8 ms·

Your Anonymous Posts to Secret Aren’t Anonymous After All

139 points by riaface 12y ago

relaxatorium 12y ago
A few friends of mine were actually talking about this last week. Apparently some folks in our social network (literal, friend based social network, not software-based) were using Secret to trash-talk (as is its purpose). It was immediately obvious who it was. When you don't know that many people who would even ever be on Secret, which is true right now about anybody who doesn't work in Silicon Valley, then it becomes almost completely transparent just because you know who your friends are. The anonymity model is a joke outside of the tech bubble.
probably_wrong 12y ago
> He turns the question back on me. If there was no Secret, or an app like it, where would this anonymous poster go for catharsis? Where would he share his struggle with mental illness? He could do it by snail-mail: http://postsecret.com/ http://postsecret.com/
- hownottowrite 12y ago
  Without a hint of sarcasm... How about with a doctor instead of random, faceless strangers? How about someone who can actually help?
  - valarauca1 12y ago
    Some mental illnesses make directly talking about the problem you have difficult. There is actually a large lack of anonymous therapeutic solutions for emotional and mental disorders for those who need them. Simply saying, "Use your brain and solve your problem." To a mental patient is very insulting and extremely marginalizing to their condition.
    - hownottowrite 12y ago
      I didn't suggest that they solve it on their own. Quite the opposite really. Following your logic, Secret is actually encouraging the very practice you called out as abhorrent.
      - pessimizer 12y ago
        Telling someone to just get help is about a hair's breadth away from telling someone to just get better.
        hownottowrite 12y ago
        No, telling someone to seek qualified help is the responsible thing to do whe one is unqualified to help. Providing untrained, unqualified, and anonymous help is both unethical and dangerous. If Secret staffed trained professionals to provide anonymous help, that would e different. They don't.
        pessimizer 12y ago
        >Providing untrained, unqualified, and anonymous help is both unethical and dangerous. It's also sometimes the only help that people will ever get. Talking to people about their problems can't be declared as forbidden or irresponsible unless mediated by a doctor. That's both unrealistic and it implies an initial unqualified diagnosis over the internet by a stranger to decide that a statement constitutes mental illness rather than a simple sharing of internal states - making an absolute statement like the one you're making self-contradictory. For example, I'm upset about a discussion that I had with my sister the other day. It makes me sad, and slightly worried. Should I continue to talk about it, or should I consult a doctor? If you answer that question, is it a diagnosis? Should all inter-human communications be routed through mental health professionals just in case?
        hownottowrite 12y ago
        If you're talking about the usual gripes and daily complaints, then sure, talk to whomever you want. If you're talking about serious mental illness, which was the entire point of this comment, then it needs to be handled by professionals or at least someone with basic training.
    - thinkpeace 12y ago
      It is not easy to talk about mental health issues or any other stigmatizing or threatening matter. That is one of the reasons why people take recourse to anonymous chat sites like Omegle and sharing apps like Secret. This leaves them even more vulnerable to attacks. However, there are startups like 7 Cups of Tea that go one step beyond and connect people anonymously with trained active listeners. If creating a support mechanism is not possible, a partnership with a provider of such service could help these anonymous networks. A responsible website/app must actively provide some amount of support to users. Tumblr has implemented it really well.
  - benjaminpv 12y ago
    In the United States many insurance plans don't include coverage for psychiatric help; you're forced to pay out-of-pocket. Perversely, many of the people with conditions that hamper them from earning much are the most in need of care. Lacking an "official" means of support, people are forced to find new ways to seek out help.
    - jedanbik 12y ago
      Actually in the US, mental health benefits are now a mandatory part of health insurance coverage. Which is great...if you have health insurance coverage.
      - dragonwriter 12y ago
        In the US, individual purchase of health insurance is now mandatory (and in some cases subsidized), except for individuals above the threshhold for government provided health-insurance through Medicaid [1]. [1] This isn't exactly true in the few states that haven't expanded Medicaid eligibility as provided for in the ACA, since in those states there is a gap.
