Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Telegram bug that disclose phone numbers of any users in public groups

docs.google.com

Post reply on HN
Print view View original

31–40 of 63 posts

Re: A Telegram bug that disclose phone numbers of any users in public groups

#31

Post by darkhorn »

22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

The problem could be solved like this; you generate an UUID and your friend generates UUID. Then you both exchange the UUID. You should do it within an hour. When both UUIDs are entered into the opposite parties you become friends. Now your friend knows you as G435-… and your wife knows you as B64J-…. No one can add you as friend with these used UUIDs. This will solve the privacy problem, mostly.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#32

Post by rargulati »

22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

Signal has spoken [1] at length about the issues of private contact discovery, and the many [2] solutions they've employed to minimize the amount of information that gets leaked. There's this intractable problem of requiring a social graph for easy discovery and for trust, and Signal's found one of the better solutions (though I'm sure we'll discover better ones yet).

[1] https://signal.org/blog/private-contact-discovery/ [2] https://signal.org/blog/contact-discovery/

Re: A Telegram bug that disclose phone numbers of any users in public groups

#33

Post by aasasd »

marcinzm wrote: post #13
hmnom wrote: post #3

It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.

>If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical. If you're a state actor probably pretty easy. Get a couple thousand rooted remote controllable android devices (which you probably already have for other projects) and have them automatically add 10k phones numbers each.…

I don't think you need a single device. Just bots with virtual numbers.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#34

Post by rolltiide »

ufmace wrote: post #27
mahemm wrote: post #25

The widespread usage of Telegram in a situation as sensitive as the Hong Kong protests is a failure on behalf of the security industry in educating the public. Even WhatsApp is miles better, but in reality it should be a no-brainer for the relevant people to use Signal or perhaps Threema/Wire. What a shame that charlatans have successfully marketed themselves to the top of this segment with a distinctly inferior prod…

I don't think Signal supports very large groups well (hundreds of users or more). Or things like announcement channels where tens of thousands can subscribe, but only a handful of accounts can post. Sounds to me like they have a superior product.

> Sounds to me like they have a superior product.

Groups in Telegram are not encrypted. And now its shown that it also reveals phone numbers, and this is not a feature.

Whatsapp shows phone numbers by default, so it wouldn't be a criticism of whatsapp.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#35

Post by couchand »

dooglius wrote: post #22
exocron wrote: post #20

Earlier quoted context omitted.

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof). I agree that there are some contacts that I would rather not know that I was on Signal, but, unfortunately, this is an impossible problem to solve when the goal is to create an end-to-end e…

>this is an impossible problem to solve when the goal is to create an end-to-end encrypted messaging platform where your identifier is your phone number Right, the use of phone number as identifier is flawed by design, and not secure

A big part of practical security is usability. It's hard enough getting most people to adopt Signal or other encrypted messaging services. If they couldn't "just send a message to a number" it would be that much more difficult. The tradeoff seems worth it in this case.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#36

Post by couchand »

darkhorn wrote: post #31
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

The problem could be solved like this; you generate an UUID and your friend generates UUID. Then you both exchange the UUID. You should do it within an hour. When both UUIDs are entered into the opposite parties you become friends. Now your friend knows you as G435-… and your wife knows you as B64J-…. No one can add you as friend with these used UUIDs. This will solve the privacy problem, mostly.

At the expense of being practically unusable for most people. It's a trade off.

EDIT: This proposal also suffers from a bootstrapping problem. You have to already have a secure channel to communicate the ids.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#37

Post by RichardHeart »

1 point by RichardHeart 44 minutes ago | parent | edit | delete [-] | on: Telegram 0-day vulnerability that can be used to d...

"TELEGRAM'S REPLY ZDNet has reached out to Telegram for comment earlier today, and the company has looked into the issue reported by Hong Kong protesters. "We have safeguards in place to prevent importing too many contacts - exactly to prevent the scenario," a Telegram spokesperson said.

"In fact, our data shows that the bot displayed on the screenshots got banned from further imports after two seconds - and only managed to successfully import 85 contacts (not 10,000)," it said. "Once you get banned from importing contacts, you can only add up to 5 new numbers per day. The rest of the contacts you add will look like they're not using Telegram - even if they are."

However, this ban limit can be bypassed. A determined threat actor like the Chinese state can easily employ multiple bots to exploit this issue, instead of just one, and they'll eventually import the entire phone number sequence they want to cover."

Re: A Telegram bug that disclose phone numbers of any users in public groups

#38

Post by NateEag »

sha666sum wrote: post #17
NateEag wrote: post #15

Earlier quoted context omitted.

s/FCC/human nature/

I live in $civilized_country and have gotten one unsolicited phone call ever. It was from an Indian, so either it was a scam or someone who doesn't adhere to telemarketing blocklists. Do not blame USA's inadequacies on human nature.

If it were not for human nature, no intervention to prevent scammers and telemarketers would be necessary.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#39

Post by rolltiide »

22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

> I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal

I specifically did not let Signal access my contacts, but some of my contacts contact me on Signal.

Those people that did upload those contacts and being notified that I'm on Signal.

I don't like it.

Its moderately creepy when Google or Facebook do it, but when a service that is advertising itself as the antithesis to those and being privacy conscious I am really disappointed.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#40

Post by ubercow13 »

couchand wrote: post #35
dooglius wrote: post #22

Earlier quoted context omitted.

>this is an impossible problem to solve when the goal is to create an end-to-end encrypted messaging platform where your identifier is your phone number Right, the use of phone number as identifier is flawed by design, and not secure

A big part of practical security is usability. It's hard enough getting most people to adopt Signal or other encrypted messaging services. If they couldn't "just send a message to a number" it would be that much more difficult. The tradeoff seems worth it in this case.

People seem fine adding each other on Facebook without using a phone number. When I add people on LINE messenger I use their ID not their phone number. When I meet a new person and exchange some contact details, it is rarely a phone number. I would also like to talk to some people who I do not want to know my phone number. I think this tradeoff was a mistake for Signal.
Post reply on HN