Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-click deanonymization attack targeting Signal, Discord, other platforms

gist.github.com

Post reply on HN
Print view View original

331–340 of 474 posts

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#331

Post by iforgot22 »

coffeeboy27 wrote: post #260
punnerud wrote: post #250

Is he just 15? The level of technical details, and this part is not that simple: “quickly patched the Signal desktop app to remove SSL pinning and configured Burp to intercept and view HTTP requests/responses sent through the app”

You’d be surprised at how adept the younger generation can be, especially those who’ve grown up with technology. As tech evolves, so do they. There are kids who genuinely apply themselves, and because they’ve been immersed in this environment, it’s practically second nature to them. I remember the late 1990s: I was young, but more than anything, I was curious about how things worked, I had the luxury of time, and acc…

There are also a lot more kids doing this than before. Like, I was one of 12(?) students in our high school AP Comp Sci course, then just one year after, 120 students took the same course.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#334

Post by bigiain »

lolinder wrote: post #314
bigiain wrote: post #312

Earlier quoted context omitted.

> If your threat model includes an attack like this The problem is, nobody's threat model includes state level attackers, until one day it does. Back when Ulbricht was publicly asking questions using an easily uncovered identity, he wasn't thinking that in a few years he'd have the full force of every relevant TLA in the US (and Five Eyes/14 Eyes) trying to track him down.

But he also chose to go on and found a darknet narcotics service. Most people don't do something like that. Yes, it's vogue right now to speculate that what you're doing right now could suddenly become illegal in a new administration, but if that happens tomorrow, most of us would be one of hundreds of thousands who are all in the same boat. For that reason, most of us won't get targeted retroactively for behaviors t…

> Yes, it's vogue right now to speculate that what you're doing right now could suddenly become illegal in a new administration, but if that happens tomorrow, most of us would be one of hundreds of thousands who are all in the same boat

I'm probably more paranoid than needed, but I'm way less sure than you seem to be about being able to hide as one of a few hundred thousand needles in the US public haystack.

I, for one, would be terrified right now if I were the child of illegal immigrants. The hateful portion of the hard right are gleefully looking forward to ICE rounding up hundreds of thousands of people.

You should probably be concerned if you were publicly pro-choice a few years back. Or if you came out as trans. Or got gay married. Or any of probably hundreds of other things that most people would have thought perfectly safe and socially reasonable in the recent past, which are looking much less so today.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#335

Post by tom1337 »

aimazon wrote: post #171
maxrmk wrote: post #146

Cool! Contrary to some of the other posters I think this definitely counts as deanonymization, or at least is close enough. How anonymous would satoshi be today if we had his location to within 250 miles? Repeated applications of this attack (maybe disguised somehow?) could let you track someone’s travel over time, and it is usually only takes 4-5 zip code sized locations to uniquely identify someone.

The counter point is that anyone who cares about being anonymous is using methods to disguise their identity that cannot be compromised by this attack, e.g: a VPN. Plus, there are much more effective versions of this attack, like sending a link to an endpoint that you control -- getting someone to click a link isn't hard if you're considered trustworthy enough to send them notifications. And less technical versions,…

> The counter point is that anyone who cares about being anonymous is using methods to disguise their identity that cannot be compromised by this attack, e.g: a VPN.

Yes unless Apple is doing Apple things and ignores VPNs for things like push notifications…

https://x.com/mysk_co/status/1579997801047822336

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#336

Post by tom1337 »

mqus wrote: post #323
alp1n3_eth wrote: post #284

Earlier quoted context omitted.

