0-click deanonymization attack targeting Signal, Discord, other platforms • Hacker News Board

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#471

Post by genewitch » Sat, Jan 25, 2025, 5:45 PM UTC

bigiain wrote: post #319

genewitch wrote: post #214

Earlier quoted context omitted.

I don't care if users see "my" ipv4 because cgnat. I think i don't care if they can see my ipv6 because each machine gets a /64 to itself, that's the logic, right? But my PBX and my matrix server both use coturn. Our 10 user "private" PBX we have to VPN into a fortigate in a DC to use, but to my understanding, there's literally no way to eavesdrop on those calls without already compromising the server it's running on…

> I think i don't care if they can see my ipv6 because each machine gets a /64 to itself, that's the logic, right? I suspect you're looking at that wrong. It's each internet connection that gets a /64, not each machine. Your ISP hands you a /64 and you can do whatever you like with it on your home(/corporate) network. So you can choose from 18 thousand trillion IPV6 addresses for any machine behind your ISP/internet…

> It's each internet connection that gets a /64,

i get a /48, which i can delegate the prefix to 255 subnets of size /64, so each machine on my LAN gets a /64 this is Prefix Delegation, part of DHCP v6 aka DHCP-PD

edit: this is still "new" in that half the consumer routers only partially support it. but afaik it was in the spec for ipv6 that each node should be a /64, so realistically my LAN having each node with /64 is per spec, and machines that are NAT behind a single /64 at the gateway are out of spec and part of the reason that no one uses ipv6, IMO...

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#472

Post by bigiain » Sat, Jan 25, 2025, 11:51 PM UTC

genewitch wrote: post #471

bigiain wrote: post #319

Earlier quoted context omitted.

> I think i don't care if they can see my ipv6 because each machine gets a /64 to itself, that's the logic, right? I suspect you're looking at that wrong. It's each internet connection that gets a /64, not each machine. Your ISP hands you a /64 and you can do whatever you like with it on your home(/corporate) network. So you can choose from 18 thousand trillion IPV6 addresses for any machine behind your ISP/internet…

> It's each internet connection that gets a /64, i get a /48, which i can delegate the prefix to 255 subnets of size /64, so each machine on my LAN gets a /64 this is Prefix Delegation, part of DHCP v6 aka DHCP-PD edit: this is still "new" in that half the consumer routers only partially support it. but afaik it was in the spec for ipv6 that each node should be a /64, so realistically my LAN having each node with /64…

That still means your /48 identifies you with much higher precision than a cgnat-ed ipv4 address ever could.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#473

Post by genewitch » Sun, Jan 26, 2025, 10:14 PM UTC

bigiain wrote: post #472

genewitch wrote: post #471

Earlier quoted context omitted.

> It's each internet connection that gets a /64, i get a /48, which i can delegate the prefix to 255 subnets of size /64, so each machine on my LAN gets a /64 this is Prefix Delegation, part of DHCP v6 aka DHCP-PD edit: this is still "new" in that half the consumer routers only partially support it. but afaik it was in the spec for ipv6 that each node should be a /64, so realistically my LAN having each node with /64…

That still means your /48 identifies you with much higher precision than a cgnat-ed ipv4 address ever could.

this isn't some gotcha directed at you; but isn't that true if i have a public ipv4 as well? also an adversary would have to know that i am actually using the entire /48, that the ISP does PD, etc which means a skid won't. a government will, but a government isn't gunna fiddle with ipv6 when they can just subpoena the DCs my data traverses and get the same info.

If i visit some site via v6 on my desktop today and in a month from my phone, at home via v6 over wifi, what percentage of companies will pool those two devices (assuming no pooling from merely being my device, etc). Either ipv6 is a nightmare or it's the utopia we were promised i will accept no compromises.

Re: 0-click deanonymization attack targeting Signal, Discord, other platforms

#474

Post by vdqtp3 » Tue, Feb 04, 2025, 6:24 PM UTC

mazambazz wrote: post #468

vdqtp3 wrote: post #440

Earlier quoted context omitted.

I had this same thought before reading the article - this isn't about link previews, it's about attachment caching

But previewing can involve automatically loading resources. This "attack" is very similar to CSRF in that your exploit involves making the victim load a specific resource. That's why in secure mail clients, nothing but plaintext should be rendered, and an optional "Load all resources" button is shown for when you trust the sender, and want to load any media elements that require HTTP onto your client. Signal could mi…

The difference being is that it's not a resource controlled by the attacker, it's an attachment hosted by Signal. But yes, removing previews for everything would mitigate the issue.