Looks like Cloudflare are still sending out the airport locations and hit status on the response headers. Maybe I'm missing something but it seems like if you had a large VPN network you could run a distributed query to figure out which edge nodes have cached the url.
0-click deanonymization attack targeting Signal, Discord, other platforms
361–370 of 474 posts
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#362This is just the fundamental way the internet works, and is the reason that anonymizing proxies like Tor exist. If you don’t want people to be able to detect your rough geographic location, you should be using a proxy to hide it. For everybody else, knowing the edge server you are closest to is really not a threat.
[deleted]
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#363This is just the fundamental way the internet works, and is the reason that anonymizing proxies like Tor exist. If you don’t want people to be able to detect your rough geographic location, you should be using a proxy to hide it. For everybody else, knowing the edge server you are closest to is really not a threat.
There's a real difference between Discord itself knowing your location and any Discord user in the world knowing it. Just like there's a difference between the VPN provider knowing your ipaddr and every website you visit knowing it.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#364Earlier quoted context omitted.
Maybe not individual warrants (at least not warrants to do non-scalable collections like hardware bugs in one's phone - I.e. warrants that, most users, with high probability, are not subject to). But mass surveillance, e.g. NSA, even with 'mass warrants' (e.g. Verizon-FISA warrant), that everyone is subject to, is probably in most people's attacker model. I don't have a study handy, but it seems reasonable that most…
I highly doubt that signal does anything to help with mass surveillance. Signal started keeping people's name, photo, phone number, and contacts in the cloud protected by a "secure" enclave the NSA almost certainly has access to and hackers already got into ( https://community.signalusers.org/t/sgx-cacheout-sgaxe-attac... ) and even leaving all that aside, all anyone needs is a PIN that can be trivially brute forced.…
I thought it was digits only but see there's always been the option to use an alphanumeric passphrase as the "PIN". That prevents brute-forcing for anyone that bothered to use one, right?
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#365Earlier quoted context omitted.
> you would be surprised how quickly this adds up Yes, but if social engineering is involved and tracing back through user conversations across a platform, it's hardly a vulnerability, let alone one deserving of a bounty. The way this is currently functioning is intended functionality, and can be further locked down depending on the user's threat model. This can essentially be classified as opsec failure for the Sign…
If I can send you a link and be guaranteed that you click on it. Then that’s definitely a security issue.
Then it's a good thing that this isn't being claimed
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#366Not sure why so many top comments dismiss the severity of this. This is just exactly the type of attack that give law enforcement or a malicious actor a way to establish proof of whereabouts.
I would guess some are just jealous of his age, but some do find the claim of de anonymizing to simply be overblown given it doesn't tell you nearly enough to find anyone except in very niche cases. This "attack" is easily defeated with a VPN or living in any major city.
You don't need to live in a major city. Cloudflare is never going to set up a caching proxy for a hamlet in the desert; you'll always be part of a huge group that a given caching proxy serves. The attacker can be happy if they can narrow the recipient's location down as much as to a single country
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#367Looks like Cloudflare are still sending out the airport locations and hit status on the response headers. Maybe I'm missing something but it seems like if you had a large VPN network you could run a distributed query to figure out which edge nodes have cached the url.
That’s exactly what the author does towards the end.
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#368This is just the fundamental way the internet works, and is the reason that anonymizing proxies like Tor exist. If you don’t want people to be able to detect your rough geographic location, you should be using a proxy to hide it. For everybody else, knowing the edge server you are closest to is really not a threat.
People for whom it's a threat don't necessarily understand anonymizing proxies - very few do. Signal is supposed to provide security for those who do not.
Where does Signal claim that, or who decides what they're "supposed" to provide?
If wishes had wings, sheep would fly. People who want their computer to do a certain thing can also be expected to do a quick web search for how to make it do said thing. E.g.: hiding location? Use onion routing. Signal doesn't claim to hide your country (heck, they require your phone number!) so it seems wishful thinking to say they should have included e.g. a Tor client and enabled it by default
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#369What is the benefit of caching images in a cdn for Signal? Assuming local client-side caching, the total number of requests for that resource should be very small, probably one in the vast majority of cases. On an unrelated note, it seems like CloudFront could very easily fix this by not returning the cf-ray header, or at least having an option for the customer to remove it. Although, it might still be possible to ge…
> it seems like CloudFront could very easily fix this by not returning the cf-ray header
Then you just look at the response time. If the resource needs to be fetched from another continent, this is probably reliably measurable
Same for websites trying to hide which users exist: do a login request for an existing username and it'll do the password hashing (usually adds at least 50 ms to the response time), whereas for an invalid username it early exits. The fix is to always run the same code, so always do the hashing, which very few sites do. (Or not care about revealing this and telling people straight out that their username is unknown, if that fits with your threat model.) So to get back to Cloudflare's case: it won't help unless they delay responses, which is the opposite of what they're supposed to do
Re: 0-click deanonymization attack targeting Signal, Discord, other platforms
#370Earlier quoted context omitted.
If you aren't comfortable broadcasting it, then maybe take measures so that it doesn't get to that point. Privacy is not by default, ever
To quote Signal themselves: > Privacy isn’t an optional mode — it’s just the way that Signal works. Every message, every call, every time [1] While I don't consider this a critical bug requiring an immediate technical remediation from Signal, this should definitely be either fixed or called out in the documentation at some point. [1] https://support.signal.org/hc/en-us/articles/360007320391-Is...
The sentence before the one you quoted gives the essential context:
> Signal conversations are always end-to-end encrypted, which means that they can only be read or heard by your intended recipients.
They're not saying that it is an anonymisation proxy, they're saying the messages and calls are encrypted for the recipient rather than to the server