      - pessimizer 12y ago
        It's important to note that people may not be aware of that because health care insurance has been in a bit of flux lately, to say the least, and there's been a lot of misinformation about the changes coming from a lot of directions.
        benjaminpv 12y ago
        This is definitely true for me: the last time (last year) we'd had a meeting regarding our insurances I specifically asked about mental health coverage and was given the information I'd mentioned above. I'll accept the downvotes for my ignorance, but I feel like underlying message is still true: there's undoubtedly a lot of people without coverage still and those people need to seek help elsewhere.
  - Gracana 12y ago
    That costs money and time and effort. Sometimes it's just nice to get something off your chest and move on.
    - mkal_tsr 12y ago
      PostSecret was made during a time when people didn't need an app for every function in their lives.
  - comrh 12y ago
    A doctor would be ideal but I know a lot of people who just needed some reassurance they were not alone or broken or weird before they could get up the courage to see someone.
    - hownottowrite 12y ago
      My reaction was to the struggle with mental illness portion of his reply. Daily issue? Sure. That makes sense.
- ZoFreX 12y ago
  Or by signing up to an anonymous account on Reddit (there are several good subreddits for people who suffer from mental illnesses such as r/depression), or any of a huge number of traditional forum sites for that purpose. Or there's always 4chan. Even in the app space Secret hasn't cornered the market, there's Whisper for example which doesn't ask for your email address and doesn't show you your friends' posts. It's ridiculous to claim that Secret is the only option for that person.
roywiggins 12y ago
> “It’s our job to make sure people feel safe and in control,” he says. So people just have to feel 'safe and in control,' rather than making sure they are actually safe and/or in control? It sounds like an admission that the whole anonymity thing is just a marketing gimmick: as long as you have a name like "Secret" and make people feel like they're safe, they'll share whether or not they have strong security at all.
- krapp 12y ago
  > It sounds like an admission that the whole anonymity thing is just a marketing gimmick: Post Snowden, there's an obvious market for "secure" and "anonymous" apps and startups, and the appearance of security is usually cheaper, quicker to implement and less annoying for end users than the real thing. Having a bug bounty is nice and obviously security is hard even when you do try, but even that can be used to give the appearance about being aggressive about security while still making sure their network is just broken enough to return whatever value there is in being 'social' (which is usually antithetical to being secure or anonymous.)
- higherpurpose 12y ago
  All such proprietary "anonymous" or "private/self-destructing" apps are guilty of this. By far the worst offender is Facebook's "anonymous login". But at least Facebook has a well deserved bad enough reputation by now that not too many people fall for that one. Secret, on the other hand, sounds like it could be truly anonymous - even if it's far from it.
- void-star 12y ago
  There's a term for that. It's called "having a false sense of security".
- Gracana 12y ago
  I think you're really reaching to find that meaning in Byttow's words.
  - bitJericho 12y ago
soneca 12y ago
I didn't see this news in HN, but in Brazil a judge forbidded the app stores to let brazilian users download Secret anymore. The app is being extensively used to bully people - non-authorized pics of naked people, messages with ofenses and etc. It was covered all over mainstream media and there is a consensus that it was a right decision (in this kind of press I mean). Edit: here a TechCrunch about it: http://techcrunch.com/2014/08/20/brazil-court-issues-injunction-against-secret-and-calls-for-app-to-be-remotely-wiped/ http://techcrunch.com/2014/08/20/brazil-court-issues-injunct... It was submitted to HN but got no comments or upvotes: https://news.ycombinator.com/item?id=8202444 https://news.ycombinator.com/item?id=8202444
- higherpurpose 12y ago
  The bigger story there is not that Brazil banned Secret, but that Google, Apple and Microsoft, all have the power to delete those apps from your device. That Orwellian power is the truly terrifying story there. And yes, personally, I've been aware for a while that they can do that, but I bet the vast majority of people don't know that. When will these companies learn that "if you build it (the infrastructure for censorship/surveillance), they (the governments) will come"? It's inevitable, and they should know better by now.
  - AndrewKemendo 12y ago
