6 ms·

If it is exactly 1 km you could triangulate to find someone's location. A program to do that would do a bisection search along a line (faking coordinates for t

by A1kmm 10y ago

If it is exactly 1 km you could triangulate to find someone's location. A program to do that would do a bisection search along a line (faking coordinates for the location of the device) to find the point on the line where you transition to seeing the person's messages. Then, repeat along other two lines in different directions. Each transition point gives a circle of 1 km radius on which the person is present, and the one point shared by all three circles is their location. This could be mitigated by rounding off coordinates to be coarse enough that it doesn't give their precise location before calculating the distance.

fucking_tragedy 10y ago
This is trilateration, not triangulation. Triangulation works if you know the angles, trilateration works if you know the distances and uses circles. Source: I've done this before and it is very accurate and creepy. > This could be mitigated by rounding off coordinates to be coarse enough that it doesn't give their precise location before calculating the distance. Reporting a slightly different location to users or varying the search radius per user search could help.
jamesfisher 10y ago
Tinder once had this exact problem. You could find users' exact locations via triangulation, since the API reported an exact distance from your location: http://blog.includesecurity.com/2014/02/how-i-was-able-to-track-location-of-any.html http://blog.includesecurity.com/2014/02/how-i-was-able-to-tr...
- badwolf 10y ago
  Grindr as well, which due to the nature of that app could have had bad effects should someone with ill-intent take advantage. There were even a few apps in the Google Play store that would pinpoint other grindr users.
  - secfirstmd 10y ago
    Yep, this is a big problem in the human rights space these days. When we train on apps with LGBT communities in the Middle East and Africa, we have to spend a lot of time on this issue. More info: https://grindrmap.neocities.org/ https://grindrmap.neocities.org/ Comparison amongst gay dating apps (from 2014) https://grindrmap.neocities.org/overview.html https://grindrmap.neocities.org/overview.html
grenoire 10y ago
Doesn't look like the application shows the distance in the UI. As long as they don't leak it in the packets (hopefully they don't given how they claim anonymity) triangulation would require the target to be sending messages continuously on a consistent interval for you to detect whether or not they are at the 1 kilometre 'border.'
- trolor 10y ago
  ... why not just fake your phone's GPS coordinates and perform a binary search?
  - Faaak 10y ago
    Well, they could make it harder by relaying messages to people 1km+rand() around you
theveloped 10y ago
Due to the fact that distance matching is done server side the application doesn't have any knowledge with regard to distance. The only knowledge one has is whether or not one receives messages from an other user. Using triangulation to pinpoint an other users location would therefore require to move in and out of range (while the targeted user is continuously sending messages). Thus significantly more difficult than if the actual distance measure was depicted in the UI or leaked elsewhere. Finally closing the API to outside requests limits the ease with which the above could be automated. Any idea's for further improving these security measures are most welcome!
- mseebach 10y ago
  > would therefore require to move in and out of range (while the targeted user is continuously sending messages). That, or a number of co-operating clients located at various locations in and out of the range. A simple fix would be to have every sender generate a random vector of random length 0-100 meters (and re-generate every time you've moved at least 100 meters, you don't want to regenerate if the sender doesn't move as you'd be able to zero-in on a prolific sender), and have the message "originate" from the end of that vector.
- pavel_lishin 10y ago
  > Using triangulation to pinpoint an other users location would therefore require to move in and out of range (while the targeted user is continuously sending messages). Or spoofing their actual location.
- tghw 10y ago
  How exactly do you close the API to outside requests? It's not hard to reverse engineer most APIs, either by decompiling the app or just watching the wire.
  - tokenizerrr 10y ago
    You don't. That is impossible.
- bo1024 10y ago
bradbeattie 10y ago
Could this be defeated by a "snap to grid" technique? The installed client takes the actual location of the user and locates the nearest grid point (the resolution of which is up for debate) and reports as at that location?
- 7952 10y ago
  Or increase the radius randomly after a pair of users have communicated for the first time.
  - qq66 10y ago
    That's not sufficient because a hostile actor could have three phones with three accounts.
deleted 10y ago
[deleted]
Too 10y ago
There are many solutions to this, some already listed. For best effect apply all of them together: Rate limiting api requests and movement, hysteresis on distance, randomness on distance, snap to grid, increasing randomness the more you seem to be trilaterating, etc. Some of thrm will also solve the problem of just discovering a user, starting a chat and then instantly loosing them, even though you were both siting still, as you were on the border.
debt 10y ago
I don't understand the anonymous angle. Why does everything have to be anonymous now? Like, you know if it uses the internet or touches a switch/router/server etc outside of your own home at any point that it's certainly, most definitely NOT anonymous at this point. Anonymous has become a pointless buzzword in this NSA-era we be living in. Just say it's a hyper-local instant messaging app, because any half woke individual will know that nothing on the internet is anonymous really anymore. A percentage of all our internet activity is sitting on a rack somewhere in the Utah desert. Get over it.
- ItsDeathball 10y ago
  There is a difference between the NSA being able to trace your identity vs. a profit-driven corporation being able to connect your identity to your online speech, location, and contacts. The first is governed by due process and need-to-know, the second is essentially public knowledge if the ad-tech revenue is sufficiently tempting. Even in a pseudonymous environment where the venue operator presumably knows who you are (like HN), the assumption that other users cannot easily trace your words to your IRL identity reduces friction in communication. Environments where everyone publicly posts under their real identity, with those posts retained forever, tend towards low-information social signaling.
  - deleted 10y ago
    [deleted]
  - brokenmachine 10y ago
    > NSA -- due process and need-to-know Lol. Have you read the news in the last 30 years? I do agree somewhat with your point though.

