A Telegram bug that disclose phone numbers of any users in public groups • Hacker News Board

Re: A Telegram bug that disclose phone numbers of any users in public groups

#61

Post by 22c » Wed, Aug 28, 2019, 12:51 AM UTC

exocron wrote: post #20

22c wrote: post #9

Whilst not the same as mentioned in TFA, I noticed in Signal that if you allow it access to your contacts it will tell you how many of your contacts are already on Signal. I understand this is useful from a usability/discoverability aspect, but from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I…

> from a privacy perspective I have no reason to be made aware of the fact that one of my old bosses who's number is in my phone is on Signal and neither should they know that I am on Signal for the same reasons (or lack thereof). I agree that there are some contacts that I would rather not know that I was on Signal, but, unfortunately, this is an impossible problem to solve when the goal is to create an end-to-end e…

I wouldn't say it's an impossible problem. It's fairly simple, in my mind.

If someone tries to send me a message on Signal it should go into purgatory. On my end, I should be able to see who is trying to send me the message (yes, including their phone number, given that is how Signal has decided to uniquely identify users) and I should be able to see what their public key is. Then I should be able to either accept that message, which would essentially make my presence on Signal known to the other party, or choose to first verify that the public key matches that of the other party via the existing "in-person" verification method.

Alternatively, I can leave the message in purgatory where a message from someone I don't trust belongs and eventually times out. Not only do I never see the contents of the message, but the sender of the message will also never know if I am on Signal.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#62

Post by couchand » Wed, Aug 28, 2019, 2:23 PM UTC

codedokode wrote: post #56

couchand wrote: post #44

Earlier quoted context omitted.

You are clearly not the target audience for Signal. There of course is a space for the type of app you're describing, but saying that the tradeoff that Signal has chosen was a mistake is to misunderstand the goal there.

What goal do you mean? Sell users to marketers?

Do you have evidence that this is happening? Otherwise, completely FUD.

The goal I was referring to is making it easy for regular folks to use end-to-end encryption. Any real measure of security needs to be practically usable by the intended audience, and the clear and consistent intended audience for Signal is regular folks who don't have a sophisticated threat model. If any other identity scheme were used, I'd guess the number of Signal users would be an order of magnitude smaller.

This is not to say that there aren't great reasons to have more elaborate secure messaging systems that address these questions, for anyone with a different security model.

Re: A Telegram bug that disclose phone numbers of any users in public groups

#63

Post by nyxxie » Mon, Sep 02, 2019, 3:27 AM UTC

marcinzm wrote: post #13

hmnom wrote: post #3

It could be argued you already had the phone number of your victim. If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical.

>If mobile numbers in your country are in the 2________ range, how feasible is it to add millions of phone numbers to your contact list to find out the number of someone? I think this is nonsensical. If you're a state actor probably pretty easy. Get a couple thousand rooted remote controllable android devices (which you probably already have for other projects) and have them automatically add 10k phones numbers each.…

All this to get an app to make "do any of my contacts also use signal" requests? You could probably just figure out what endpoint the mobile client calls and imitate them yourself to avoid all the overhead of setting up the mobile devices. If you have to register to make the request, just provision a bunch of VOIP numbers and go to town.

Point being, if "who is using signal" is a question you want answered, it's far more trivial than having to acquire actual devices. Your oppressive regime could go from zero to black bag list in an afternoon.