291–300 of 474 posts
Earlier quoted context omitted.
You can disable the auto-download. Settings > Data and storage > Media auto-download, you can choose what to auto download for mobile data/wifi/roaming.
hmm. I find the auto-download setting in the mobile app but not on desktop (mac). anyone know?
Earlier quoted context omitted.
Not really. It's only true if the bits are uncorrelated, and you can acquire additional bits of information. I don't see how you can go from "this guy on the internet lives near Albuquerque, New Mexico" to "this guy is Walter Hartwell White, and lives at 308 Negra Arroyo Lane, Albuquerque, New Mexico, 87104" without massive opsec failures.
If you want to extend the analogy, Gus Fring's threat model for RFP contractors at the superlab required flying people into the United States and driving them for days before reaching the final destination. i.e. If you aren't selected for the final proposal, the most you should know is the lab is "somewhere reachable by driving from the United States". Locating the superlab to within 800 miles would break Gus' threat…
Earlier quoted context omitted.
This is all the classic dismissals of security issues, including blaming the user. > opsec failure for the Signal user Signal's mission is to provide security for users who don't know the word 'opsec'.
Blaming the user is sometimes what it boils down to. Security includes a balancing act that involves usability, and Signal is firstly targeting the masses, but includes settings that can be configured for high-risk scenarios. This "vulnerability" requires the user to have none of the normal things a person with a more extreme threat model would have already configured. EZPZ guides online on locking down Signal. It's…
At least we agree about your argument. :)
> Signal at minimum will ensure no one is snooping on your messages, and it's up to the user whether they want to take that further.
Signal also secures metadata, including the participants in the conversation. That is undeniable - they have gone through considerable development investment to provide that feature.
> that user's ISP has performed terribly
Now we're blaming the ISP. If your app doesn't work with your users and ISPs, who does it work for? And how does a non-technical end-user know whether or when to trust you?
This will be more accurate than the cloudflare approach.
Earlier quoted context omitted.
Combined with other information, it may identify someone reliably, just like you can with zip code, age and gender. For example, if you know this person is part of a group with members in several locations, or if you can corroborate someone's movements, etc. For example, imagine someone suspected of sharing sensitive information with a journalist. They might have a short list of suspects, and use this technique to co…
Or you want to find a specific journalist, and you find out that they just arrived to a certain city, and there are only three hotels in that city...
The accuracy of this geolocalization depends very much on peering agreements. I don't know about the UD bit this will not be very accurate within the EU. As an example: In Hungary, there's pretty much only one peering hub (bix) and there's only one Cloudflare datacenter. You've already geolocated me better than this hack just by knowing my language or phone prefix.
It's not because you have a Hungarian number that you're not travelling somewhere else. I don't really understand the point.
In my case, Cloudflare will identify me as BUD even when i'm roaming at a different country.
This behavior is very typical for the EU, because the telco landscape is fairly fragmented, and each company typically have only one, or at most 2 peering locations.
This may be different within the US where the distances are bigger, and latencies matter more, so there is more incentive to peer locally.
Earlier quoted context omitted.
I doubt how useful it would be as an attack. As a single point of info it tells you next to nothing. As part of a composition of other indicators it would be the weak link in the chain probably just causing noise for the not un-likly scenario where the person you're targeting is using a VPN. If it was any less specific we'd be talking about a deanonymization attack that outs whether or not a target is still on Earth.
> not un-likly scenario where the person you're targeting is using a VPN Do you think a large proportion of Signal users also use VPNs? I'd expect it would be a higher proportion than the general population but still only a small minority.
It is feasible to consider that interesting Signal users mostly use VPN as an extra protection layer.
How is it different than sending someone an image hosted on your server which is a tracking pixel and just get their IP+location? This will be more accurate than the cloudflare approach.
1. Attacker sends novel image to Signal
2. Signal hosts the image on their core servers
3. Signal instructs victim to fetch preview of the image
4. Victim asks the CDN for the image
5. CDN gets the image from Signal core servers and caches it
6. Victim gets the image from the CDN and displays the preview normally
7. Attacker hits every one of the CDN cache servers
8. The CDN cache server that say "yep, saw that already" is the one closest to the victim
So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.