Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Telegram bug that disclose phone numbers of any users in public groups

docs.google.com

Post reply on HN
Print view View original

21–30 of 63 posts

Re: A Telegram bug that disclose phone numbers of any users in public groups

#21

Post by dooglius »

tapoxi wrote: post #14
interfixus wrote: post #11

Earlier quoted context omitted.

We are not really supposed to talk ill of the holy Signal here on HN, and we usually get severely trounced if we do. But of course you are absolutely right - this has been one gaping hole in Signal privacy since forever. Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardw…

> Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardware habits. This is a security feature to ensure you're talking to the same person. Phone numbers are terrifyingly easy to port to another account.

>Phone numbers are terrifyingly easy to port to another account.

Which is precisely why they should never be used as an identifier.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#22

Post by dooglius »

exocron wrote: post #20
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof). I agree that there are some contacts that I would rather not know that I was on Signal, but, unfortunately, this is an impossible problem to solve when the goal is to create an end-to-end e…

>this is an impossible problem to solve when the goal is to create an end-to-end encrypted messaging platform where your identifier is your phone number

Right, the use of phone number as identifier is flawed by design, and not secure

Re: A Telegram bug that disclose phone numbers of any users in public groups

#23

Post by gervase »

exocron wrote: post #20
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof). I agree that there are some contacts that I would rather not know that I was on Signal, but, unfortunately, this is an impossible problem to solve when the goal is to create an end-to-end e…

> If it fails, you know they aren't. And if it succeeds, well, then you know they are.

This problem is solved in an interesting way by Keybase Chat, in which messages sent to non-existing accounts are "delivered", and can then be read if that account is created later on. It requires re-keying of the message by the sender, so it's not exactly a "fire and forget" solution, but it's pretty neat anyway.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#24

Post by MikusR »

hmnom wrote: post #3

It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.

The way cellphone telephones work, is by registering to a cell. so all they have to do is look what phones were in vicinity of cell towers in place where they protest.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#25

Post by mahemm »

The widespread usage of Telegram in a situation as sensitive as the Hong Kong protests is a failure on behalf of the security industry in educating the public.

Even WhatsApp is miles better, but in reality it should be a no-brainer for the relevant people to use Signal or perhaps Threema/Wire. What a shame that charlatans have successfully marketed themselves to the top of this segment with a distinctly inferior product.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#26

Post by davidhyde »

tialaramex wrote: post #18
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof). Your goal is to set up little fun secret decoder ring groups each silo'd with a handful of people so you can pretend to be spies or whatever. For this goal it's important that each silo you…

People use Signal in the first place because they want something more secure and privacy focused than the alternatives. It's not reasonable to mock them for having higher expectations of privacy and security than you do. Its the whole point of the product.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#27

Post by ufmace »

mahemm wrote: post #25

The widespread usage of Telegram in a situation as sensitive as the Hong Kong protests is a failure on behalf of the security industry in educating the public. Even WhatsApp is miles better, but in reality it should be a no-brainer for the relevant people to use Signal or perhaps Threema/Wire. What a shame that charlatans have successfully marketed themselves to the top of this segment with a distinctly inferior prod…

I don't think Signal supports very large groups well (hundreds of users or more). Or things like announcement channels where tens of thousands can subscribe, but only a handful of accounts can post. Sounds to me like they have a superior product.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#28

Post by tialaramex »

davidhyde wrote: post #26
tialaramex wrote: post #18

Earlier quoted context omitted.

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof). Your goal is to set up little fun secret decoder ring groups each silo'd with a handful of people so you can pretend to be spies or whatever. For this goal it's important that each silo you…

People use Signal in the first place because they want something more secure and privacy focused than the alternatives. It's not reasonable to mock them for having higher expectations of privacy and security than you do. Its the whole point of the product.

People who actually want "secure and privacy focused" text messages would want their messages to or from their boss to be "secure and privacy focused" too. Whereas people who just want to create yet another little clique don't want that. They'd rather most messages remained unencrypted, insecure, not privacy focused at all, so long as they can underscore how cool they are by creating an "in" group of people with secure messages.

The _whole point of the product_ - to repeat your phrase - is to secure _all_ the messages rather than repeat the mistake of tools like PGP that never get there.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#29

Post by aasasd »

hmnom wrote: post #3

It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.

There's apparently at least one private company that gathered a database of account-to-number correlations precisely by adding over ten million numbers to Telegram's address books. Here's an article in Russian where one account is deanonymised: https://meduza.io/feature/2019/08/10/kto-takoy-tovarisch-may...

Dunno if this is patched by Telegram in any way now. However, I don't see why it would be difficult for a program to add numbers to the contact list incrementally. To my knowledge, computers so far were pretty good at incrementing numbers. And if the contact list length is limited, the question is just how many phone numbers a company can buy.

Post reply on HN