Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-click deanonymization attack targeting Signal, Discord, other platforms

gist.github.com

Post reply on HN
Print view View original

321–330 of 474 posts

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#321

Post by jrochkind1 »

aprilnya wrote: post #236
jrochkind1 wrote: post #209

Earlier quoted context omitted.

I dont' believe the Signal app/network is choosing to cacheimages in a CDN? But any user can send anyone other user a message that includes a link to a CDN-cached resource. Isn't that the "attack" here? Or am I misunderstanding?

Signal does cache them in a CDN. If the vulnerability was sending any link, you could just set up your own web server and get the person’s IP

Ah, and the attack is knowing what CDN that is that signal itself is using, and examining it directly? I had missed that somehow.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#322

Post by iforgot22 »

scottydelta wrote: post #294

How is it different than sending someone an image hosted on your server which is a tracking pixel and just get their IP+location? This will be more accurate than the cloudflare approach.

If your target is savvy enough not to click random links sent by strangers, it's hard to get them to load it. Many apps have caught onto the tracking pixel technique. It used to work for iMessage long ago.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#323

Post by mqus »

alp1n3_eth wrote: post #284
kelnos wrote: post #234

Why has Signal even enabled caching for those URLs? The most common case is going to be that the attachment is downloaded once, and that's it. I would even expect that Signal wouldn't allow you to download it more than once, and would immediately delete it after the first successful download. Well, ok, maybe the client fails mid-way through, so allow some grace period for a re-download. But I can't imagine that would…

Signal's default setup is more usability focused while supporting E2E, and less about tinfoil hat threat models about being present on a continent you're a citizen of. The items you mentioned can essentially be configured, for those that want the insane level of privacy / security. Messages can be auto-deleted 30 seconds after being seen, a proxy can be configured to route all your traffic through it, and tons of oth…

> Signal's default setup is more usability focused while supporting E2E

If images/attachments were e2ee, this problem probably wouldn't exist, right? or are the images on cloudflare encrypted?

Edit: I should clarify. I didn't mean the encryption itself fixes the problem, but rather that: If this were handled like the text messages we send (not via cloudflare CDNs) then this wouldn't exist. I get that attachments are quite some bytes bigger than text but shouldn't the security guarantees be the same?

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#324

Post by [deleted] »

j3s wrote: post #88
dare944 wrote: post #51

Earlier quoted context omitted.

"bit of a sensationalist" is reasonable feedback; no slack needed. After all, this is how they learn.

people learn when they’re given kind, direct, actionable feedback from people they trust - not when they’re called sensationalists by random critics on the internet. what have you made lately?

[deleted]

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#325

Post by endofreach »

cthalupa wrote: post #308
bufferoverflow wrote: post #303

Earlier quoted context omitted.

CloudFlare has the actual IP address that viewed the image. Which means some powerful (or rich enough) actors can get it. This is very very bad.

This was... always, the case though? For any CDN service? How do you serve traffic to people without knowing where to send it?

Agree. Though a valid concern might be that a victim uses signal because of E2EE, thinking no 3rd party involved in delivery, not knowing/thinking about a CDN used.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#326

Post by iforgot22 »

catlikesshrimp wrote: post #53
aimazon wrote: post #31

What's old is new. Does anyone remember the forum signatures that would display the viewers IP address and location on a little wooden signpost held up by a troll-looking creature? https://cdn.geekzone.co.nz/images/forums/danasoftcache.jpg

That was a troll feature. It usually showed any user his own information. MAYBE some forum doxxed users by posting their informatio? but I didn't see any.

Wikipedia still does if you aren't logged in

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#329

Post by sojournerc »

pyeri wrote: post #148
lxgr wrote: post #142

Earlier quoted context omitted.

It's not stretching it. The expectation is that Signal does not reveal any observable aspect of your IP address or location when receiving messages on it. Whether this specific level/type of deanonymization is a problem for your particular use case is an entirely different question. Personally, I wouldn't even care if mutual contacts were to see my IP address outright (and they do for calls), but I'm not every user.

Exactly. Especially when considering that Signal was often advertised as that *one* privacy friendly open-source messaging solution in a world dominated by data-collecting demons like WhatsApp, etc. I don't think even WhatsApp let's such status details leak; notwithstanding whatever they might be doing with the user data on the backend.

I can send a link in Whatsapp to a domain I control and track if clicked. How is that different?

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#330

Post by sojournerc »

hmottestad wrote: post #145
internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

If I know someone on Signal I can now check if they’ve left the country. Or send this to a bunch of signal users whom you suspect one of them being a particular person, and if you know that the person you are looking for is going to travel you can send it once before and once after. Then see which of these users were in the home city and subsequently in the destination city.

A VPN obfuscates this. Assuming a target is even remotely aware, you might think they are in Australia, while they're actually in Nova Scotia
Post reply on HN