5 ms·
Strava was used to locate the most powerful people
- kjrfghslkdjfl 2y agoFitoTrack. That's all I have to say about this.
- harry8 2y agoI also endorse FitoTrack on droid as a user. Along with Out-Run on iphone. Both work well and are pleasant to use. Record your exercise for yourself with no cloud.
- abetusk 2y agoStrava is a fitness app. So, apprently, the security detachment of political figures tends to use the app, presumably because they're into fitness and keep in shape, and their location can be tracked through the app. As the security detachment tend to travel with the people they protect, political leaders locations can be inferred. The article talks about body guards not being allowed to use social media/apps while on the job, they allow for provisions on use when not on active duty. So, I guess, the guards get a day off, use the app, wherever they are, broadcasting their location. Crazy stuff.
- netsharc 2y agoYeah, the targetting isn't that difficult, I guess. If you know crown prince Akeem Joffer was in New York 5 days ago, and is in Paris 3 days ago, you can probably diligently query Strava users who weren't in New York for a long time but showed up 5 days ago, and see if they showed up in Paris 3 days ago, and boom, you've found a member of his entourage. Even if they use the anonymizing feature that masks their start/end points, if you find a few other members, you could be able to triangulate a big hotel near them and guess that that's where the crown prince stayed... and the next time you hear he's coming to NY/Paris, you have this information.
- kkielhofner 2y agoShouldn't be much of a surprise, this made news back in 2018 when the same was realized with soldiers and secret military bases: https://www.theguardian.com/world/2018/jan/28/fitness-tracking-app-gives-away-location-of-secret-us-army-bases https://www.theguardian.com/world/2018/jan/28/fitness-tracki...
- loeg 2y agoMore specifically, it's a social network for sharing workout data. Sharing data is like, first and foremost what it's about. It has the same privacy controls you'd expect of social networks (public/friends/private both globally and per post/activity) as well as some that are special to a location-sharing app (hidden addresses). This was either a gap in social media policy set for the guards, or a violation of that policy on the part of the guards.
- mandevil 2y agoCell phone tracking is better at surveillance than the best stuff the military has. https://www.washingtonpost.com/national-security/2024/02/22/ukraine-war-pentagon-lessons-learned/ https://www.washingtonpost.com/national-security/2024/02/22/... has a fun story about a time at Fort Irwin (US Army laser tag in the desert) one side couldn't figure out how an attack helicopter got through their defenses, until they did some queries on a commercial cell phone tracking database and found the cellphone moving across the desert at 120mph. Hole identified, plugged for the next round. And also talks about how the Ukrainians and Russians are having a great deal of trouble with cell phone OPSEC even after years of shooting war.
- taeric 2y agoProbably not better than the best stuff the military has... Still really good, mind. And, yeah, unintended uses are usually prime locations for security breaches. For a long time (maybe still?) metadata on pictures that people post would reveal far more than people meant. Thumbnails of cropped pictures, even.
- FactKnower69 2y ago>Probably not better than the best stuff the military has... Military tech is always a decade ahead of civilian, that's why the US has easily won every armed conflict they've entered into in the past 50 years
- chatmasta 2y agoI’m not sure this has been true since the advent of the internet. I don’t believe there’s an entire shadow sphere of academia that is decades ahead of what’s openly published. For nuclear energy, this might be true. But for nearly any other topic I’m very skeptical.
- JohnMakin 2y agoI know for a fact that swaths of critical military infrastructure sit in AWS, so I personally doubt this is true.
- mikeryan 2y agoAlong these lines some cyclists have had their gear stolen by thieves who figured out where they live from Strava data. They have a feature to block part of your route when near your home but some folks aren’t aware of it (or learn the hard way)
- nickff 2y agoThat feature is fairly recent, and I believe it is now enabled by default.
- hondo77 2y agoIf by "is fairly recent" you mean "has been around for over six years", yes.
- xarope 2y agoIsn't it only a few 100 yards worth? So thieves can still camp out in a 1 square mile area to find that nice carbon fiber bike at 5am in the morning?
- loeg 2y agoYou can select a radius of 1/8 to 1 mile.
- mariusor 2y agoFrankly the blocking is a radius around the start and stop points. If they are both at your doorstep, all your rides will extrapolate to points on a circle with a center very easy to determine. The feature as it is, is snake oil for someone determined enough. I started to start and stop my rides some distance out, just to add some variation.
