5 ms·

> Protesters believe Chinese security officials have exploited the function by uploading large quantities of phone numbers. > The app automatically matches pho

> Protesters believe Chinese security officials have exploited the function by uploading large quantities of phone numbers. > The app automatically matches phone numbers with the user names in the group. Chinese authorities then only need to request the owners of the phone numbers from the local telecom service in order to learn the users’ true identities. > Telegram has detected evidence that Chinese authorities may have uploaded numbers to identify protesters, said a person with direct knowledge of the situation. Signal does/did this too: https://news.ycombinator.com/item?id=12590979 https://news.ycombinator.com/item?id=12590979

segmondy 7y ago
Not the same thing. The flaw in Telegram happens with the group feature.
- jobigoud 7y ago
  Are you sure? I wanted to install Telegram and it insisted on having the contacts permission from the get go. I think it's sending contacts to their database so they can match friends. Isn't there a secure messaging app that doesn't require a phone number and doesn't ask me to upload my contacts?
  - tripzilch 7y ago
    Matrix doesn't ask for anything. But I wouldn't use it for super critical things, cause the user interface (of the Riot client) is confusing enough that I'm afraid I'll make mistakes in verifying devices or fingerprints or something. Weird things happened when I tried it myself (I got more device IDs than devices, and I'm not sure where the other ones came from ... )
Mediterraneo10 7y ago
> The app automatically matches phone numbers with the user names in the group. Chinese authorities then only need to request the owners of the phone numbers from the local telecom service in order to learn the users’ true identities. This is a flaw common to services that rely on phone numbers as IDs. In many countries, one cannot purchase a SIM card without showing ID (and the seller makes a photocopy of the ID to provide to the authorities). That means that there cannot be true anonymity. Know the phone number, know the person. I am always baffled when people claim that PGP-encrypted e-mail is passé because it leaks metadata, when Signal and Telegram leak metadata too and, furthermore, metadata that can be immediately associated with a specific person in many countries.
- spondyl 7y ago
  re: needing an ID for SIM cards, that's interesting! Here in New Zealand, I can freely purchase any prepay SIM without ID and use it straight away. Most, if not all dairies carry them too.
  - est31 7y ago
    In europe it's mixed: https://www.reddit.com/r/europe/comments/9ziqfi/european_countries_requiring_registration_of/ https://www.reddit.com/r/europe/comments/9ziqfi/european_cou...
    - vinay427 7y ago
      I recently visited what is apparently a prepaid-SIM-without-ID island of the Czech Republic, accustomed to places where registration is required. The person in the telecom store selling me the SIM looked at me with an almost disarming "this is the Czech Republic" look when I asked if she needed to see my passport. In Germany you now apparently need to show ID and provide an address, though no proof of residence so any address seems acceptable.
      - n_ary 7y ago
        In Germany, I need to do PostIdent or handover my address+copy of my ID/passport to buy a SIM card. To further check things, telecom sends letters to corresponding address too sometimes.
  - dannyw 7y ago
    Not over the border in Australia.
  - terrywang 7y ago
    Not the same crossing the Tasman sea. It's mixed in Australia. One can only have 5 pre-paid mobile numbers under 1 name (activation limit). However, you can still buy SIM packs from supermarkets or convenient stores, not sure if activation requires ID, it may depend on provider. NZ is obviously loose due to large number of tourists, I reckon. So easy to get SIM cards, I've got 2 (spark and 2 degrees). US also requires ID to get SIM last time I was in bay area (2016).
axaxs 7y ago
Then don't use so called 'secure' services that rely on phone numbers. There exist plenty of secure chat apps that don't have this flaw. LINE is probably my favorite.
- intertextuality 7y ago
  Secure until the government asks. https://linecorp.com/en/security/article/35 https://linecorp.com/en/security/article/35
  - axaxs 7y ago
    Fair, but it's E2E by default, and only requires a (burner) email address to sign up. If you're careful, there's not much to be gleaned from the remaining data.
- ubercow13 7y ago
  Doesn't LINE require a phone number or a Facebook account? Seeing as Facebook will often ask for a photo of you to verify your account before you can use it now, this doesn't seem like a fix for the anonymity issue.
  - axaxs 7y ago
    You can sign up with a phone number or email address. *Untrue. See comments below.
    - ubercow13 7y ago
      How? As far as I am aware, you can link an email to an account once it is created, though it doesn't really do much, but you require a phone number to create one. Indeed their website claims you need a phone number or Facebook account. I just tried registering using the Chrome extension and it required a phone number. https://linecorp.com/en/security/article/164 https://linecorp.com/en/security/article/164
      - 7y ago

segmondy 7y ago

Not the same thing. The flaw in Telegram happens with the group feature.

