16 ms·

Large-Scale Abuse of Contact Discovery in Mobile Messengers [pdf]

410 points by weinzierl 6y ago

Karrot_Kream 6y ago
The authors have an implementation of an improvement on these messengers' contact discovery algorithms at https://contact-discovery.github.io/ https://contact-discovery.github.io/
- lucb1e 6y ago
  That's an interesting project / paper[1]. I don't have the time to dive deeply into it and understand how this works, but at a glance it seems better than what I was working on a few months ago[2]. Does anyone else know more about this, since the paper is really written for the in-crowd? The video[3] helps a little for a very high-level overview (to give some context before starting to read), but doesn't explain how it works or what properties their algorithm has. [1] https://eprint.iacr.org/2019/517 https://eprint.iacr.org/2019/517 [2] This would do partial hash matching against a database on the server (similar to HIBP) and then do an interactive session with each of the matches, basically alternating sending the next binary bit of the phone number until either party gets it wrong or the value fully matched. The todo is to check whether there are parameters that make it both scale and protect privacy. [3] https://dro.pm/a.webm/preview https://dro.pm/a.webm/preview (link works for 18 hours after posting) or if you've already accepted the Google terms of service: https://www.youtube.com/watch?v=4vgKHmNaAAw https://www.youtube.com/watch?v=4vgKHmNaAAw
walterbell 6y ago
Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-device history if the device logs in within a few weeks of the sent message. Basic export/import for moving your device's message archive to a new device of the same type. https://wire.com/download/ https://wire.com/download/ They are contributing to IETF MLS for end-to-end encrypted group messaging: https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/
- zeitg3ist 6y ago
  I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).
  - walterbell 6y ago
    For those who want end-to-end encrypted messages, it's a feature that the server doesn't have a persistent archive of message history. Wire messages are on the server for a few weeks, long enough to relay those messages to transiently offline devices. Telegram is great at what it does, different use case from Wire.
    - ajconway 6y ago
      Matrix does have end-to-end encrypted persistent history.
      - walterbell 6y ago
        Yes, it's possible. Depending on your threat model, it may or may not be a good idea to have a long-term archive of encrypted data be subject to legal process. Matrix has plans to support IETF MLS, which is a necessary precursor to messenger interoperability.
        Arathorn 6y ago
        Matrix lets you configure the history retention on a per-server or per-room basis, fwiw: https://github.com/matrix-org/synapse/blob/develop/docs/message_retention_policies.md https://github.com/matrix-org/synapse/blob/develop/docs/mess.... From a metadata perspective, we're working on P2P to avoid metadata accumulating on servers. In terms of the OP here (address-book based contact discovery), https://github.com/matrix-org/matrix-doc/blob/hs/hash-identity/proposals/2134-identity-hash-lookup.md https://github.com/matrix-org/matrix-doc/blob/hs/hash-identi... is how Matrix optionally implements it while trying to preserve privacy.
random5634 6y ago
100% of signal scrapped - ugh
- dotandimet 6y ago
  Just as insecure as Whatsapp, just far fewer users.
  - hiq 6y ago
    > Just as insecure as Whatsapp From the paper: > With its focus on privacy, Signal excels in exposing almost no information about registered users, apart from their phone number. In contrast, WhatsApp exposes profile pictures and the About text for registered numbers, and requires users to opt-out of sharing this data by changing the default settings.
- Daniel_sk 6y ago
  They have been too busy with integrating crypto payments instead of fixing long standing issues or planned features (allow to register without a phone number). But - to Signal's defense - while you can scrape the phone numbers, there is not much you can gain from it, you can only tell that a specific number is a Signal user. And sometimes you can see the username (if the user chooses to not encrypt it).
  - walrus01 6y ago
    Given the re-use and re-issuance of phone numbers in very busy US area codes (like 212, 202, etc) it also only allows discovery that at some unknown point in the past, that number has been registered as a Signal user.
elyobo 6y ago
Happened with Australia's real time payment system too. https://www.itnews.com.au/news/monitoring-fail-allowed-westpac-payid-look-up-abuse-526135 https://www.itnews.com.au/news/monitoring-fail-allowed-westp...
- wombatmobile 6y ago
  I didn't know that. Thanks. I suppose the consequences for Westpac are... nothing.
  - elyobo 6y ago
    As far as I know, no. I suspect that it wasn't just them.
deeplowdock 6y ago
Nice to see Telegram imposed strict limits for contact discovery. They were only able to scrape 100k numbers over 20 days. Strange that they keep and return metadata for non-registered numbers though.
- deleted 6y ago
  [deleted]
Jonnax 6y ago
There needs to be two lists of contacts. One which I allow to be shared with apps And another which are my contacts I use with my dialer. People don't need their messenger apps knowing the phone number of their doctor
- jannes 6y ago
  An alternative would be to make it similar to the iOS photo gallery permissions: When an app requests permission to all photos the user gets the option to share only a subset of photos with the app. (This subset can be different for each app.)
  - furyg3 6y ago
    While I agree with you, the current way this functionality works is really terrible.
    - ratww 6y ago
      It's indeed terrible in Apps that reimplement the photo selecting feature, but in simpler Apps that just use the default picker it works quite well and it is transparent. Popular apps like WhatsApp, Twitter, Facebook, Telegram, etc, could just fall back to the default picker when full access is not available.
    - h0h0h0h0111 6y ago
      Agree - it's a great concept but seems to involve an inordinate number of clicks (touches?) all over the screen