by A1kmm 10y ago

fucking_tragedy 10y ago

This is trilateration, not triangulation. Triangulation works if you know the angles, trilateration works if you know the distances and uses circles. Source: I've done this before and it is very accurate and creepy. > This could be mitigated by rounding off coordinates to be coarse enough that it doesn't give their precise location before calculating the distance. Reporting a slightly different location to users or varying the search radius per user search could help.

jamesfisher 10y ago

Tinder once had this exact problem. You could find users' exact locations via triangulation, since the API reported an exact distance from your location: http://blog.includesecurity.com/2014/02/how-i-was-able-to-track-location-of-any.html http://blog.includesecurity.com/2014/02/how-i-was-able-to-tr...

badwolf 10y ago
Grindr as well, which due to the nature of that app could have had bad effects should someone with ill-intent take advantage. There were even a few apps in the Google Play store that would pinpoint other grindr users.
- secfirstmd 10y ago
  Yep, this is a big problem in the human rights space these days. When we train on apps with LGBT communities in the Middle East and Africa, we have to spend a lot of time on this issue. More info: https://grindrmap.neocities.org/ https://grindrmap.neocities.org/ Comparison amongst gay dating apps (from 2014) https://grindrmap.neocities.org/overview.html https://grindrmap.neocities.org/overview.html

grenoire 10y ago

Doesn't look like the application shows the distance in the UI. As long as they don't leak it in the packets (hopefully they don't given how they claim anonymity) triangulation would require the target to be sending messages continuously on a consistent interval for you to detect whether or not they are at the 1 kilometre 'border.'

trolor 10y ago
... why not just fake your phone's GPS coordinates and perform a binary search?
- Faaak 10y ago
  Well, they could make it harder by relaying messages to people 1km+rand() around you

theveloped 10y ago

Due to the fact that distance matching is done server side the application doesn't have any knowledge with regard to distance. The only knowledge one has is whether or not one receives messages from an other user. Using triangulation to pinpoint an other users location would therefore require to move in and out of range (while the targeted user is continuously sending messages). Thus significantly more difficult than if the actual distance measure was depicted in the UI or leaked elsewhere. Finally closing the API to outside requests limits the ease with which the above could be automated. Any idea's for further improving these security measures are most welcome!

mseebach 10y ago
> would therefore require to move in and out of range (while the targeted user is continuously sending messages). That, or a number of co-operating clients located at various locations in and out of the range. A simple fix would be to have every sender generate a random vector of random length 0-100 meters (and re-generate every time you've moved at least 100 meters, you don't want to regenerate if the sender doesn't move as you'd be able to zero-in on a prolific sender), and have the message "originate" from the end of that vector.
pavel_lishin 10y ago
> Using triangulation to pinpoint an other users location would therefore require to move in and out of range (while the targeted user is continuously sending messages). Or spoofing their actual location.
tghw 10y ago
How exactly do you close the API to outside requests? It's not hard to reverse engineer most APIs, either by decompiling the app or just watching the wire.
- tokenizerrr 10y ago
  You don't. That is impossible.
bo1024 10y ago

bradbeattie 10y ago

Could this be defeated by a "snap to grid" technique? The installed client takes the actual location of the user and locates the nearest grid point (the resolution of which is up for debate) and reports as at that location?

7952 10y ago
Or increase the radius randomly after a pair of users have communicated for the first time.
- qq66 10y ago
  That's not sufficient because a hostile actor could have three phones with three accounts.

deleted 10y ago

[deleted]

Too 10y ago

There are many solutions to this, some already listed. For best effect apply all of them together: Rate limiting api requests and movement, hysteresis on distance, randomness on distance, snap to grid, increasing randomness the more you seem to be trilaterating, etc. Some of thrm will also solve the problem of just discovering a user, starting a chat and then instantly loosing them, even though you were both siting still, as you were on the border.

debt 10y ago

I don't understand the anonymous angle. Why does everything have to be anonymous now? Like, you know if it uses the internet or touches a switch/router/server etc outside of your own home at any point that it's certainly, most definitely NOT anonymous at this point. Anonymous has become a pointless buzzword in this NSA-era we be living in. Just say it's a hyper-local instant messaging app, because any half woke individual will know that nothing on the internet is anonymous really anymore. A percentage of all our internet activity is sitting on a rack somewhere in the Utah desert. Get over it.

ItsDeathball 10y ago
There is a difference between the NSA being able to trace your identity vs. a profit-driven corporation being able to connect your identity to your online speech, location, and contacts. The first is governed by due process and need-to-know, the second is essentially public knowledge if the ad-tech revenue is sufficiently tempting. Even in a pseudonymous environment where the venue operator presumably knows who you are (like HN), the assumption that other users cannot easily trace your words to your IRL identity reduces friction in communication. Environments where everyone publicly posts under their real identity, with those posts retained forever, tend towards low-information social signaling.
- deleted 10y ago
  [deleted]
- brokenmachine 10y ago
  > NSA -- due process and need-to-know Lol. Have you read the news in the last 30 years? I do agree somewhat with your point though.