3 ms·
Exploiting silent delivery receipts to monitor users on instant messengers
- wakawaka28 11mo agoFull Title: "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers"
- rzl 11mo agoThis has been making the rounds in privacy-focused forums and whatnot and still no comment from the foundation. That doesn't inspire a lot of confidence in the Signal Foundation. If nothing else, I would expect that sending delivery receipts to invalid messages be considered a bug to fix, even if sending delivery receipts in general would be intentional.
- Stefan-H 11mo agoAn attacker with a privileged position on the network allowing them to eavesdrop (but not decrypt) traffic could use a bug like this to identify the device on the network associated with a phone number in Signal. Given nation state level adversaries, that seems like a significant privacy issue to me.
- 8cvor6j844qw_d6 11mo agoRelated reading. Might be of interest while on this topic. [1] https://www.pressherald.com/2024/02/29/the-fbis-new-tactic-catching-suspects-with-push-alerts/ https://www.pressherald.com/2024/02/29/the-fbis-new-tactic-c...