- loeg 2y agoThe hidden address feature picks a random centroid near your hidden address, not exactly on it. Averaging out the circle finds that random centroid, not your hidden address.
- slibhb 2y agoWas there a breach with Strava or did people simply choose to publish their location publicly?
- basiccalendar74 2y agonot a data breach
- pndy 2y agoThey recently introduced "Athlete Intelligence" [1][2] feature that wasn't received well by users so I'd guess this is a pr stunt so people would forget about it [1] - https://www.forbes.com/sites/cyrusfarivar/2024/10/12/strava-upsets-fans-with-new-ai-feature-that-promises-insights-but-provides-bland-pep-talks/ https://www.forbes.com/sites/cyrusfarivar/2024/10/12/strava-... [2] - https://communityhub.strava.com/t5/strava-features-chat/opt-out-of-ai-features/m-p/41483 https://communityhub.strava.com/t5/strava-features-chat/opt-...
- orwin 2y agoThe original find is from Le Monde. It's not a leak, just usual investigations.
- sam_lowry_ 2y agoThe problem with Strava is how invasive their location sharing is. One has to actively search to disable it. And the integrations with Garmin Connect and the others are even worse.
- notatoad 2y agoit's not "invasive", it's a location sharing app. if you don't want to share your location, you probably should not use location-sharing apps.
- RobRivera 2y agoA fitness app that features location-sharing features. When I think of location sharing apps, I think of garmin inreachme for search amd rescue.
- blackeyeblitzar 2y agoWhat’s the point of Strava? Can’t people easily cheat on the results to outcompete others? Like what happens if I use an e-bike to beat the best times?
- r00fus 2y agoStrava is a social app with a gamification angle. I use the social to share my rides (only) with people who follow me and to view people I follow to get inspired. I also use the gamification to compete - but really only against myself.
- jerlam 2y agoThere is no reward for getting the best time. Also, the people that you beat are extremely motivated to investigate and flag your activity; it will look pretty obvious that it was ridden on an e-bike due to incorrect / missing data like heart rate and wattage. I have the record on a short inconsequential running course near me. I occasionally get a notification that someone beat my record and I am forced to look at it; it is always someone on a bike or car, and I flag it and it eventually goes away. Also, my own record activity has been flagged multiple times despite it only being slightly faster than the second place finisher - I no longer bother trying to contest it. The joke is on the flagger since I have run the exact same record time, several times, so I still have the course record.
- bigiain 2y agoNot everyone is as chill about that as you. https://www.forbes.com/sites/kashmirhill/2012/06/20/a-quantified-self-fatality-family-says-cyclists-death-is-fault-of-ride-tracking-company-strava/ https://www.forbes.com/sites/kashmirhill/2012/06/20/a-quanti...
- recursive 2y agoIt's even possible to do dumb stuff in pursuit of a personal best without using an app at all. But it should be noted that the Strava user in question doesn't seem to have been cheating. For some reason, they were trying to set a legitimate score in an ill-advised way. There's no evidence here that cheating in Strava is a problem. Is Strava promoting unsafe riding? Maybe. I don't really think so. But it's not connected to the cheating question.
- netsharc 2y agoIn video form (the Guardian article talks about a Le Monde investigation): - Pt 1: https://www.youtube.com/watch?v=4eQKnV0zsMc https://www.youtube.com/watch?v=4eQKnV0zsMc - Pt 2: https://www.youtube.com/watch?v=KX7f1PwXEWg https://www.youtube.com/watch?v=KX7f1PwXEWg
- homarp 2y agohttps://www.lemonde.fr/en/international/article/2024/10/29/putin-s-bodyguards-go-on-runs-near-palace-he-denies-owning-stravaleaks-episode-3_6730915_4.html https://www.lemonde.fr/en/international/article/2024/10/29/p...
- netsharc 2y agoZelensky has suddenly perked up... The 2nd video focuses on the US Secret Service, finding 26 profiles of Biden's protection (and 100+ users who were geolocated inside the S.S. training facility). During the credits of that video, a journalist says, "Despite our warning about this issue to the US authorities, 14 of the 26 profiles are still public."
- r00fus 2y agoThis is why I only use Strava to share with my followers. Yes, it's an extra step after my workout to edit, add pics if any, choose my activity level if I was too lazy to put on my HR monitor, and then only post to my followers. Yes, this means I get less likes and can't participate in challenges etc. But it's really about sharing with my colleagues and friends so they can motivate me for my next ride.
