4 ms·
> The API allows an application to check if a mobile device is in proximity of a given location. The API request contains the location to be checked and an accu
by barbazoo 3y ago
> The API allows an application to check if a mobile device is in proximity of a given location. The API request contains the location to be checked and an accuracy range in km (between 2km and 200km). The API response indicates whether the location is within the accuracy range of the last known location of the MSISDN.
I'd say this can only "give away" the location if you already roughly know where someone is AND no rate limit exists.
- legulere 3y agoWith adjustable accuracy range you can do binary search to find out where someone is.
- PreInternet01 3y agoWhich is where API rate limits come in. But if you really need to know where someone is, today, just be a telco with its own mobile infrastructure, and you can pretty much query the current network+cell ID of any of your subscribers without any limitations. Same goes for anyone with, say, subpoena powers in your jurisdiction and/or sufficient (social) engineering skills. And cell ID to geo mapping is also a solved problem...
- mplewis 3y agoAPI rate limits don't keep you from doing the nasty stuff when you want to target one specific individual.
- barbazoo 3y agoDepends on the limit and how it's implemented
- wolpoli 3y agoEven if API rate limit exists and is strictly enforced, it's also easy to bypass it with multiple API keys and over time. Most people adhere to a weekly schedule.
- Koffiepoeder 3y agoRate limits can also be based on the message contents, e. g. max 20 lookups per day for a cell.
- wongarsu 3y agoAssuming you already know what continent somebody is on, 20 circles of 200km radius (120 miles) should cover most of the major population centers. If you live out in Nebraska or the middle of the Sahara this attack is easy to defend against, but humans tend to clump up.
- zamadatix 3y agoSounds like a great way to DoS someone out of being able to use their banking app.
- barbazoo 3y ago> AND no rate limit exists.
- downrightmike 3y agoYeah, the apple air tags do something similar, the more devices the more accurate the location
- m4rtink 3y agoSounds like you can just easily triangulete someone using this API.