3 ms·

From the section "mitigation techniques": «It should be possible for privacy-concerned users to provide another form of identifier (e.g. a username or email ad

by dbrgn 6y ago

From the section "mitigation techniques": «It should be possible for privacy-concerned users to provide another form of identifier (e.g. a username or email address, as is the standard for social networks) instead of their phone number. This increases the search space for an attacker and also improves resistance of hashes against reversal. Especially random or user-chosen identifiers with high entropy would offer better protection.» Threema does this. By default users get an 8-character random identifier. Linking a phone number and/or e-mail address is optional. This way, users can choose their own balance between the usability of contact discovery and the privacy of random identifiers. All the other techniques are mainly making it harder for attackers, but not impossible. If a user on a 5 year old phone should be able to sync an address book of 2000 contacts in reasonable time, then the calculation of hashes cannot be made all too computationally intensive (e.g. by using intentionally expensive derivation functions like scrypt or argon2). The asymmetry between the weak hardware of a consumer phone and the abundant computation power of a cluster is what makes fighting brute force attacks so difficult. Granted, the proposed incremental contact discovery using leaky buckets is quite an interesting form of rate limiting. It also has a cost though, namely increased complexity, and thus an increased chance for bugs / malfunction (hurting the user experience) and vulnerabilities (hurting security). Contact discovery is a difficult balancing act. (One last comment: While private contact discovery is a difficult problem, securing profile information isn't. The fact that I can grab the public profile picture / information and online status of almost any WhatsApp or Telegram user is inexcusable. Giving the users control over access permissions is easy. Signal does this by encrypting the profile and sharing the key. Threema does this by sharing profile information only using end-to-end encrypted messages, without servers being involved for storage.)

bigiain 6y ago
> It should be possible for privacy-concerned users to provide another form of identifier (e.g. a username or email address, as is the standard for social networks) instead of their phone number. This expands the search space, without actually solving the problem, I think. The problem exposed by the study shows that phone numbers have a small enough search space to be readily enumerable. Adding email addresses and/or usernames just means the same attacker would need to move to well understood JackTheRipper/Hashcat style dictionary attacks. I think to thwart these types of attacks, every user identifier needs to be something very like a GUID (and a proper long one like 128 bits and a totally random one, not a hash of their phone number or email address).
- dbrgn 6y ago
  Yep, my point was that if the phone/email thing is entirely optional, then users can choose not to link any non-random identifier at all. You are right that e-mail space is also quite small (albeit not as small as phone numbers), especially considering that a huge part of users will have a @gmail.com address.
  - bigiain 6y ago
    If you attack email addresses as a dictionary attack instead of brute forcing the entire possible email address space, they’re actually a smaller search space. The paper claims 53 trillion possible (global) phone numbers, and 700 billion mobile numbers. Haveibeenpwned has just recently passed 10 billion email addresses- Troy probably doesn’t have _every_ valid email in existence (yet), but I’d be surprised if it was as low as 1 in 70 (or 1 in 5,300). At least cutting phone numbers down to just a specific country works better in eliminating in needed searches than for email (all those @gmail.com @outlook.com and to a lesser extent @company.com addresses aren’t country specific).

by dbrgn 6y ago

bigiain 6y ago

> It should be possible for privacy-concerned users to provide another form of identifier (e.g. a username or email address, as is the standard for social networks) instead of their phone number. This expands the search space, without actually solving the problem, I think. The problem exposed by the study shows that phone numbers have a small enough search space to be readily enumerable. Adding email addresses and/or usernames just means the same attacker would need to move to well understood JackTheRipper/Hashcat style dictionary attacks. I think to thwart these types of attacks, every user identifier needs to be something very like a GUID (and a proper long one like 128 bits and a totally random one, not a hash of their phone number or email address).

dbrgn 6y ago
Yep, my point was that if the phone/email thing is entirely optional, then users can choose not to link any non-random identifier at all. You are right that e-mail space is also quite small (albeit not as small as phone numbers), especially considering that a huge part of users will have a @gmail.com address.
- bigiain 6y ago
  If you attack email addresses as a dictionary attack instead of brute forcing the entire possible email address space, they’re actually a smaller search space. The paper claims 53 trillion possible (global) phone numbers, and 700 billion mobile numbers. Haveibeenpwned has just recently passed 10 billion email addresses- Troy probably doesn’t have _every_ valid email in existence (yet), but I’d be surprised if it was as low as 1 in 70 (or 1 in 5,300). At least cutting phone numbers down to just a specific country works better in eliminating in needed searches than for email (all those @gmail.com @outlook.com and to a lesser extent @company.com addresses aren’t country specific).