- marcellus23 2y agoYou can set your activities to be private by default, you don't need to change it for every activity individually after you upload it.
- r00fus 2y agoYes, mine are. I explicitly share some activities.
- zardo 2y ago> This is why I only use Strava to share with my followers. You travel with one of the most powerful people in the world?
- tonymet 2y agoI wouldn’t trust their security restrictions. Their API and authentication is primitive. For a while I ran a basic bot to automate data extraction. Their security is 20+ years behind other social networks . You likely have bot followers and API calls that can read your latest activity GPX data
- OgsyedIE 2y agoThe simplest solution to this is bureaucratic. Establish an app approval cybersecurity office within some agency and have the office make two lists: apps that have specific security configurations that need to be enabled and apps that are outright banned. Then you just make compliance with the lists necessary for certain security clearances.
- Muromec 2y agoNononon, you make one list: - apps that are allowed to be installed, pinned by version with a person responsible for monitoring them
- tonymet 2y agoStrava has suffered from this and had known attacks for 10+ years now. There was a famous case around Colorado of a mistaken doxxing attack driven by Reddit. Due to mistaken identity, attackers pursued an innocent victim using their Strava account. The Strava location was the cause of both the mistaken identity case and abused to find and dox the victim. Strava’s anonymization algorithm (the bubble feature) is primitive and trivially de-anonymized with basic triangulation. The company has never adequately responded to privacy concerns despite many abuse cases.
- paganel 2y agoPeople should just stop using Strava, or at least stop making their Strava data public to the world (not sure if that's an option cause I've never used that app). They should just run/cycle, whatever, forget about gps.
- loeg 2y ago> Strava’s anonymization algorithm (the bubble feature) is primitive and trivially de-anonymized with basic triangulation. That is not true. It picks a single random centroid near your privacy location and does the privacy feature based on that. Triangulation finds the random centroid, which is crucially not your hidden location.
- mariusor 2y agoThat's something I didn't know, but even like that, it narrows down the area.
- TrevorJ 2y agoNot sure if the format for this article is standard these days, but oh man do I hate it.
- davidsawyer 2y agoReads like a remix of how Axios articles are.
- cj 2y agoRelated: Strava heatmap can be used to locate military bases - https://news.ycombinator.com/item?id=16249955 https://news.ycombinator.com/item?id=16249955 - Jan 2018 (271 comments) Turns out soldiers enjoy tracking their runs around the base!
- aynyc 2y agoStrava deserves all the blames it get, but don't you need some serious skills to find out who are the agents guarding Biden/Harris/Trump? I mean, if you can literally track down the names of Secret Service agents guarding VIPs, then you can probably easily track them with other means (phone for example) no? Speaking out of most likely ignorance of Secret Service, I was in the US Marines. I dealt with marine snipers a few times during training exercises, we were mainly serve as security protections. I've seen them train, shoot and handle combat scenarios. If any of those marine snipers want to take shot at a VIP, I can't imagine Secret Service will be able to do anything to stop it. Some of the snipers are putting rounds into a postal stamp at 1,000 yard / 900 meters.
- loeg 2y ago> Strava deserves all the blames it get Not sure why Strava deserves any blame here. It's explicitly a social network for sharing your location and other training data. If you use it and share your location, that's it functioning exactly as designed.
- MR_Bulldops 2y agoStrava has (rightfully) received no blame, so they were accidentally right!
- loeg 2y agoIt's pretty clear that at least some users in this thread blame Strava for some things.
- TheRealPomax 2y agoI guess strava users didn't learn from the first time.
- tedunangst 2y agoWas the Biden Xi meeting supposed to be a secret? I think it's generally not difficult to locate the president.
- wslh 2y agoOther sources: Haaretz Investigation: Intelligence Operation Collected Information on Sensitive Israeli Bases, Soldiers <https://www.haaretz.com/israel-news/security-aviation/2024-10-29/ty-article-magazine/.premium/intelligence-operation-collected-information-on-sensitive-israeli-bases-soldiers/00000192-d7bb-df2b-a5db-d7bf8d440000 https://www.haaretz.com/israel-news/security-aviation/2024-1...> <https://archive.is/2024.10.29-113518/https://www.haaretz.com/israel-news/security-aviation/2024-10-29/ty-article-magazine/.premium/intelligence-operation-collected-information-on-sensitive-israeli-bases-soldiers/00000192-d7bb-df2b-a5db-d7bf8d440000 https://archive.is/2024.10.29-113518/https://www.haaretz.com...>