    That Orwellian power is the truly terrifying story there. Only if you somehow consider the app store and mobile infrastructure a public good, which is most certainly is not. There are open source/decentralized options that you are free to use.
    - sp332 12y ago
      Google doesn't have to literally be the government to wield power that only a government (or not even a government) should have.
      - mpyne 12y ago
hifier 12y ago
I could be wrong, but it seems that the way Secret is designed it cannot be truly anonymous. They need to be able to decrypt your secrets to show them to others, and they need to be able to associate them with your account to show them to you when you log in. This means that Secret knows who you are (to the extent that your login credentials reveal your identity) and what you've posted. If coerced or attacked there is no reason to believe that posts to Secret will in fact be kept a secret.
- coldcode 12y ago
  I'm not convinced there is any ultimate way to build a secret type app that allows for perfect secrecy. Ultimately anything build on top of the internet has a chain of IP address that have to exist in order to send message back and forth. Add a system with a server in the middle and it doesn't seem like there is any way to avoid someone (or a chain of someones) to figure out the far endpoint. If you can get at least some information leakage (cell phone connections, other IP accesses, etc) I would think you could eventually figure out the device on the other end. The only hope you have to keep the source secret is to make it too difficult or expensive to uncover so no one bothers.
  - josephagoss 12y ago
    Could something like ring signatures be used here?
  - pinkyand 12y ago
    It all depends on what are the powers your attackers have. If your attackers can monitor the whole web, inject packets as he wish and control every computer in the world - there probably isn't any way to offer secrecy. On the other hand, if we're talking about an adversary with a more limited capabilities - maybe he can access only 50% of the computers in the world and that cannot crack encryption at will - Than there are papers talking about theoretically sound systems that can give you anonymity with very high reliability.
  - Mimu 12y ago
    If they just store secret without anything else, that would be pretty hard to get back to the original author though. I don't know a lot about security, but if they remove the whole "linked friends" part, I would qualify it as safe. On the other hand I guess the whole point is knowing your friends secrets, not just people secrets.
kenjackson 12y ago
Secret should consider changing their algorithm. How about the following: You need at least 7 contacts that use Secret, but approximately half (or 1/3 or 1/4, whatever gives the best experience) of your messages will come from people NOT on your contact list. That is, most of the posts will be from people you don't know. But enough will be from your contacts to keep it personal...
- Pwntastic 12y ago
  Well there are two separate streams, people outside your circle, and people in/around your circle. So that would kind of defeat the purpose of the "friends" stream entirely.
- bentcorner 12y ago
  The allure of Secret is that you know that a given secret is from someone you know. Diluting the pool is harmful to that message. What they could do instead is only share secrets if you have N contacts in common. This solves the bot problem - the target will not add the bots. You could also have some sort of threshold before showing secrets as well. That said, I've never used Secret so this may or may not work. It'd be interesting to play with the Secret data to see how the social circles overlap and what kind of traffic patterns they see.
  - gus_massa 12y ago
    If you know N+1 contacts of X, then you create N+1 bots. Each bot has only N of the N+1 contacts. So, each bot receive the secrets from everyone except one person.
- ultrasaurus 12y ago
  It's still vulnerable to a binary search to find an author: create an account with the first half of your contacts and another with the second half, see which account has the secret (if it's in neither, it's from outside your network and you don't care) and repeat the process on that half. You'll figure the account with a dozen or two accounts created.
jrochkind1 12y ago
The thing about this particular attack is... it's pretty obvious, isn't it? I had never heard of this app before, but reading the article, as soon as they got to describing how it works (you give it emails/phone numbers of your friends, you only see secrets from them), I correctly guessed what the attack would be. Now, maybe it wouldn't have been obvious to me without the setup (there's been a successful attack, and now we're going to describe how Secret works like this, setting you up to understand the attack). But if Secret has security engineers, intimately familiar with their system, and trying to identify possible attacks -- how could they have not identified this? It makes one think the bug bounty program IS their security program. Which is probably true of much software, but this is software focused on secrets! On the other hand, maybe it just seems that obvious in retrospect? Apparently they have already given out 42 security bounties, and this one wasn't identified until now, so I dunno. It sure seems obvious though.