Signal's default setup is more usability focused while supporting E2E, and less about tinfoil hat threat models about being present on a continent you're a citizen of. The items you mentioned can essentially be configured, for those that want the insane level of privacy / security. Messages can be auto-deleted 30 seconds after being seen, a proxy can be configured to route all your traffic through it, and tons of oth…

> Signal's default setup is more usability focused while supporting E2E If images/attachments were e2ee, this problem probably wouldn't exist, right? or are the images on cloudflare encrypted? Edit: I should clarify. I didn't mean the encryption itself fixes the problem, but rather that: If this were handled like the text messages we send (not via cloudflare CDNs) then this wouldn't exist. I get that attachments are…

I actually also wondered about this because if Signal does not encrypt attachments and delivers them via CloudFlare and that would suck as CloudFlare could just look into all them.

It seems that signal is indeed encrypting all attachments and therefore the encrypted attachments are cached and served via CloudFlare.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#337

Post by iforgot22 »

byearthithatius wrote: post #223
lxe wrote: post #204

Not sure why so many top comments dismiss the severity of this. This is just exactly the type of attack that give law enforcement or a malicious actor a way to establish proof of whereabouts.

I would guess some are just jealous of his age, but some do find the claim of de anonymizing to simply be overblown given it doesn't tell you nearly enough to find anyone except in very niche cases. This "attack" is easily defeated with a VPN or living in any major city.

Someone on GitHub called him out for making a Twitter account in 2017, since he'd have to be 8 years old at the time... I don't see what's so unbelievable about an 8yo making a Twitter account.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#338

Post by iforgot22 »

sojournerc wrote: post #330
hmottestad wrote: post #145

Earlier quoted context omitted.

If I know someone on Signal I can now check if they’ve left the country. Or send this to a bunch of signal users whom you suspect one of them being a particular person, and if you know that the person you are looking for is going to travel you can send it once before and once after. Then see which of these users were in the home city and subsequently in the destination city.

A VPN obfuscates this. Assuming a target is even remotely aware, you might think they are in Australia, while they're actually in Nova Scotia

Say I send a message to someone who has a phone with push notifications enabled, showing message previews. Will the phone still be connected to the VPN when it wakes up to display the message? Because my iPhone doesn't seem to stay connected to my VPN when it sleeps, at least not reliably.

There really should be a "never use the internet without VPN" mode on devices.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#339

Post by sojournerc »

iforgot22 wrote: post #338
sojournerc wrote: post #330

Earlier quoted context omitted.

A VPN obfuscates this. Assuming a target is even remotely aware, you might think they are in Australia, while they're actually in Nova Scotia

Say I send a message to someone who has a phone with push notifications enabled, showing message previews. Will the phone still be connected to the VPN when it wakes up to display the message? Because my iPhone doesn't seem to stay connected to my VPN when it sleeps, at least not reliably. There really should be a "never use the internet without VPN" mode on devices.

Valid point. Afaict, vpns I've used route all network activity regardless of phone state, but that's likely dependant on the service.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#340

Post by andix »

ziddoap wrote: post #43
open-sesame wrote: post #19

Unless I'm missing something, this seems like an incredibly long winded way to check the users IP location? For example, connecting to a VPN and checking https://cloudflare.com/cdn-cgi/trace gives me `colo:CPH` (Copenhagen) which is far from my nearest CF datacenter (geographically), closer to the IP location from my VPN provider (Oslo) but still not particularly close? If I don't use a VPN, I don't even get the capi…

> just not convinced on the real world applications here... As a piece of data alone, the results are probably not of significant use. The real-world application (and potential danger) is when this data is combined with other data. De-anonymization techniques using sparse datasets has been an active area of research for at least 15 years and it is often surprising to people how much can be gleaned from a few pieces o…

> The real-world application (and potential danger) is when this data is combined with other data.

That's exactly the point. In this case it's only really possible to de-anonymize people who take long distance trips. But based on two data points it might be possible to know which flight or train a person travelled with.

With three different data points it might be quite unique. For example you might find out somebody travelled from Italy to Norway on Monday evening and then to France on Wednesday morning. There are probably not so many people who did a trip like that, it might come down to only one (or a handful) people who fits this itinerary. With other data sources it might be possible to uniquely identify this person.

Post reply on HN