Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

ndss-symposium.org

Post reply on HN
Print view View original

21–30 of 206 posts

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#21

Post by zibzab »

walterbell wrote: post #5
zeitg3ist wrote: post #4

Earlier quoted context omitted.

I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).

For those who want end-to-end encrypted messages, it's a feature that the server doesn't have a persistent archive of message history. Wire messages are on the server for a few weeks, long enough to relay those messages to transiently offline devices. Telegram is great at what it does, different use case from Wire.

I'm actually fine with the wire approach.

But it would be nice if the sender could be notified that the message was never delivered.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#22

Post by blorange »

The most interesting section for me was "Exposed User Data". My takeaway is that an attacker can know whether my phone number is registered with Signal and can receive voice and video calls. They also get my encrypted name and profile picture but would need my explicit consent for that.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#23

Post by gnud »

jillesvangurp wrote: post #18

The practical consequence of this is that your phone number + name is public information. Almost as if it were listed in a phone book. That was pretty much the case already so it's not really a new threat. Of course people with unlisted numbers will be a bit annoyed by this. Likewise, your email address probably is part of numerous databases, including those owned by spammers/scammers. I'm not saying this is good. Bu…

My name/number is already pretty much public information, you can find it in various public registries if you search.

But who I have in my contact list is _not_ public information. You can infer a lot from that.

And the idiots who create these social apps always assume you want to "connect" with whoever is in your contact list.

Even if you added their number so you know to _not_ pick up when they call.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#24

Post by qwertox »

walterbell wrote: post #2

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

Threema also does not require your phone number.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#25

Post by elric »

jillesvangurp wrote: post #18

The practical consequence of this is that your phone number + name is public information. Almost as if it were listed in a phone book. That was pretty much the case already so it's not really a new threat. Of course people with unlisted numbers will be a bit annoyed by this. Likewise, your email address probably is part of numerous databases, including those owned by spammers/scammers. I'm not saying this is good. Bu…

Yeah ... no. I'm not sure what exactly gets shared with these apps, whether it's just the numbers or also the rest of the contact information. If names are being shared, that's a seriously fucked up nono. These parties are getting insights into our lives that are way beyond what is reasonable. Imagine I have 555-12345 in my contact list as "Wife" and someone else has the same number as "Girlfriend".

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#26

Post by strogonoff »

hansel_der wrote: post #17
Jonnax wrote: post #12

There needs to be two lists of contacts. One which I allow to be shared with apps And another which are my contacts I use with my dialer. People don't need their messenger apps knowing the phone number of their doctor

on ios if one does not grant addressbook permission for the app: * telegram uses an "internal" contact list for which one can add contacts via the desktop client and then works as expected. * whatsapp let's the user freely initiate contact by phone numbers, but then only shows the number (no name). don't know about signal.

WhatsApp on iOS cripples user experience without access to OS contact list. You cannot create groups, and cannot initiate a chat with anyone, even by phone number. It works if someone else messages you first or adds you to a group.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#27

Post by captainmuon »

I think the information who is a contact of whom should not reside with the provider, but be distributed among the peers.

I had a proof of concept of something similar working a couple years ago. I was writing a file-sharing app, and the goal was to piggy-pack on the existing social graph that you had from Facebook, Skype and so on. I could not register as a proper Facebook app, since that required having a domain, and I would be legally catchable in case somebody used my app to share copyrighted or illegal stuff.

Back then, Facebook messenger was based on XMPP/Jabber, which allows sending custom stanzas (secret messages that are not shown to the user). My app would ask for your login, then send a message to every contact, and if it got a reply from another instance, it would perform a handshake and exchange keys. This also worked over (old) Skype, which although it didn't support XMPP, you could do something similar with SkypeAPI. (Unfortunately, a few months later almost every messaging service that allowed such a trick stopped it...)

Now, this trick doesn't help if you are trying to set up a new social graph in the first place. But I think with this "send an invisible message to a potential contact's app" primitive, you could build a list of mutuals securely. (Other caveats apply, you'd let somebody know that you have their number for example...)

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#28

Post by walrus01 »

Daniel_sk wrote: post #11
random5634 wrote: post #3

100% of signal scrapped - ugh

They have been too busy with integrating crypto payments instead of fixing long standing issues or planned features (allow to register without a phone number). But - to Signal's defense - while you can scrape the phone numbers, there is not much you can gain from it, you can only tell that a specific number is a Signal user. And sometimes you can see the username (if the user chooses to not encrypt it).

Given the re-use and re-issuance of phone numbers in very busy US area codes (like 212, 202, etc) it also only allows discovery that at some unknown point in the past, that number has been registered as a Signal user.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#29

Post by hiq »

blorange wrote: post #22

The most interesting section for me was "Exposed User Data". My takeaway is that an attacker can know whether my phone number is registered with Signal and can receive voice and video calls. They also get my encrypted name and profile picture but would need my explicit consent for that.

That's my take as well, and I think that's already known by most users. So nothing new for Signal users.

For WhatsApp it would be nice to change the defaults so that no information (other than the fact that the number is registered) is shared with no interaction.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#30

Post by walterbell »

zibzab wrote: post #21
walterbell wrote: post #5

Earlier quoted context omitted.

For those who want end-to-end encrypted messages, it's a feature that the server doesn't have a persistent archive of message history. Wire messages are on the server for a few weeks, long enough to relay those messages to transiently offline devices. Telegram is great at what it does, different use case from Wire.

I'm actually fine with the wire approach. But it would be nice if the sender could be notified that the message was never delivered.

Each Wire message has a user-visible status: Failed, Sent or Delivered.

It's not obvious, but if status never changes from "Sent", then it wasn't "Delivered".

Post reply on HN