- tgv 6y ago
  Or the number of the VD clinic, or the number of the an oncology ward, or the number of the pawnbroker, ...
- hansel_der 6y ago
  on ios if one does not grant addressbook permission for the app: * telegram uses an "internal" contact list for which one can add contacts via the desktop client and then works as expected. * whatsapp let's the user freely initiate contact by phone numbers, but then only shows the number (no name). don't know about signal.
ovi256 6y ago
In other parts of the world, users share their contact books to get access to what others shared, see Bellingcat's extensive use of these phone contact book apps, here documented in 2019: https://www.bellingcat.com/resources/how-tos/2019/04/08/using-phone-contact-book-apps-for-digital-research/ https://www.bellingcat.com/resources/how-tos/2019/04/08/usin...
jillesvangurp 6y ago
The practical consequence of this is that your phone number + name is public information. Almost as if it were listed in a phone book. That was pretty much the case already so it's not really a new threat. Of course people with unlisted numbers will be a bit annoyed by this. Likewise, your email address probably is part of numerous databases, including those owned by spammers/scammers. I'm not saying this is good. But merely that assuming otherwise was always a bit naive. Now in terms of GDPR and similar laws in the US, leaking information via a scrapable API is of course still a problem.
- gnud 6y ago
  My name/number is already pretty much public information, you can find it in various public registries if you search. But who I have in my contact list is _not_ public information. You can infer a lot from that. And the idiots who create these social apps always assume you want to "connect" with whoever is in your contact list. Even if you added their number so you know to _not_ pick up when they call.
- elric 6y ago
  Yeah ... no. I'm not sure what exactly gets shared with these apps, whether it's just the numbers or also the rest of the contact information. If names are being shared, that's a seriously fucked up nono. These parties are getting insights into our lives that are way beyond what is reasonable. Imagine I have 555-12345 in my contact list as "Wife" and someone else has the same number as "Girlfriend".
- hiq 6y ago
  > The practical consequence of this is that your phone number + name is public information. From the paper: > With its focus on privacy, Signal excels in exposing almost no information about registered users, apart from their phone number. In contrast, WhatsApp exposes profile pictures and the About text for registered numbers, and requires users to opt-out of sharing this data by changing the default settings. So if you only use Signal you don't leak the connection between your profile (which could contain your name) and your phone number, at least not until you accept a message from an attacker.
blorange 6y ago
"Interestingly, if the number provided by Hushed was previously registered by another user, the WhatsApp account is "inherited", including group memberships. A non-negligible percentage of the accounts we registered had been in active use, with personal and/or group messages arriving after account takeover." Did not know that taking over a WhatsApp account is that easy.
- hiq 6y ago
  You can set a pin which I think would reset your account eventually if you want to register the same number but fail to provide the correct pin, and the previous owner of the phone number does not use WhatsApp in some time.
blorange 6y ago
The most interesting section for me was "Exposed User Data". My takeaway is that an attacker can know whether my phone number is registered with Signal and can receive voice and video calls. They also get my encrypted name and profile picture but would need my explicit consent for that.
- hiq 6y ago
  That's my take as well, and I think that's already known by most users. So nothing new for Signal users. For WhatsApp it would be nice to change the defaults so that no information (other than the fact that the number is registered) is shared with no interaction.
captainmuon 6y ago
I think the information who is a contact of whom should not reside with the provider, but be distributed among the peers. I had a proof of concept of something similar working a couple years ago. I was writing a file-sharing app, and the goal was to piggy-pack on the existing social graph that you had from Facebook, Skype and so on. I could not register as a proper Facebook app, since that required having a domain, and I would be legally catchable in case somebody used my app to share copyrighted or illegal stuff. Back then, Facebook messenger was based on XMPP/Jabber, which allows sending custom stanzas (secret messages that are not shown to the user). My app would ask for your login, then send a message to every contact, and if it got a reply from another instance, it would perform a handshake and exchange keys. This also worked over (old) Skype, which although it didn't support XMPP, you could do something similar with SkypeAPI. (Unfortunately, a few months later almost every messaging service that allowed such a trick stopped it...) Now, this trick doesn't help if you are trying to set up a new social graph in the first place. But I think with this "send an invisible message to a potential contact's app" primitive, you could build a list of mutuals securely. (Other caveats apply, you'd let somebody know that you have their number for example...)
- hiq 6y ago
  > I think the information who is a contact of whom should not reside with the provider, but be distributed among the peers. Signal partially solves this with SGX. Partially because SGX will probably never be fully secure.
anthropodie 6y ago
I will criticize how Contacts are implemented on Android for this. For example, I don't want any person who I interact with once or twice a month to have access to my WhatsApp or any other social media app. But I can't do this in Android because once you add contact every damn app has access to that contact list. It's full access or no access if app uses permissions. I need something where I can label contacts to not appear in main contact list.
- zibzab 6y ago
