Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

0-click deanonymization attack targeting Signal, Discord, other platforms

gist.github.com

Post reply on HN
Print view View original

421–430 of 474 posts

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#421

Post by dns_snek »

lolinder wrote: post #314
bigiain wrote: post #312

Earlier quoted context omitted.

> If your threat model includes an attack like this The problem is, nobody's threat model includes state level attackers, until one day it does. Back when Ulbricht was publicly asking questions using an easily uncovered identity, he wasn't thinking that in a few years he'd have the full force of every relevant TLA in the US (and Five Eyes/14 Eyes) trying to track him down.

But he also chose to go on and found a darknet narcotics service. Most people don't do something like that. Yes, it's vogue right now to speculate that what you're doing right now could suddenly become illegal in a new administration, but if that happens tomorrow, most of us would be one of hundreds of thousands who are all in the same boat. For that reason, most of us won't get targeted retroactively for behaviors t…

> but if that happens tomorrow, most of us would be one of hundreds of thousands who are all in the same boat. For that reason, most of us won't get targeted retroactively for behaviors that were legal at the time

I'm sure that would be part of any oppressive government's plan. They wouldn't go after people for their past "transgressions" as long as they keep their heads down, do as they're told, and don't cause any trouble. At that point you're morally compromised.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#422

Post by upofadown »

mmooss wrote: post #256
crawfordcomeaux wrote: post #149

Earlier quoted context omitted.

Hello, I'm an organizer for a system to coordinate multiple mutual aid networks, many of which are only organizing by Signal & Protonmail exclusively because they think they're secure and private. People who are doing work to help people in ways the state tries to prevent (like giving people food) rely on this tech. These are the same groups who were able to mobilize so quickly to respond to the LA fires, but the Red…

Someone should tell anyone who seeks confidentiality that no email is secure. Use Signal and enable the data retention (i.e., automatic message deletion) feature. By itself that is not perfectly secure, but it's a start.

The people involved are likely all using Protonmail. So that would mean TLS for the connection to Protonmail with E2EE for messages passing through Protonmail.

Not sure that encrypted email in general would be less secure than, say, Signal. Since Signal is an instant messenger on a phone it might actually be less secure[1].

[1] https://articles.59.ca/doku.php?id=em:emailvsim

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#424

Post by upofadown »

aja12 wrote: post #342

I'm a bit at a loss there. Has _anyone_ ever considered Signal to be anonymous? Or Discord? If so, I have bad news: they are not anonymous. At all. Not even slightly anonymous. Nor did they ever claim to be, they only claim to not be able to read your messages (Signal claims that, I don't know about Discord, I doubt it). And that claim has flaws (sure the crypto is sound but have you thoroughly reviewed and compiled…

I am currently banned from the Signal subreddit for pointing out that we only have Signal's word that they don't collect metadata. So, yeah, people do consider Signal anonymous...

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#425

Post by tjoff »

internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

Why does it need to be cached though?

The only case where it might be downloaded more than once is if the user has multiple clients. Not that common and still very little traffic.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#426

Post by shim__ »

lolinder wrote: post #47
diggan wrote: post #40

Earlier quoted context omitted.

Last time I used Cloudflare I think their settings default to only "Origin SSL/TLS" (or whatever they call it), which wouldn't encrypt anything between Cloudflare and the origin, it would only encrypt data between Cloudflare and the end-user/browser.

But the Signal client encrypts images before sending them to the Signal server. If it padded out the images at that point, the images would all be indistinguishable from each other unless Cloudflare were actually able to break the encryption (which would completely undermine the entire security model).

So the image is uploaded for each recipient with an individual key?

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#427

Post by rkagerer »

internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

[dupe]

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#428

Post by rkagerer »

internet_points wrote: post #2

So if you send a picture to a Signal user, it's retrieved via cloudflare, and cached in a data center near that user; now you can look up the cache status and find the data center used. I'd say "deanonymization" is stretching it, unless the user is in the middle of nowhere (no other users near the data center). But interesting writeup anyway.

Caching attachments at a single nice, big, juicy honeypot like CloudFlare is one of the reasons Signal's privacy guarantees don't feel totally solid to me. I get that it's pragmatic, but feel there must be a better way.

Does the caching occur even if both users are online when the attachment is sent?

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#429

Post by scottydelta »

quotemstr wrote: post #299
scottydelta wrote: post #294

How is it different than sending someone an image hosted on your server which is a tracking pixel and just get their IP+location? This will be more accurate than the cloudflare approach.

You can't instruct a random Signal client to fetch a random URL. Here's how this attack works: 1. Attacker sends novel image to Signal 2. Signal hosts the image on their core servers 3. Signal instructs victim to fetch preview of the image 4. Victim asks the CDN for the image 5. CDN gets the image from Signal core servers and caches it 6. Victim gets the image from the CDN and displays the preview normally 7. Attacke…

Can't you already see the IP of the datacenter that requested the image from your server/pixel and map it to the data center+location?

This is assuming the data center is directly requesting the source server which it might be given a few searches on Google [1].

[1] https://community.cloudflare.com/t/cloudflare-is-forwarding-...

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#430

Post by shakna »

miyuru wrote: post #393
shakna wrote: post #346

Earlier quoted context omitted.

Cloudflare does serve me from France. When I'm in Australia. (My ISP bought some IP addresses that were original regional France, back in the early 90s.) So though this does have implications, the assumptions they utilise, like always, are not universal.

> My ISP bought some IP addresses that were original regional France CLoudflare uses anycast, and IP geo location is not how anycast works.

That may be true. But you still need to explain why Cloudflare serves me from France, and not Sydney, in that case.
Post reply on HN