Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Telegram bug that disclose phone numbers of any users in public groups

docs.google.com

Post reply on HN
Print view View original

51–60 of 63 posts

Re: A Telegram bug that disclose phone numbers of any users in public groups

#51

Post by newscracker »

couchand wrote: post #35
dooglius wrote: post #22

Earlier quoted context omitted.

>this is an impossible problem to solve when the goal is to create an end-to-end encrypted messaging platform where your identifier is your phone number Right, the use of phone number as identifier is flawed by design, and not secure

A big part of practical security is usability. It's hard enough getting most people to adopt Signal or other encrypted messaging services. If they couldn't "just send a message to a number" it would be that much more difficult. The tradeoff seems worth it in this case.

Usability? Signal prevents backups on iOS and has no solution for someone changing a device (or even restoring a device from a backup) to carry over the conversations and retain chat history and group memberships. This is because it puts security above usability.

It’s also buggy in many other ways (e.g., sending safety number change messages when nothing has changed with the device or number; contacts sending messages and asking if it was received, etc.).

Signal is quite bad on usability compared to other apps.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#52

Post by interfixus »

tapoxi wrote: post #14
interfixus wrote: post #11

Earlier quoted context omitted.

We are not really supposed to talk ill of the holy Signal here on HN, and we usually get severely trounced if we do. But of course you are absolutely right - this has been one gaping hole in Signal privacy since forever. Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardw…

> Another thing Signal likes to do is to broadcast the fact every time you shift it to a new device. I have seen enough changing round from a couple of correspondents to deduce a pattern in their hardware habits. This is a security feature to ensure you're talking to the same person. Phone numbers are terrifyingly easy to port to another account.

Yes, I know it's supposed to be a security feature. Not one that works weel, but perhaps it does somewhat enhance security. Alas, Signal forgets to mention that it does so at a cost to privacy.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#53

Post by sschueller »

mahemm wrote: post #25

The widespread usage of Telegram in a situation as sensitive as the Hong Kong protests is a failure on behalf of the security industry in educating the public. Even WhatsApp is miles better, but in reality it should be a no-brainer for the relevant people to use Signal or perhaps Threema/Wire. What a shame that charlatans have successfully marketed themselves to the top of this segment with a distinctly inferior prod…

charlatans? You mean like when Facebook claims they have implemented the signal protocol but then scan your messages for keywords in order to disable encryption for governments? There is no way for you to check my claim nor Facebook's as it's closed source.

Same goes for threema which will shortly be required by Swiss law to comply with Büpf as they will reach a size requiring it. It's closed source, we can't check what they are doing. Their external security audit was a long time ago.

At least with telegram if I install the android version off fdroid it is compiled from source and I can verify that.

I can gets users to switch to telegram, I can't get them to switch to signal. There is a trade-off but I would argue telegram over whatsapp anytime.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#54

Post by codedokode »

rargulati wrote: post #32
22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

Signal has spoken [1] at length about the issues of private contact discovery, and the many [2] solutions they've employed to minimize the amount of information that gets leaked. There's this intractable problem of requiring a social graph for easy discovery and for trust, and Signal's found one of the better solutions (though I'm sure we'll discover better ones yet). [1] https://signal.org/blog/private-contact-disco…

Signal could allow using it without a phone number, and let people themselves choose between anonimyty, social graph and trust. Why didn't they allow it? Because they don't want anonymous users I assume.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#55

Post by codedokode »

couchand wrote: post #35
dooglius wrote: post #22

Earlier quoted context omitted.

>this is an impossible problem to solve when the goal is to create an end-to-end encrypted messaging platform where your identifier is your phone number Right, the use of phone number as identifier is flawed by design, and not secure

A big part of practical security is usability. It's hard enough getting most people to adopt Signal or other encrypted messaging services. If they couldn't "just send a message to a number" it would be that much more difficult. The tradeoff seems worth it in this case.