  That is not correct. In Android you have two ways of accessing most things: full access or use the system to access one entry. You should blame WhatsApp for not supporting the second method.
  - anthropodie 6y ago
    My point remains valid. If OS is handling contacts it should have some sort of control over what's getting shared. Theirs no point of providing alternate ways if an app can access full list of contacts.
    - viraptor 6y ago
      You need a migration path and backwards compatibility. They can't kill all the apps which used the old system.
      - MiddleEndian 6y ago
        They can just lie to the old apps. Tell them they're getting the full list when the API is called.
        LeifCarrotson 6y ago
        "Yep, this user has exactly one contact, and gee, it happens to be the one they're calling now, how fortuitous! They had a different single contact yesterday, but apparently they've deleted that one and added this one."
williesleg 6y ago
Surprise!
jacquesm 6y ago
It didn't take long after the first social graph was created to realize that your contacts define you as much or even more than your other indicators do. That's why so many companies are gunning for this information.
- TeMPOraL 6y ago
  A quote I saw on the Internet long ago went, "You're the average of the five people spend the most time with". I used to interpret it only in its original, prescriptive sense: if you want to become a different person, make appropriate changes to your social life. It took me way too long to realize it's even more applicable in the descriptive sense: the people you spend most of your time with are a good statistical predictor of who you are.
_trampeltier 6y ago
I was wondering, what would happen, if I would add all the phone numbers from the Facebook leak to my contacts. Did anybody try something like this? What is the upper contact limit?
- hansel_der 6y ago
  > What is the upper contact limit? answer is in the paper
wombatmobile 6y ago
The reason this abuse of privacy is so widespread is because there are no bad consequences for the perpetrators. Governments don't enforce privacy acts in this circumstance. Users just roll their eyes, knowing there is no way for them to complain except though boycotts, which are difficult to organise and might not work unless coordinated on a massive scale which has never been tried. And so it goes.
- Nextgrid 6y ago
  And yet people are still bitching about the GDPR. The only problem with the GDPR is the lack of enforcement. However, it isn't really surprising considering a large chunk of this very community makes their money off large-scale stalking and the same unethical things they complain about.
  - ryandrake 6y ago
    The only people really bitching about GDPR are software engineers and lawyers at companies whose privacy practices are still questionable after all the time given to clean up their act. That's why, if you look at HN comments, everyone seems to hate it. Sample bias. None of the remaining 7 billion people on the planet really know much about it. I bet if you summarize the regulation and describe it to a random person on the street, they'll nod and think "sure it's kind of a good idea" and forget about it in the next 10 seconds.
Andrew_nenakhov 6y ago
This scientifically-looking paper could have been written by Captain Obvious himself. It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. If users' behaviour has shown us anything, it's that they love it. And for all the dangers of their privacy loss, they happily trade it for the convenience of finding the people they know.
- MattJ100 6y ago
  "They love it" but they often aren't given the choice, nor are they fully aware of the consequences (I expect many would choose not to accept if the findings in this paper were presented to them in a clear understandable way). The average person barely knows what a server is. They install e.g. WhatsApp on their phone, they are likely to think that the app on their phone is doing the work of telling them who else is on WhatsApp. They are not likely to think that their contact list is being scraped and uploaded and stored on someone else's computer in a warehouse, and then profiled for advertising purposes and then exposed to strangers via an API. The average person may love the convenience, but the average person does not understand how it is implemented or the consequences of using such a service (as described in this paper).
  - AshamedCaptain 6y ago
    In my experience, even after having made fully sure that they understand the risks involved, "the average person" will happily switch back to a walled garden IM platform the moment the next stupid feature comes in. Last time it was the (I think Whatsapp?) feature that allows, when replying to a message with an attached picture, to highlight a portion of the attached picture. That's it. There was no network effect at this point whasoever. This pseudo-feature was enough for an adult person to decide to switch back to Whatsapp and fuck my and everyone's privacy. THEN the network effect kicks in in favor of Whatsapp, because of course Whatsapp is a walled garden, so everyone is forced to switch to Whatsapp. I have seen this already happen several times network-wide and I will see it happen again. Non-walled garden IM networks are just set-up to lose.
- 6y ago
gnfargbl 6y ago
The paper claims that stricter rate limits are a possible solution to this issue, and that with stricter limits in place "crawling entire countries would only be feasible for very powerful attackers". I don't think I agree. Take Signal: the authors managed to crawl all US phone numbers in 25 days, using 100 accounts. Their proposed stricter rate limits force an approx 50x slowdown on an attacker (Table V), which seems to imply that over the same crawl period an attacker would require 5000 accounts. If we assume that virtual SMS numbers are around $5 each, then the attack now costs about $25k, which is about 0.001% the GDP of East Timor. They also propose a global salt as a mitigation. I'm a little confused there too, because wouldn't the salt need to be present in the endpoint application? If so it would be trivial to extract. Their proposal of using a key stretching hash algorithm (e.g. Argon2) seems reasonable? At a significant increase in cost on the server side.