- ryandrake 12y ago
  It's not obvious in retrospect. It's obvious from the outset. I installed the app once to check it out. The first thing it asked for in order to proceed was an E-mail or phone number. Again, THE FIRST SCREEN REQUIRES PERSONAL INFO. It should be plainly obvious to anyone who gets past the first screen that your use of the app is not anonymous.
- kalleboo 12y ago
  Read the whole article. It was a known attack, their defense against it is dummy account/bot detection systems, and they claim that they were broken somehow due to an infrastructure upgrade which is why it worked for this guy.
  - psykovsky 12y ago
    That sounds like a bunch of excuses, if you ask me.
    - samspot 12y ago
      The why's always sound like excuses. If you don't want to hear excuses then don't ask why.
Sami_Lehtinen 12y ago
App is just extremely badly designed. If service is supposed to be anonymous it's good idea not to store any identifying information. If there's need to store some for legal reasons that can be encypted easily. So there's absolutely no way to recover it without the administrator. Even if the servers would be seized. Unfortunately world is full of such crappy broken by design services. Simply bad engineers and engineering does fail. That's how I do it. When you're anonymous use proxy tor and random wifi or anonymous clean cellphone. Even then be very careful about writing style analysis. Anyway it's worth of noting that absolutely nothing is private with Android or iPhones etc. If you're dealing with things which require privacy you're not using mainstream smart phone.
- fps 12y ago
  If they don't store identifiying information, the app can't perform it's main purpose, which is to share secrets _with people you know_. In fact, I don't think it's possible for this app to work without this vulnerability. For any set of rules they can provide, a set of sockpuppet accounts can be created to fulfill those rules and only track a single real person.
  - Rapzid 12y ago
    Yes, so say they make a rule like "You're account needs 5 friends and 20 secrets". So create a bunch of accounts with different sets of friends and find out where the intersections between friends and posted secrets are. Busted. This application is fundamentally flawed in it's current form. To even approach feasibility you would need to give people the power to view and approve emails that are following them. Then social circles would naturally form within the app along with a form of self governance.
thirdtruck 12y ago
This story is terrifying in the context of the recent attack on women game developers. To put the attack in contexts, imagine all the epitaphs you've heard playing FPS games online, but much worse. Then imagine having those slipped under the door of your home, scrawled over a Polaroid of you sleeping in your bedroom. Now imagine that you have no safe place to complain about this invasion of your privacy, but that you have to keep it constantly bottled up in yourself. That's a mild version of what these developers are facing.
- bitlord_219 12y ago
  I think you mean "epithets."
  - thirdtruck 12y ago
    Correct. I just hope that no actual epitaphs come of this nonsense.
jamieb 12y ago
"“The thing we try to help people acknowledge is that anonymous doesn’t mean untraceable,” says Byttow.
nikcub 12y ago
Anonymous application that users install on their phones that identify them, using their personal email addresses and real-life social networks turns out to not be so anonymous. mindblown.gif As was pointed out when Secret launched by many, the model can never be secret. It has been interesting to watch the company feel their way around in the dark to a conclusion that anybody in infosec or who understands security/anonymity could have told them before they launched.
pkfrank 12y ago
I tweeted this back on Feb 19 (https://twitter.com/PeterKimFrank/status/436186142950850560 https://twitter.com/PeterKimFrank/status/436186142950850560): .@getsecret Un-veiler-service: 1) Empty contacts 2) Re-add incrementally 3) Identify "secret" posters 4) ?? 5) Profit Seems way too obvious.
saurabhnanda 12y ago
was never into this app nonsense, but installed Secret a week ago because a VC chided me for not having it (and therefore not being able to connect, generally, with the new mobile masses). How do I delete all my account info along with the BS that I "anonymously" posted?