You can just provide a choice, whether user wants to use a phone number and a real name, or just an anonymous login, not linked to anything. Why Signal doesn't want to do this? They don't want users to be anonymous, they want real names, addresses and GPS locations I assume.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#56

Post by codedokode »

couchand wrote: post #44
ubercow13 wrote: post #40

Earlier quoted context omitted.

People seem fine adding each other on Facebook without using a phone number. When I add people on LINE messenger I use their ID not their phone number. When I meet a new person and exchange some contact details, it is rarely a phone number. I would also like to talk to some people who I do not want to know my phone number. I think this tradeoff was a mistake for Signal.

You are clearly not the target audience for Signal. There of course is a space for the type of app you're describing, but saying that the tradeoff that Signal has chosen was a mistake is to misunderstand the goal there.

What goal do you mean? Sell users to marketers?

Re: A Telegram bug that disclose phone numbers of any users in public groups

#57

Post by codedokode »

couchand wrote: post #36
darkhorn wrote: post #31

Earlier quoted context omitted.

The problem could be solved like this; you generate an UUID and your friend generates UUID. Then you both exchange the UUID. You should do it within an hour. When both UUIDs are entered into the opposite parties you become friends. Now your friend knows you as G435-… and your wife knows you as B64J-…. No one can add you as friend with these used UUIDs. This will solve the privacy problem, mostly.

At the expense of being practically unusable for most people. It's a trade off. EDIT: This proposal also suffers from a bootstrapping problem. You have to already have a secure channel to communicate the ids.

Signal could allow both options: register with a phone number or with completely anonymous logins. I think they just don't want anonymous users, visits from FBI etc. Also, it is not very profitable to sell ads to anonymous users.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#58

Post by codedokode »

samat wrote: post #42

Telegram says they block massive contacts imports, says that particular bot was able to add only 85 contacts and then throttled to 5 new contacts per day. My questions is how do they distinguish legitimate imports? I have 2K phone numbers in my address book. Would it take a year for me to be able to message my friends on telegram?

I assume there are some limits on number of uploaded contacts (probably on order of thousands) but they can be bypassed by creating thousands of accounts each with different contact list. One SIM card here in Russia costs as low as several dollars, and probably cheaper if bought wholesale, so it is not very expensive.

Also, here is a quote from an article in Russian [1], where it is claimed that there is a software to de-anonymize Telegram users:

> A phone number used by [Telegram] account @silovikicat was discovered using a program titled "Insider-Telegram" developed by the "Center of research of legitimacy and political protest". The head of the "Center" Eugene Venediktov explains: "Currently the database contains over 10 million of numbers. We just go through all possible numbers and check whether they are registered in Telegram: for example, we take all numbers starting with a prefix +7911 and check them. You automatically see all contacts from you address book in your Telegram, don't you? We just have a very "fat" address book with phones of all users from our country."

> When a phone number provided by Eugene is added into an address book, Telegram automatically matches it with account @silovikicat («Siloviks' cat»).

[1] https://meduza.io/feature/2019/08/10/kto-takoy-tovarisch-may...

Re: A Telegram bug that disclose phone numbers of any users in public groups

#59

Post by ubercow13 »

couchand wrote: post #43
ubercow13 wrote: post #41

Earlier quoted context omitted.

You have to have a secure channel to exchange phone numbers too. The code could be communicated simply using a QR code. Other messengers already work this way and it works well.

Yes, the difference being that a phone number is an established identity mechanism and you likely already know it.

Yes but it's a kind of bad one. There are many ways you can lose or change your phone number. Email address is a better identifier.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#60

Post by toosangiforthis »

mahemm wrote: post #25

The widespread usage of Telegram in a situation as sensitive as the Hong Kong protests is a failure on behalf of the security industry in educating the public. Even WhatsApp is miles better, but in reality it should be a no-brainer for the relevant people to use Signal or perhaps Threema/Wire. What a shame that charlatans have successfully marketed themselves to the top of this segment with a distinctly inferior prod…

Is Telegram that bad? I thought it was fairly good. Atleast better than WhatsApp

Edit: Nvm, I remembered that telegram isn't e2e by default

Post reply on HN