you or the user should know are either everything wrong with IT, or perhaps iOS is different.

Re: Telegram publishes users' locations online

#199
post #192
post #173

Clickbait. User explicitly shares location to all people nearby, discovers it is accessible to all people. Feature is disabled by default, and user must find this and enable it. They are not even prompted to enable it unless they seek it.

They also say you need root to software spoof your location, but I thought you could do this without root using Mock Locations in developer options. I'm not sure if that's just an oversight, but it makes me think they aren't exactly familiar with Android as a whole.

Correct, spoofing can be done with the "FakeGPS Free" app and developer options. Or via an emulator.

Re: Telegram publishes users' locations online

#200
post #192

Earlier quoted context omitted.

They also say you need root to software spoof your location, but I thought you could do this without root using Mock Locations in developer options. I'm not sure if that's just an oversight, but it makes me think they aren't exactly familiar with Android as a whole.

Correct, spoofing can be done with the "FakeGPS Free" app and developer options. Or via an emulator.

If you just want to spoof location, you only need to use the setting in developer options, but this is detectable by apps. For example, Ingress or Pokemon GO will refuse to work when it is enabled, so to actually spoof location on some apps, root is needed.
Post reply on HN