139 points by riaface 12y ago

A few friends of mine were actually talking about this last week. Apparently some folks in our social network (literal, friend based social network, not software-based) were using Secret to trash-talk (as is its purpose). It was immediately obvious who it was. When you don't know that many people who would even ever be on Secret, which is true right now about anybody who doesn't work in Silicon Valley, then it becomes almost completely transparent just because you know who your friends are. The anonymity model is a joke outside of the tech bubble.

probably_wrong 12y ago

> He turns the question back on me. If there was no Secret, or an app like it, where would this anonymous poster go for catharsis? Where would he share his struggle with mental illness? He could do it by snail-mail: http://postsecret.com/ http://postsecret.com/

hownottowrite 12y ago
Without a hint of sarcasm... How about with a doctor instead of random, faceless strangers? How about someone who can actually help?
- valarauca1 12y ago
  Some mental illnesses make directly talking about the problem you have difficult. There is actually a large lack of anonymous therapeutic solutions for emotional and mental disorders for those who need them. Simply saying, "Use your brain and solve your problem." To a mental patient is very insulting and extremely marginalizing to their condition.
  - hownottowrite 12y ago
    I didn't suggest that they solve it on their own. Quite the opposite really. Following your logic, Secret is actually encouraging the very practice you called out as abhorrent.
    - pessimizer 12y ago
      Telling someone to just get help is about a hair's breadth away from telling someone to just get better.
      - hownottowrite 12y ago
        No, telling someone to seek qualified help is the responsible thing to do whe one is unqualified to help. Providing untrained, unqualified, and anonymous help is both unethical and dangerous. If Secret staffed trained professionals to provide anonymous help, that would e different. They don't.
        pessimizer 12y ago
        >Providing untrained, unqualified, and anonymous help is both unethical and dangerous. It's also sometimes the only help that people will ever get. Talking to people about their problems can't be declared as forbidden or irresponsible unless mediated by a doctor. That's both unrealistic and it implies an initial unqualified diagnosis over the internet by a stranger to decide that a statement constitutes mental illness rather than a simple sharing of internal states - making an absolute statement like the one you're making self-contradictory. For example, I'm upset about a discussion that I had with my sister the other day. It makes me sad, and slightly worried. Should I continue to talk about it, or should I consult a doctor? If you answer that question, is it a diagnosis? Should all inter-human communications be routed through mental health professionals just in case?
        hownottowrite 12y ago
        If you're talking about the usual gripes and daily complaints, then sure, talk to whomever you want. If you're talking about serious mental illness, which was the entire point of this comment, then it needs to be handled by professionals or at least someone with basic training.
  - thinkpeace 12y ago
    It is not easy to talk about mental health issues or any other stigmatizing or threatening matter. That is one of the reasons why people take recourse to anonymous chat sites like Omegle and sharing apps like Secret. This leaves them even more vulnerable to attacks. However, there are startups like 7 Cups of Tea that go one step beyond and connect people anonymously with trained active listeners. If creating a support mechanism is not possible, a partnership with a provider of such service could help these anonymous networks. A responsible website/app must actively provide some amount of support to users. Tumblr has implemented it really well.
- benjaminpv 12y ago
  In the United States many insurance plans don't include coverage for psychiatric help; you're forced to pay out-of-pocket. Perversely, many of the people with conditions that hamper them from earning much are the most in need of care. Lacking an "official" means of support, people are forced to find new ways to seek out help.
  - jedanbik 12y ago
    Actually in the US, mental health benefits are now a mandatory part of health insurance coverage. Which is great...if you have health insurance coverage.
    - dragonwriter 12y ago
      In the US, individual purchase of health insurance is now mandatory (and in some cases subsidized), except for individuals above the threshhold for government provided health-insurance through Medicaid [1]. [1] This isn't exactly true in the few states that haven't expanded Medicaid eligibility as provided for in the ACA, since in those states there is a gap.
    - pessimizer 12y ago
      It's important to note that people may not be aware of that because health care insurance has been in a bit of flux lately, to say the least, and there's been a lot of misinformation about the changes coming from a lot of directions.
      - benjaminpv 12y ago
        This is definitely true for me: the last time (last year) we'd had a meeting regarding our insurances I specifically asked about mental health coverage and was given the information I'd mentioned above. I'll accept the downvotes for my ignorance, but I feel like underlying message is still true: there's undoubtedly a lot of people without coverage still and those people need to seek help elsewhere.
- Gracana 12y ago
  That costs money and time and effort. Sometimes it's just nice to get something off your chest and move on.
  - mkal_tsr 12y ago
    PostSecret was made during a time when people didn't need an app for every function in their lives.
- comrh 12y ago
  A doctor would be ideal but I know a lot of people who just needed some reassurance they were not alone or broken or weird before they could get up the courage to see someone.
  - hownottowrite 12y ago
    My reaction was to the struggle with mental illness portion of his reply. Daily issue? Sure. That makes sense.
ZoFreX 12y ago
Or by signing up to an anonymous account on Reddit (there are several good subreddits for people who suffer from mental illnesses such as r/depression), or any of a huge number of traditional forum sites for that purpose. Or there's always 4chan. Even in the app space Secret hasn't cornered the market, there's Whisper for example which doesn't ask for your email address and doesn't show you your friends' posts. It's ridiculous to claim that Secret is the only option for that person.

