Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

ndss-symposium.org

Post reply on HN
Print view View original

81–90 of 206 posts

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#81

Post by egberts1 »

duckfang wrote: post #72
kome wrote: post #66

Earlier quoted context omitted.

> It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. Mass uploading contacts should be limited, like Telgram rightfully implemented. Signal should do the same. Also, for signal you have to give the list of your contacts. And you don't have with Telegram (and I didn't).

With Signal, it means your friends can rat you out by them sharing their address book.

Yeah, associativity remains an issue via Signal but the encryted-at-rest message content can be timed out at your interval.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#82

Post by deepstack »

oauea wrote: post #37
zeitg3ist wrote: post #4

Earlier quoted context omitted.

I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).

So you want them to just hold on to your messages on their servers indefinitely? I realize this is the norm nowadays, but is this really what you actually want?

Wire is not for people to leave message unread for 3 months. Most user can deal with that. And once it is read. You can archive your message on to a file (and then put on USB). For most users, why use anything else?

For those who like to leave your message unread on the server for up to a year, then go with signal or telegram.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#84

Post by 14 »

sen wrote: post #78
walterbell wrote: post #2

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

Wire is massively underrated in general. It’s got a slick UI that’s easy for non techies, it’s got native clients on all major platforms, and it has everything you really need from an e2e IM without the fluff. I’m surprised it doesn’t come up more in these discussions and people just “settle” for Signal or another service that needs your phone number etc.

I also like wire and just by chance found it to message my kids on their iDevices that don’t have a phone number like iPads and iPods. It works great and has all the main features. I’m even happier now that you guys inform me it’s secure also.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#85

Post by usrusr »

oauea wrote: post #37
zeitg3ist wrote: post #4

Earlier quoted context omitted.

I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).

So you want them to just hold on to your messages on their servers indefinitely? I realize this is the norm nowadays, but is this really what you actually want?

In a flawed world that deals perfectly with its flaws, infinite storage would be a service you can optionally buy from an open market of third parties, alongside optional identity mediation (for those who definitely don't want their identity bound to a device or SIM or some other PID known to the core network). Bonus points if the technological and organizational interface between third party and core network is paid, I believe that this would be one of the least bad ways imaginable of funding the core network.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#86

Post by Andrew_nenakhov »

egberts1 wrote: post #80
Andrew_nenakhov wrote: post #74

Earlier quoted context omitted.

Actually, the general love for Signal on HN is puzzling to me. It's nothing more than yet another centralised silo not owned by the users. End-to-end encryption? I'd take federation over it any day.

there is always Matrix app. Some may argue that Matrix still a centralized server by the virtue of seeding your group info somewhere. But this seeding can be done via paper-only thereby it is still a true decentralized messaging server.

No, there is always xmpp. Matrix is just an app, and we need a federated protocol. I think that Matrix will never have an alternative server implementation made by a competing party, which makes it's main selling point void.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#87

Post by TeMPOraL »

vbezhenar wrote: post #40
strogonoff wrote: post #26

Earlier quoted context omitted.

WhatsApp on iOS cripples user experience without access to OS contact list. You cannot create groups, and cannot initiate a chat with anyone, even by phone number. It works if someone else messages you first or adds you to a group.

https://wa.me/phonenumber Very intuitive, I know.

For people as confused as I was about the above link - after spending 5 minutes trying to figure out why visiting it gives me a 404 page, I eventually got out my phone and tried pushing that link to Android activity system, and then I discovered: it's meant to be wa.me/[an actual phone number goes here] - like wa.me/12345678912345.

Not great indeed.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#88

Post by elyobo »

wombatmobile wrote: post #50
elyobo wrote: post #6

Happened with Australia's real time payment system too. https://www.itnews.com.au/news/monitoring-fail-allowed-westp...

I didn't know that. Thanks. I suppose the consequences for Westpac are... nothing.

As far as I know, no. I suspect that it wasn't just them.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#89

Post by exciteabletom »

zeitg3ist wrote: post #4
walterbell wrote: post #2

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-devi…

I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).

FWIW Telegram deletes your account if you are away for a year, and you cannot disable it.

Re: Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

#90

Post by Ticklee »

criley2 wrote: post #76
norcux wrote: post #70

Earlier quoted context omitted.

Who said Bitcoin is anonymous?

There is no such thing as an anonymous transaction, for a fully informed definition of anonymous. Bitcoin isn't... neither is cash in hand. Neither is a drop. Someone knows. A discussion of 'anonymity' in this context is one of increasing the difficulty of discovery, not thinking that the discovery is impossible. If a major world government is after you, good luck with "anonymous"

Monero is.
Post reply on HN