- hiq 6y ago
  From the paper: > Signal acknowledged the issue of enumeration attacks as not fully preventable, So rate-limiting is fine as long as you don't hurt user experience, e.g. you can still message your contacts within 1min if you have around 500 contacts. It's also nice to lower the load on the servers. But there's no real fix as long as phone numbers are used. And it's fine, given that Signal basically leaks one bit of information: whether a phone number has a Signal account or not. ...of course, assuming that the account owner doesn't accept unsolicited messages (and thus shares their profile, with their picture and "About" field).
deleted 6y ago
[deleted]
upofadown 6y ago
People will complain about the meta-information leakage of email but then turn around and suggest we should instead use something based on your phone number[1]. I guess this is a reminder that phone number based contact discovery has issues as well ... perhaps worse ones in practice. With email the server operators know who is talking to who but do not necessarily know who any of those people are. Email clients will not show who has you in their contact list. There is no practical way to enumerate every active email address in use. [1] https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html https://latacora.micro.blog/2020/02/19/stop-using-encrypted....
egberts1 6y ago
Imagine my surprise when one can actually give up MORE revealing information about yourself and your contacts just by installing BOTH Telegram and Signal apps. Signal: when you’re most concerned about privacy of your message content. Telegram: when you’re most concerned about association with contacts. WhatsApp: when you’re most concerned about losing your ability to reach out and contact someone. Nothing is absolute. But don’t tell our politicians and lobbyists that. Oh wait.
- anticensor 6y ago
  Matrix: when you are most concerned about losing your message history.
  - egberts1 6y ago
    which is probably the best sweet spot any privacy fan can aim for.
cpach 6y ago
Previous discussion: https://news.ycombinator.com/item?id=24494505 https://news.ycombinator.com/item?id=24494505
tediousdemise 6y ago
Your contact list seems like a pretty unique fingerprint with high entropy. It also persists across devices and accounts through common synchronization mechanisms. How many people in the world share the same contact list as you?
ISO-morphism 6y ago
Every time I open the Snapchat Android app it prompts me with a Snapchat-styled (not the system) dialog to share my contacts. Every time I hit "Don't allow". Every time it prompts me again. This is an inexcusable dark pattern. Two things need to happen: 1. The operating system needs to provide a "screw you, never" option for any permissions. 2. We as engineers need to say "screw you, never" to requests to implement behavior like this. Sure, this could be a bug, but I see the same behavior with Venmo and location access. Personally I'm rather disillusioned with where we've found ourselves. This sort of adversarial relationship in which people are property of a platform and treated as such is winning. Edit: Venmo had been set to "Only while using the app" and was prompting to enable location services on the device, not for permission. That's my own fault.
- MrDresden 6y ago
  The system does have a "screw you, never" option for all permissions. The issue is that Snapchat (in your case, as I don't have this happen on v11.23.3.36) is told that they wont get the permission and wont be able to ask for it either. And so they perform their own inhouse permission request to you. There is nothing that can be done from the system's point of view for that.
  - ISO-morphism 6y ago
    > v11.23.3.36 v11.25.0.29 Beta for me > in house permission request That's what I had feared. I'd expand the scope of "the system" to include Play store rules.
    - MrDresden 6y ago
      It would change the ecosystem, for the better, if Google would uphold and enforce their policies as fiercly as Apple does. It would surely reduce the amount dark pattern predatory apps on the market place, and overall just pull the quality up a few notches. Why they haven't done so already is a mystery to me.
  - hctaw 6y ago
rcMgD2BwE72F 6y ago
An even bigger problem: if you set up an Android phone without a Google account and need to access the Play Store (which is impossible to do without nowadays), Google will force you to sign into a Google account at the OS level and will suck in all your devices contacts -- with no opt out. You can disable this sync "feature" but *only after*, once Google has collected all your contacts (phone number, addresses, emails, birthdays, etc). Explanation: the toggle to opt out is made available after you log into Google and you must navigate in multiple screens which gives Google ample time to collect hundreds of contact details. Of course, it is not possible to turn on airplane mode during this procedure since the log in requires an Internet connection. This is 100% against the EU GDPR. I've submitted a complaint to my local privacy regular (French CNIL) but never heard back. This probably impacts 200+ hundreds millions of EU citizens (since 2/3 of the population must be using an Android phone). I can't imagine a more massive data collection program, since each user must probably have more than 50 people on their device so the total amount of people that is affected exceeds my imagination. How can Google get such a pass?
- lofi_lory 6y ago
  I use Aurora for the Playstore. It's buggy but does the trick for the few apps not in FDroid. No account needed as they provide a service for shared credentials.
- vmateixeira 6y ago
  I feel you. Unfortunately, I don't think GDPR will be of much help on that case. A fine of up to 1% of they're revenue will hardly make a dent - it's just another tax. Misbehaviour will be still worth it. Actually GDPR is of great help to them, by putting smaller competitors away from using similar techniques. For those, a 1% revenue is a lot.
jimkleiber 6y ago
I have thought for a while about creating a contacts app for the phone that had much more privacy, almost like a Signal but specifically for the address book. Any thoughts on this?
danlugo92 6y ago
Paywalled

