5 ms·

Strava has suffered from this and had known attacks for 10+ years now. There was a famous case around Colorado of a mistaken doxxing attack driven by Reddit.

Strava has suffered from this and had known attacks for 10+ years now. There was a famous case around Colorado of a mistaken doxxing attack driven by Reddit. Due to mistaken identity, attackers pursued an innocent victim using their Strava account. The Strava location was the cause of both the mistaken identity case and abused to find and dox the victim. Strava’s anonymization algorithm (the bubble feature) is primitive and trivially de-anonymized with basic triangulation. The company has never adequately responded to privacy concerns despite many abuse cases.

paganel 2y ago
People should just stop using Strava, or at least stop making their Strava data public to the world (not sure if that's an option cause I've never used that app). They should just run/cycle, whatever, forget about gps.
- loeg 2y ago
  > not sure if that's an option cause I've never used that app You can make your account private, or individual activities private (including by default).
- tonymet 2y ago
  Strava doesn’t even know who has access. They seem to be doing little to know auditing of security access.
loeg 2y ago
> Strava’s anonymization algorithm (the bubble feature) is primitive and trivially de-anonymized with basic triangulation. That is not true. It picks a single random centroid near your privacy location and does the privacy feature based on that. Triangulation finds the random centroid, which is crucially not your hidden location.
- mariusor 2y ago
  That's something I didn't know, but even like that, it narrows down the area.
  - loeg 2y ago
    Sure, but it's pretty obvious that exposing most of your activity except for the start and end location will do that. Strava allows you to choose the hidden radius from a range of values between 1/8 mile and a full mile. That's a pretty wide area. (And you can always make specific activities or your entire account private.) Anyway, I think true claims make for much more interesting criticism than false claims.

paganel 2y ago

People should just stop using Strava, or at least stop making their Strava data public to the world (not sure if that's an option cause I've never used that app). They should just run/cycle, whatever, forget about gps.

loeg 2y ago
> not sure if that's an option cause I've never used that app You can make your account private, or individual activities private (including by default).
tonymet 2y ago
Strava doesn’t even know who has access. They seem to be doing little to know auditing of security access.

loeg 2y ago

> Strava’s anonymization algorithm (the bubble feature) is primitive and trivially de-anonymized with basic triangulation. That is not true. It picks a single random centroid near your privacy location and does the privacy feature based on that. Triangulation finds the random centroid, which is crucially not your hidden location.

mariusor 2y ago
That's something I didn't know, but even like that, it narrows down the area.
- loeg 2y ago
  Sure, but it's pretty obvious that exposing most of your activity except for the start and end location will do that. Strava allows you to choose the hidden radius from a range of values between 1/8 mile and a full mile. That's a pretty wide area. (And you can always make specific activities or your entire account private.) Anyway, I think true claims make for much more interesting criticism than false claims.