jobigoud 7y ago
Are you sure? I wanted to install Telegram and it insisted on having the contacts permission from the get go. I think it's sending contacts to their database so they can match friends. Isn't there a secure messaging app that doesn't require a phone number and doesn't ask me to upload my contacts?
- tripzilch 7y ago
  Matrix doesn't ask for anything. But I wouldn't use it for super critical things, cause the user interface (of the Riot client) is confusing enough that I'm afraid I'll make mistakes in verifying devices or fingerprints or something. Weird things happened when I tried it myself (I got more device IDs than devices, and I'm not sure where the other ones came from ... )

Mediterraneo10 7y ago

> The app automatically matches phone numbers with the user names in the group. Chinese authorities then only need to request the owners of the phone numbers from the local telecom service in order to learn the users’ true identities. This is a flaw common to services that rely on phone numbers as IDs. In many countries, one cannot purchase a SIM card without showing ID (and the seller makes a photocopy of the ID to provide to the authorities). That means that there cannot be true anonymity. Know the phone number, know the person. I am always baffled when people claim that PGP-encrypted e-mail is passé because it leaks metadata, when Signal and Telegram leak metadata too and, furthermore, metadata that can be immediately associated with a specific person in many countries.

spondyl 7y ago
re: needing an ID for SIM cards, that's interesting! Here in New Zealand, I can freely purchase any prepay SIM without ID and use it straight away. Most, if not all dairies carry them too.
- est31 7y ago
  In europe it's mixed: https://www.reddit.com/r/europe/comments/9ziqfi/european_countries_requiring_registration_of/ https://www.reddit.com/r/europe/comments/9ziqfi/european_cou...
  - vinay427 7y ago
    I recently visited what is apparently a prepaid-SIM-without-ID island of the Czech Republic, accustomed to places where registration is required. The person in the telecom store selling me the SIM looked at me with an almost disarming "this is the Czech Republic" look when I asked if she needed to see my passport. In Germany you now apparently need to show ID and provide an address, though no proof of residence so any address seems acceptable.
    - n_ary 7y ago
      In Germany, I need to do PostIdent or handover my address+copy of my ID/passport to buy a SIM card. To further check things, telecom sends letters to corresponding address too sometimes.
- dannyw 7y ago
  Not over the border in Australia.
- terrywang 7y ago
  Not the same crossing the Tasman sea. It's mixed in Australia. One can only have 5 pre-paid mobile numbers under 1 name (activation limit). However, you can still buy SIM packs from supermarkets or convenient stores, not sure if activation requires ID, it may depend on provider. NZ is obviously loose due to large number of tourists, I reckon. So easy to get SIM cards, I've got 2 (spark and 2 degrees). US also requires ID to get SIM last time I was in bay area (2016).

axaxs 7y ago

Then don't use so called 'secure' services that rely on phone numbers. There exist plenty of secure chat apps that don't have this flaw. LINE is probably my favorite.

intertextuality 7y ago
Secure until the government asks. https://linecorp.com/en/security/article/35 https://linecorp.com/en/security/article/35
- axaxs 7y ago
  Fair, but it's E2E by default, and only requires a (burner) email address to sign up. If you're careful, there's not much to be gleaned from the remaining data.
ubercow13 7y ago
Doesn't LINE require a phone number or a Facebook account? Seeing as Facebook will often ask for a photo of you to verify your account before you can use it now, this doesn't seem like a fix for the anonymity issue.
- axaxs 7y ago
  You can sign up with a phone number or email address. *Untrue. See comments below.
  - ubercow13 7y ago
    How? As far as I am aware, you can link an email to an account once it is created, though it doesn't really do much, but you require a phone number to create one. Indeed their website claims you need a phone number or Facebook account. I just tried registering using the Chrome extension and it required a phone number. https://linecorp.com/en/security/article/164 https://linecorp.com/en/security/article/164
    - 7y ago