410 points by weinzierl 6y ago

The authors have an implementation of an improvement on these messengers' contact discovery algorithms at https://contact-discovery.github.io/ https://contact-discovery.github.io/

lucb1e 6y ago
That's an interesting project / paper[1]. I don't have the time to dive deeply into it and understand how this works, but at a glance it seems better than what I was working on a few months ago[2]. Does anyone else know more about this, since the paper is really written for the in-crowd? The video[3] helps a little for a very high-level overview (to give some context before starting to read), but doesn't explain how it works or what properties their algorithm has. [1] https://eprint.iacr.org/2019/517 https://eprint.iacr.org/2019/517 [2] This would do partial hash matching against a database on the server (similar to HIBP) and then do an interactive session with each of the matches, basically alternating sending the next binary bit of the phone number until either party gets it wrong or the value fully matched. The todo is to check whether there are parameters that make it both scale and protect privacy. [3] https://dro.pm/a.webm/preview https://dro.pm/a.webm/preview (link works for 18 hours after posting) or if you've already accepted the Google terms of service: https://www.youtube.com/watch?v=4vgKHmNaAAw https://www.youtube.com/watch?v=4vgKHmNaAAw

walterbell 6y ago

Wire (from the creators of Skype) does not mandate a mobile phone number (SIM cards are tied to government identity in many countries). Only an email address is required to open a free account. Nor does Wire mandate upload of your phone's address book with personal social graph of contacts. Free for consumers with paid teams offering for enterprises, optional on-prem server. Open-source clients and server. Cross-device history if the device logs in within a few weeks of the sent message. Basic export/import for moving your device's message archive to a new device of the same type. https://wire.com/download/ https://wire.com/download/ They are contributing to IETF MLS for end-to-end encrypted group messaging: https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/

zeitg3ist 6y ago
I didn’t login on Wire for 3 months and “for my security” messages that were sent to me during that time were just... lost. I think my history was deleted too. This happened 2 or 3 years ago, but it made me just switch to something else (Telegram).
- walterbell 6y ago
  For those who want end-to-end encrypted messages, it's a feature that the server doesn't have a persistent archive of message history. Wire messages are on the server for a few weeks, long enough to relay those messages to transiently offline devices. Telegram is great at what it does, different use case from Wire.
  - ajconway 6y ago
    Matrix does have end-to-end encrypted persistent history.
    - walterbell 6y ago
      Yes, it's possible. Depending on your threat model, it may or may not be a good idea to have a long-term archive of encrypted data be subject to legal process. Matrix has plans to support IETF MLS, which is a necessary precursor to messenger interoperability.
      - Arathorn 6y ago
        Matrix lets you configure the history retention on a per-server or per-room basis, fwiw: https://github.com/matrix-org/synapse/blob/develop/docs/message_retention_policies.md https://github.com/matrix-org/synapse/blob/develop/docs/mess.... From a metadata perspective, we're working on P2P to avoid metadata accumulating on servers. In terms of the OP here (address-book based contact discovery), https://github.com/matrix-org/matrix-doc/blob/hs/hash-identity/proposals/2134-identity-hash-lookup.md https://github.com/matrix-org/matrix-doc/blob/hs/hash-identi... is how Matrix optionally implements it while trying to preserve privacy.

random5634 6y ago

100% of signal scrapped - ugh

dotandimet 6y ago
Just as insecure as Whatsapp, just far fewer users.
- hiq 6y ago
  > Just as insecure as Whatsapp From the paper: > With its focus on privacy, Signal excels in exposing almost no information about registered users, apart from their phone number. In contrast, WhatsApp exposes profile pictures and the About text for registered numbers, and requires users to opt-out of sharing this data by changing the default settings.
Daniel_sk 6y ago
They have been too busy with integrating crypto payments instead of fixing long standing issues or planned features (allow to register without a phone number). But - to Signal's defense - while you can scrape the phone numbers, there is not much you can gain from it, you can only tell that a specific number is a Signal user. And sometimes you can see the username (if the user chooses to not encrypt it).
- walrus01 6y ago
  Given the re-use and re-issuance of phone numbers in very busy US area codes (like 212, 202, etc) it also only allows discovery that at some unknown point in the past, that number has been registered as a Signal user.

elyobo 6y ago

Happened with Australia's real time payment system too. https://www.itnews.com.au/news/monitoring-fail-allowed-westpac-payid-look-up-abuse-526135 https://www.itnews.com.au/news/monitoring-fail-allowed-westp...

wombatmobile 6y ago
I didn't know that. Thanks. I suppose the consequences for Westpac are... nothing.
- elyobo 6y ago
  As far as I know, no. I suspect that it wasn't just them.

deeplowdock 6y ago

Nice to see Telegram imposed strict limits for contact discovery. They were only able to scrape 100k numbers over 20 days. Strange that they keep and return metadata for non-registered numbers though.

deleted 6y ago
[deleted]

