4 ms·

Cool writeup with some interesting techniques and approaches! I'll echo the other comments and say "deanonymization" is stretching the definition of the word,

Cool writeup with some interesting techniques and approaches! I'll echo the other comments and say "deanonymization" is stretching the definition of the word, along with "grab the user's location", as it isn't anything near precise. 150 miles is approx. a 2-hour drive on the highway from Atlanta, GA to Augusta, GA. In that radius, there's probably 700,000+ people. I do think the auto-retrieve attachment feature of Signal is slightly concerning, as for a private messenger I'd expect there to be an option to turn it off (like turning off JS in Tor). I don't know if I'm not looking deep enough, but there doesn't seem to be a feature for that. Signal appears to take a useful-by-default approach that balances privacy and ease-of-use in order to encourage adoption by the masses, I'd assume most people that are really concerned are hardening Signal, similar to what is in this guide: https://www.privacyguides.org/articles/2022/07/07/signal-configuration-and-hardening/#proxy-support https://www.privacyguides.org/articles/2022/07/07/signal-con... . They've always recommended a VPN / proxy + a modification of settings for more high-security scenarios. Caching isn't going anywhere, and neither is CloudFlare. The DoSing days of old in P2P multiplayer lobbies with exposed IPs seemed to carry more of a threat than this, CloudFlare's response seems to be the best out of the 3. Caching sensitive information is never recommended and the onus is on the application doing the communicating to tell their CDN / middle-service to not cache specific items.

vel0city 2y ago
You can disable the auto-download. Settings > Data and storage > Media auto-download, you can choose what to auto download for mobile data/wifi/roaming.
- alp1n3_eth 2y ago
  Thank you! That's what I get for quick scrolling through the settings. I for sure thought it would have been under Privacy (for this concern), but that makes sense too.
  - LWIRVoltage 2y ago
    So, just to confirm my understanding, if one goes into those settings and disables all auto-download, that helps- but, then a user will manually download images, correct? Are they still vulnerable to this issue then at that time?
    - vel0city 2y ago
      A user might download images and yes, if they download images Cloudflare will show which datacenters have cached that image. They might also install an APK you give them or run that taylor_swift_concert.mp4.exe as well. If I host an image on Cloudflare and put the URL here, I'll know which CF datacenters are near HN users who bother clicking the link as well.
  - jcul 2y ago
    Ah I made the same mistake. Whatsapp has this option and I'm pretty sure it is in privacy settings.
- tribby 2y ago
  it looks like it can’t be disabled for view-once media (or at least, that’s what the settings screen says)
  - vel0city 2y ago
    I wonder if view-once media is even handled the same way as a regular attachment (using CF) or is sent more like a regular message. I imagine if one really wanted it to be view-once, it wouldn't go to a CDN. Thanks for pointing this out!
    - jrochkind1 2y ago
      I think view-once media there means media hosted on signal servers, not remote servers? But not entirely sure.
      - vel0city 2y ago
        I'd love a hard answer to this if anyone knows or has time to look at the source code. https://github.com/signalapp https://github.com/signalapp
- gorfian_robot 2y ago
  hmm. I find the auto-download setting in the mobile app but not on desktop (mac). anyone know?
  - gorfian_robot 2y ago
    (some comments seem to suggest that the desktop app always auto-downloads)
giancarlostoro 2y ago
> "deanonymization" is stretching the definition of the word, along with "grab the user's location", as it isn't anything near precise. You'd think so, but you would be surprised how quickly this adds up to other details people share, like "oh I just drove 15 minutes to get Starbucks" or something to that effect, small things that eventually add up to a precise location over time.
- alp1n3_eth 2y ago
  > you would be surprised how quickly this adds up Yes, but if social engineering is involved and tracing back through user conversations across a platform, it's hardly a vulnerability, let alone one deserving of a bounty. The way this is currently functioning is intended functionality, and can be further locked down depending on the user's threat model. This can essentially be classified as opsec failure for the Signal user. If they're trying to hide from a hit in a 300 mile radius, they've got bigger problems to worry about, and should already be using a VPN setup. Every time you click on a link your external IP addresses is exposed, is this a vulnerability? Being online without a VPN / proxy is inherent consent to have your external IP & other required items to be shared with services / middlemen. When it comes to Discord, if you have this strict of a threat model and you're still using it, idk what to tell you.
  - hmottestad 2y ago
    If I can send you a link and be guaranteed that you click on it. Then that’s definitely a security issue.
    - Aachen 2y ago
      Then it's a good thing that this isn't being claimed
      - hmottestad 2y ago
        The comment says: Every time you click on a link your external IP addresses is exposed, is this a vulnerability? Being online without a VPN / proxy is inherent consent to have your external IP & other required items to be shared with services / middlemen. The fact that a user's IP is exposed when they click on a link is only relevant to the original post if a user would do this automatically and without realizing. The original post alleges that they can send someone a message on Signal and have the user automatically and somewhat unknowingly load a resource from a server. Sure, the author doesn't claim they have much control over the resource or the server, but they do show how you can check which server the user accessed and how that leaks information about the location of the user to a certain extent.
why_only_15 2y ago
Random unrelated point: in a 100km radius circle between Atlanta and Augusta there are ~2,000,000 people (calculated using https://www.tomforth.co.uk/circlepopulations/ https://www.tomforth.co.uk/circlepopulations/ )
- alp1n3_eth 2y ago
  Haha thank you for doing the math! I was lazy and just added the populations and a plus at the end.

