Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Telegram bug that disclose phone numbers of any users in public groups

docs.google.com

Post reply on HN
Print view View original

41–50 of 63 posts

Re: A Telegram bug that disclose phone numbers of any users in public groups

#41

Post by ubercow13 »

couchand wrote: post #36
darkhorn wrote: post #31

Earlier quoted context omitted.

The problem could be solved like this; you generate an UUID and your friend generates UUID. Then you both exchange the UUID. You should do it within an hour. When both UUIDs are entered into the opposite parties you become friends. Now your friend knows you as G435-… and your wife knows you as B64J-…. No one can add you as friend with these used UUIDs. This will solve the privacy problem, mostly.

At the expense of being practically unusable for most people. It's a trade off. EDIT: This proposal also suffers from a bootstrapping problem. You have to already have a secure channel to communicate the ids.

You have to have a secure channel to exchange phone numbers too. The code could be communicated simply using a QR code. Other messengers already work this way and it works well.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#42

Post by samat »

Telegram says they block massive contacts imports, says that particular bot was able to add only 85 contacts and then throttled to 5 new contacts per day.

My questions is how do they distinguish legitimate imports? I have 2K phone numbers in my address book. Would it take a year for me to be able to message my friends on telegram?

Re: A Telegram bug that disclose phone numbers of any users in public groups

#43

Post by couchand »

ubercow13 wrote: post #41
couchand wrote: post #36

Earlier quoted context omitted.

At the expense of being practically unusable for most people. It's a trade off. EDIT: This proposal also suffers from a bootstrapping problem. You have to already have a secure channel to communicate the ids.

You have to have a secure channel to exchange phone numbers too. The code could be communicated simply using a QR code. Other messengers already work this way and it works well.

Yes, the difference being that a phone number is an established identity mechanism and you likely already know it.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#44

Post by couchand »

ubercow13 wrote: post #40
couchand wrote: post #35

Earlier quoted context omitted.

A big part of practical security is usability. It's hard enough getting most people to adopt Signal or other encrypted messaging services. If they couldn't "just send a message to a number" it would be that much more difficult. The tradeoff seems worth it in this case.

People seem fine adding each other on Facebook without using a phone number. When I add people on LINE messenger I use their ID not their phone number. When I meet a new person and exchange some contact details, it is rarely a phone number. I would also like to talk to some people who I do not want to know my phone number. I think this tradeoff was a mistake for Signal.

You are clearly not the target audience for Signal. There of course is a space for the type of app you're describing, but saying that the tradeoff that Signal has chosen was a mistake is to misunderstand the goal there.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#45

Post by ajconway »

tapoxi wrote: post #14
interfixus wrote: post #11

Earlier quoted context omitted.

We are not really supposed to talk ill of the holy Signal here on HN, and we usually get severely trounced if we do. But of course you are absolutely right - this has been one gaping hole in Signal privacy since forever. Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardw…

> Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardware habits. This is a security feature to ensure you're talking to the same person. Phone numbers are terrifyingly easy to port to another account.

This feature leaks metadata. It's just an implementation detail, I'm sure the devs are not happy about it and probably are researching other ways to provide cross-device experience.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#46

Post by ajconway »

mahemm wrote: post #25

The widespread usage of Telegram in a situation as sensitive as the Hong Kong protests is a failure on behalf of the security industry in educating the public. Even WhatsApp is miles better, but in reality it should be a no-brainer for the relevant people to use Signal or perhaps Threema/Wire. What a shame that charlatans have successfully marketed themselves to the top of this segment with a distinctly inferior prod…

WhatsApp does secure group messages with end to end encryption, but what good is encryption in a public protests group where everyone can see your phone number?

Re: A Telegram bug that disclose phone numbers of any users in public groups

#47

Post by segmondy »

exocron wrote: post #20
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof). I agree that there are some contacts that I would rather not know that I was on Signal, but, unfortunately, this is an impossible problem to solve when the goal is to create an end-to-end e…

This is like saying you want people to know you use PGP or encryption implying that those who use such tech have something to hide. I see no problem in anyone knowing that I use Signal. If anything it communicates that I'm serious about privacy and security.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#48

Post by perl4ever »

sha666sum wrote: post #17
NateEag wrote: post #15

Earlier quoted context omitted.

s/FCC/human nature/

I live in $civilized_country and have gotten one unsolicited phone call ever. It was from an Indian, so either it was a scam or someone who doesn't adhere to telemarketing blocklists. Do not blame USA's inadequacies on human nature.

People in the US don't get uniform amounts of spam calls, so I'm doubtful that your experience can be taken as representative of your entire country.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#49

Post by dirkt »

rargulati wrote: post #32
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

Signal has spoken [1] at length about the issues of private contact discovery, and the many [2] solutions they've employed to minimize the amount of information that gets leaked. There's this intractable problem of requiring a social graph for easy discovery and for trust, and Signal's found one of the better solutions (though I'm sure we'll discover better ones yet). [1] https://signal.org/blog/private-contact-disco…

Both your links deal with leaking information to the carrier (signal).

But the issue in the parent post is about leaking information to the people you have in your contact list.

These are very different issues. And it looks like signal hasn't considered the second aspect and the implications.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#50

Post by newscracker »

tapoxi wrote: post #14
interfixus wrote: post #11

Earlier quoted context omitted.

We are not really supposed to talk ill of the holy Signal here on HN, and we usually get severely trounced if we do. But of course you are absolutely right - this has been one gaping hole in Signal privacy since forever. Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardw…

> Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardware habits. This is a security feature to ensure you're talking to the same person. Phone numbers are terrifyingly easy to port to another account.

It stops being a security feature when Signal keeps sending such messages when nothing has changed (and because Signal has bugs), prompting users to ignore these messages forever.
Post reply on HN