Jonnax 6y ago

There needs to be two lists of contacts. One which I allow to be shared with apps And another which are my contacts I use with my dialer. People don't need their messenger apps knowing the phone number of their doctor

jannes 6y ago
An alternative would be to make it similar to the iOS photo gallery permissions: When an app requests permission to all photos the user gets the option to share only a subset of photos with the app. (This subset can be different for each app.)
- furyg3 6y ago
  While I agree with you, the current way this functionality works is really terrible.
  - ratww 6y ago
    It's indeed terrible in Apps that reimplement the photo selecting feature, but in simpler Apps that just use the default picker it works quite well and it is transparent. Popular apps like WhatsApp, Twitter, Facebook, Telegram, etc, could just fall back to the default picker when full access is not available.
  - h0h0h0h0111 6y ago
    Agree - it's a great concept but seems to involve an inordinate number of clicks (touches?) all over the screen
tgv 6y ago
Or the number of the VD clinic, or the number of the an oncology ward, or the number of the pawnbroker, ...
hansel_der 6y ago
on ios if one does not grant addressbook permission for the app: * telegram uses an "internal" contact list for which one can add contacts via the desktop client and then works as expected. * whatsapp let's the user freely initiate contact by phone numbers, but then only shows the number (no name). don't know about signal.

ovi256 6y ago

In other parts of the world, users share their contact books to get access to what others shared, see Bellingcat's extensive use of these phone contact book apps, here documented in 2019: https://www.bellingcat.com/resources/how-tos/2019/04/08/using-phone-contact-book-apps-for-digital-research/ https://www.bellingcat.com/resources/how-tos/2019/04/08/usin...

jillesvangurp 6y ago

The practical consequence of this is that your phone number + name is public information. Almost as if it were listed in a phone book. That was pretty much the case already so it's not really a new threat. Of course people with unlisted numbers will be a bit annoyed by this. Likewise, your email address probably is part of numerous databases, including those owned by spammers/scammers. I'm not saying this is good. But merely that assuming otherwise was always a bit naive. Now in terms of GDPR and similar laws in the US, leaking information via a scrapable API is of course still a problem.

gnud 6y ago
My name/number is already pretty much public information, you can find it in various public registries if you search. But who I have in my contact list is _not_ public information. You can infer a lot from that. And the idiots who create these social apps always assume you want to "connect" with whoever is in your contact list. Even if you added their number so you know to _not_ pick up when they call.
elric 6y ago
Yeah ... no. I'm not sure what exactly gets shared with these apps, whether it's just the numbers or also the rest of the contact information. If names are being shared, that's a seriously fucked up nono. These parties are getting insights into our lives that are way beyond what is reasonable. Imagine I have 555-12345 in my contact list as "Wife" and someone else has the same number as "Girlfriend".
hiq 6y ago
> The practical consequence of this is that your phone number + name is public information. From the paper: > With its focus on privacy, Signal excels in exposing almost no information about registered users, apart from their phone number. In contrast, WhatsApp exposes profile pictures and the About text for registered numbers, and requires users to opt-out of sharing this data by changing the default settings. So if you only use Signal you don't leak the connection between your profile (which could contain your name) and your phone number, at least not until you accept a message from an attacker.

blorange 6y ago

"Interestingly, if the number provided by Hushed was previously registered by another user, the WhatsApp account is "inherited", including group memberships. A non-negligible percentage of the accounts we registered had been in active use, with personal and/or group messages arriving after account takeover." Did not know that taking over a WhatsApp account is that easy.

hiq 6y ago
You can set a pin which I think would reset your account eventually if you want to register the same number but fail to provide the correct pin, and the previous owner of the phone number does not use WhatsApp in some time.

blorange 6y ago

The most interesting section for me was "Exposed User Data". My takeaway is that an attacker can know whether my phone number is registered with Signal and can receive voice and video calls. They also get my encrypted name and profile picture but would need my explicit consent for that.

hiq 6y ago
That's my take as well, and I think that's already known by most users. So nothing new for Signal users. For WhatsApp it would be nice to change the defaults so that no information (other than the fact that the number is registered) is shared with no interaction.

captainmuon 6y ago

I think the information who is a contact of whom should not reside with the provider, but be distributed among the peers. I had a proof of concept of something similar working a couple years ago. I was writing a file-sharing app, and the goal was to piggy-pack on the existing social graph that you had from Facebook, Skype and so on. I could not register as a proper Facebook app, since that required having a domain, and I would be legally catchable in case somebody used my app to share copyrighted or illegal stuff. Back then, Facebook messenger was based on XMPP/Jabber, which allows sending custom stanzas (secret messages that are not shown to the user). My app would ask for your login, then send a message to every contact, and if it got a reply from another instance, it would perform a handshake and exchange keys. This also worked over (old) Skype, which although it didn't support XMPP, you could do something similar with SkypeAPI. (Unfortunately, a few months later almost every messaging service that allowed such a trick stopped it...) Now, this trick doesn't help if you are trying to set up a new social graph in the first place. But I think with this "send an invisible message to a potential contact's app" primitive, you could build a list of mutuals securely. (Other caveats apply, you'd let somebody know that you have their number for example...)

hiq 6y ago
> I think the information who is a contact of whom should not reside with the provider, but be distributed among the peers. Signal partially solves this with SGX. Partially because SGX will probably never be fully secure.

anthropodie 6y ago

I will criticize how Contacts are implemented on Android for this. For example, I don't want any person who I interact with once or twice a month to have access to my WhatsApp or any other social media app. But I can't do this in Android because once you add contact every damn app has access to that contact list. It's full access or no access if app uses permissions. I need something where I can label contacts to not appear in main contact list.