vel0city 2y ago

You can disable the auto-download. Settings > Data and storage > Media auto-download, you can choose what to auto download for mobile data/wifi/roaming.

alp1n3_eth 2y ago
Thank you! That's what I get for quick scrolling through the settings. I for sure thought it would have been under Privacy (for this concern), but that makes sense too.
- LWIRVoltage 2y ago
  So, just to confirm my understanding, if one goes into those settings and disables all auto-download, that helps- but, then a user will manually download images, correct? Are they still vulnerable to this issue then at that time?
  - vel0city 2y ago
    A user might download images and yes, if they download images Cloudflare will show which datacenters have cached that image. They might also install an APK you give them or run that taylor_swift_concert.mp4.exe as well. If I host an image on Cloudflare and put the URL here, I'll know which CF datacenters are near HN users who bother clicking the link as well.
- jcul 2y ago
  Ah I made the same mistake. Whatsapp has this option and I'm pretty sure it is in privacy settings.
tribby 2y ago
it looks like it can’t be disabled for view-once media (or at least, that’s what the settings screen says)
- vel0city 2y ago
  I wonder if view-once media is even handled the same way as a regular attachment (using CF) or is sent more like a regular message. I imagine if one really wanted it to be view-once, it wouldn't go to a CDN. Thanks for pointing this out!
  - jrochkind1 2y ago
    I think view-once media there means media hosted on signal servers, not remote servers? But not entirely sure.
    - vel0city 2y ago
      I'd love a hard answer to this if anyone knows or has time to look at the source code. https://github.com/signalapp https://github.com/signalapp
gorfian_robot 2y ago
hmm. I find the auto-download setting in the mobile app but not on desktop (mac). anyone know?
- gorfian_robot 2y ago
  (some comments seem to suggest that the desktop app always auto-downloads)

giancarlostoro 2y ago

> "deanonymization" is stretching the definition of the word, along with "grab the user's location", as it isn't anything near precise. You'd think so, but you would be surprised how quickly this adds up to other details people share, like "oh I just drove 15 minutes to get Starbucks" or something to that effect, small things that eventually add up to a precise location over time.

alp1n3_eth 2y ago
> you would be surprised how quickly this adds up Yes, but if social engineering is involved and tracing back through user conversations across a platform, it's hardly a vulnerability, let alone one deserving of a bounty. The way this is currently functioning is intended functionality, and can be further locked down depending on the user's threat model. This can essentially be classified as opsec failure for the Signal user. If they're trying to hide from a hit in a 300 mile radius, they've got bigger problems to worry about, and should already be using a VPN setup. Every time you click on a link your external IP addresses is exposed, is this a vulnerability? Being online without a VPN / proxy is inherent consent to have your external IP & other required items to be shared with services / middlemen. When it comes to Discord, if you have this strict of a threat model and you're still using it, idk what to tell you.
- hmottestad 2y ago
  If I can send you a link and be guaranteed that you click on it. Then that’s definitely a security issue.
  - Aachen 2y ago
    Then it's a good thing that this isn't being claimed
    - hmottestad 2y ago
      The comment says: Every time you click on a link your external IP addresses is exposed, is this a vulnerability? Being online without a VPN / proxy is inherent consent to have your external IP & other required items to be shared with services / middlemen. The fact that a user's IP is exposed when they click on a link is only relevant to the original post if a user would do this automatically and without realizing. The original post alleges that they can send someone a message on Signal and have the user automatically and somewhat unknowingly load a resource from a server. Sure, the author doesn't claim they have much control over the resource or the server, but they do show how you can check which server the user accessed and how that leaks information about the location of the user to a certain extent.

why_only_15 2y ago

Random unrelated point: in a 100km radius circle between Atlanta and Augusta there are ~2,000,000 people (calculated using https://www.tomforth.co.uk/circlepopulations/ https://www.tomforth.co.uk/circlepopulations/ )

alp1n3_eth 2y ago
Haha thank you for doing the math! I was lazy and just added the populations and a plus at the end.