3 ms·
The ability to find user locations via triangulation is overlooked in a lot of products - it's easy to not think twice when showing a user the distance between
by ve55 6y ago
The ability to find user locations via triangulation is overlooked in a lot of products - it's easy to not think twice when showing a user the distance between themselves and someone else.
In my own products I fix this by aggressively rounding/adding noise before the distance calculation is performed, and then rounding again afterwards, or quantizing into ranges (e.g. '0-10 miles'). Other solutions can be storing locations imprecisely to begin with, using pre-defined geobuckets, and so on, although remember that randomness by itself can be bypassed with enough queries since it will average out. It's rare that you need to know exactly how far away someone is from you rather than a rough approximation. Telegram is definitely not the only product with this issue, but hopefully they fix it even so.
- ROARosen 6y agoDoesn't this triangulation assume the other user is in one location the entire time of manually going to these places to triangulate them?
- peteretep 6y agoYou don’t need to go to a location to tell an app you’re in that location and want to know the distance to your target.
- hombre_fatal 6y agoIt's not much of an assumption. People go the same places every day (work, cafe) and then go to the same home to sleep in the same bed.
- taneq 6y agoIt does, but you can keep trying until you get an accurate location. In the simplest version you can just watch the distance and play warmer/colder until you physically track them down.
- dheera 6y agoQuantizing is much safer. Adding random noise is useless because one can just average multiple samples. If you want to be extra safe, quantize the user's lat/lon before computing the distance, and then quantize the distance again. (Quantizing only the distance can theoretically allow an attacker to travel in one direction until they see the transition from one bucket to the other which would tell them exactly when they are precisely 10 miles from the target.)
- ve55 6y agoYeah, it's important to put a lot of thought into it if users can query often like this. Removing more information generally won't hurt most use cases a ton, so it's better to err on the side of caution with good quantization as you note suggest here.