zibzab 6y ago
That is not correct. In Android you have two ways of accessing most things: full access or use the system to access one entry. You should blame WhatsApp for not supporting the second method.
- anthropodie 6y ago
  My point remains valid. If OS is handling contacts it should have some sort of control over what's getting shared. Theirs no point of providing alternate ways if an app can access full list of contacts.
  - viraptor 6y ago
    You need a migration path and backwards compatibility. They can't kill all the apps which used the old system.
    - MiddleEndian 6y ago
      They can just lie to the old apps. Tell them they're getting the full list when the API is called.
      - LeifCarrotson 6y ago
        "Yep, this user has exactly one contact, and gee, it happens to be the one they're calling now, how fortuitous! They had a different single contact yesterday, but apparently they've deleted that one and added this one."

williesleg 6y ago

Surprise!

jacquesm 6y ago

It didn't take long after the first social graph was created to realize that your contacts define you as much or even more than your other indicators do. That's why so many companies are gunning for this information.

TeMPOraL 6y ago
A quote I saw on the Internet long ago went, "You're the average of the five people spend the most time with". I used to interpret it only in its original, prescriptive sense: if you want to become a different person, make appropriate changes to your social life. It took me way too long to realize it's even more applicable in the descriptive sense: the people you spend most of your time with are a good statistical predictor of who you are.

_trampeltier 6y ago

I was wondering, what would happen, if I would add all the phone numbers from the Facebook leak to my contacts. Did anybody try something like this? What is the upper contact limit?

hansel_der 6y ago
> What is the upper contact limit? answer is in the paper

wombatmobile 6y ago

The reason this abuse of privacy is so widespread is because there are no bad consequences for the perpetrators. Governments don't enforce privacy acts in this circumstance. Users just roll their eyes, knowing there is no way for them to complain except though boycotts, which are difficult to organise and might not work unless coordinated on a massive scale which has never been tried. And so it goes.

Nextgrid 6y ago
And yet people are still bitching about the GDPR. The only problem with the GDPR is the lack of enforcement. However, it isn't really surprising considering a large chunk of this very community makes their money off large-scale stalking and the same unethical things they complain about.
- ryandrake 6y ago
  The only people really bitching about GDPR are software engineers and lawyers at companies whose privacy practices are still questionable after all the time given to clean up their act. That's why, if you look at HN comments, everyone seems to hate it. Sample bias. None of the remaining 7 billion people on the planet really know much about it. I bet if you summarize the regulation and describe it to a random person on the street, they'll nod and think "sure it's kind of a good idea" and forget about it in the next 10 seconds.

Andrew_nenakhov 6y ago

This scientifically-looking paper could have been written by Captain Obvious himself. It is beyond obvious that contact discovery in any major messenger or social network is facilitated by uploading all contacts from the user’s address book, with all the implied drawbacks. If users' behaviour has shown us anything, it's that they love it. And for all the dangers of their privacy loss, they happily trade it for the convenience of finding the people they know.

MattJ100 6y ago
"They love it" but they often aren't given the choice, nor are they fully aware of the consequences (I expect many would choose not to accept if the findings in this paper were presented to them in a clear understandable way). The average person barely knows what a server is. They install e.g. WhatsApp on their phone, they are likely to think that the app on their phone is doing the work of telling them who else is on WhatsApp. They are not likely to think that their contact list is being scraped and uploaded and stored on someone else's computer in a warehouse, and then profiled for advertising purposes and then exposed to strangers via an API. The average person may love the convenience, but the average person does not understand how it is implemented or the consequences of using such a service (as described in this paper).
- AshamedCaptain 6y ago
  In my experience, even after having made fully sure that they understand the risks involved, "the average person" will happily switch back to a walled garden IM platform the moment the next stupid feature comes in. Last time it was the (I think Whatsapp?) feature that allows, when replying to a message with an attached picture, to highlight a portion of the attached picture. That's it. There was no network effect at this point whasoever. This pseudo-feature was enough for an adult person to decide to switch back to Whatsapp and fuck my and everyone's privacy. THEN the network effect kicks in in favor of Whatsapp, because of course Whatsapp is a walled garden, so everyone is forced to switch to Whatsapp. I have seen this already happen several times network-wide and I will see it happen again. Non-walled garden IM networks are just set-up to lose.
6y ago

gnfargbl 6y ago

The paper claims that stricter rate limits are a possible solution to this issue, and that with stricter limits in place "crawling entire countries would only be feasible for very powerful attackers". I don't think I agree. Take Signal: the authors managed to crawl all US phone numbers in 25 days, using 100 accounts. Their proposed stricter rate limits force an approx 50x slowdown on an attacker (Table V), which seems to imply that over the same crawl period an attacker would require 5000 accounts. If we assume that virtual SMS numbers are around $5 each, then the attack now costs about $25k, which is about 0.001% the GDP of East Timor. They also propose a global salt as a mitigation. I'm a little confused there too, because wouldn't the salt need to be present in the endpoint application? If so it would be trivial to extract. Their proposal of using a key stretching hash algorithm (e.g. Argon2) seems reasonable? At a significant increase in cost on the server side.

hiq 6y ago
From the paper: > Signal acknowledged the issue of enumeration attacks as not fully preventable, So rate-limiting is fine as long as you don't hurt user experience, e.g. you can still message your contacts within 1min if you have around 500 contacts. It's also nice to lower the load on the servers. But there's no real fix as long as phone numbers are used. And it's fine, given that Signal basically leaks one bit of information: whether a phone number has a Signal account or not. ...of course, assuming that the account owner doesn't accept unsolicited messages (and thus shares their profile, with their picture and "About" field).

deleted 6y ago

[deleted]

upofadown 6y ago

People will complain about the meta-information leakage of email but then turn around and suggest we should instead use something based on your phone number[1]. I guess this is a reminder that phone number based contact discovery has issues as well ... perhaps worse ones in practice. With email the server operators know who is talking to who but do not necessarily know who any of those people are. Email clients will not show who has you in their contact list. There is no practical way to enumerate every active email address in use. [1] https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html https://latacora.micro.blog/2020/02/19/stop-using-encrypted....

egberts1 6y ago

Imagine my surprise when one can actually give up MORE revealing information about yourself and your contacts just by installing BOTH Telegram and Signal apps. Signal: when you’re most concerned about privacy of your message content. Telegram: when you’re most concerned about association with contacts. WhatsApp: when you’re most concerned about losing your ability to reach out and contact someone. Nothing is absolute. But don’t tell our politicians and lobbyists that. Oh wait.

anticensor 6y ago
Matrix: when you are most concerned about losing your message history.
- egberts1 6y ago
  which is probably the best sweet spot any privacy fan can aim for.

cpach 6y ago

Previous discussion: https://news.ycombinator.com/item?id=24494505 https://news.ycombinator.com/item?id=24494505

tediousdemise 6y ago

Your contact list seems like a pretty unique fingerprint with high entropy. It also persists across devices and accounts through common synchronization mechanisms. How many people in the world share the same contact list as you?

ISO-morphism 6y ago

Every time I open the Snapchat Android app it prompts me with a Snapchat-styled (not the system) dialog to share my contacts. Every time I hit "Don't allow". Every time it prompts me again. This is an inexcusable dark pattern. Two things need to happen: 1. The operating system needs to provide a "screw you, never" option for any permissions. 2. We as engineers need to say "screw you, never" to requests to implement behavior like this. Sure, this could be a bug, but I see the same behavior with Venmo and location access. Personally I'm rather disillusioned with where we've found ourselves. This sort of adversarial relationship in which people are property of a platform and treated as such is winning. Edit: Venmo had been set to "Only while using the app" and was prompting to enable location services on the device, not for permission. That's my own fault.

MrDresden 6y ago
The system does have a "screw you, never" option for all permissions. The issue is that Snapchat (in your case, as I don't have this happen on v11.23.3.36) is told that they wont get the permission and wont be able to ask for it either. And so they perform their own inhouse permission request to you. There is nothing that can be done from the system's point of view for that.
- ISO-morphism 6y ago
  > v11.23.3.36 v11.25.0.29 Beta for me > in house permission request That's what I had feared. I'd expand the scope of "the system" to include Play store rules.
  - MrDresden 6y ago
    It would change the ecosystem, for the better, if Google would uphold and enforce their policies as fiercly as Apple does. It would surely reduce the amount dark pattern predatory apps on the market place, and overall just pull the quality up a few notches. Why they haven't done so already is a mystery to me.
- hctaw 6y ago

rcMgD2BwE72F 6y ago

An even bigger problem: if you set up an Android phone without a Google account and need to access the Play Store (which is impossible to do without nowadays), Google will force you to sign into a Google account at the OS level and will suck in all your devices contacts -- with no opt out. You can disable this sync "feature" but *only after*, once Google has collected all your contacts (phone number, addresses, emails, birthdays, etc). Explanation: the toggle to opt out is made available after you log into Google and you must navigate in multiple screens which gives Google ample time to collect hundreds of contact details. Of course, it is not possible to turn on airplane mode during this procedure since the log in requires an Internet connection. This is 100% against the EU GDPR. I've submitted a complaint to my local privacy regular (French CNIL) but never heard back. This probably impacts 200+ hundreds millions of EU citizens (since 2/3 of the population must be using an Android phone). I can't imagine a more massive data collection program, since each user must probably have more than 50 people on their device so the total amount of people that is affected exceeds my imagination. How can Google get such a pass?

lofi_lory 6y ago
I use Aurora for the Playstore. It's buggy but does the trick for the few apps not in FDroid. No account needed as they provide a service for shared credentials.
vmateixeira 6y ago
I feel you. Unfortunately, I don't think GDPR will be of much help on that case. A fine of up to 1% of they're revenue will hardly make a dent - it's just another tax. Misbehaviour will be still worth it. Actually GDPR is of great help to them, by putting smaller competitors away from using similar techniques. For those, a 1% revenue is a lot.

jimkleiber 6y ago

I have thought for a while about creating a contacts app for the phone that had much more privacy, almost like a Signal but specifically for the address book. Any thoughts on this?

danlugo92 6y ago

Paywalled