roywiggins 12y ago

> “It’s our job to make sure people feel safe and in control,” he says. So people just have to feel 'safe and in control,' rather than making sure they are actually safe and/or in control? It sounds like an admission that the whole anonymity thing is just a marketing gimmick: as long as you have a name like "Secret" and make people feel like they're safe, they'll share whether or not they have strong security at all.

krapp 12y ago
> It sounds like an admission that the whole anonymity thing is just a marketing gimmick: Post Snowden, there's an obvious market for "secure" and "anonymous" apps and startups, and the appearance of security is usually cheaper, quicker to implement and less annoying for end users than the real thing. Having a bug bounty is nice and obviously security is hard even when you do try, but even that can be used to give the appearance about being aggressive about security while still making sure their network is just broken enough to return whatever value there is in being 'social' (which is usually antithetical to being secure or anonymous.)
higherpurpose 12y ago
All such proprietary "anonymous" or "private/self-destructing" apps are guilty of this. By far the worst offender is Facebook's "anonymous login". But at least Facebook has a well deserved bad enough reputation by now that not too many people fall for that one. Secret, on the other hand, sounds like it could be truly anonymous - even if it's far from it.
void-star 12y ago
There's a term for that. It's called "having a false sense of security".
Gracana 12y ago
I think you're really reaching to find that meaning in Byttow's words.
- bitJericho 12y ago

soneca 12y ago

I didn't see this news in HN, but in Brazil a judge forbidded the app stores to let brazilian users download Secret anymore. The app is being extensively used to bully people - non-authorized pics of naked people, messages with ofenses and etc. It was covered all over mainstream media and there is a consensus that it was a right decision (in this kind of press I mean). Edit: here a TechCrunch about it: http://techcrunch.com/2014/08/20/brazil-court-issues-injunction-against-secret-and-calls-for-app-to-be-remotely-wiped/ http://techcrunch.com/2014/08/20/brazil-court-issues-injunct... It was submitted to HN but got no comments or upvotes: https://news.ycombinator.com/item?id=8202444 https://news.ycombinator.com/item?id=8202444

higherpurpose 12y ago
The bigger story there is not that Brazil banned Secret, but that Google, Apple and Microsoft, all have the power to delete those apps from your device. That Orwellian power is the truly terrifying story there. And yes, personally, I've been aware for a while that they can do that, but I bet the vast majority of people don't know that. When will these companies learn that "if you build it (the infrastructure for censorship/surveillance), they (the governments) will come"? It's inevitable, and they should know better by now.
- AndrewKemendo 12y ago
  That Orwellian power is the truly terrifying story there. Only if you somehow consider the app store and mobile infrastructure a public good, which is most certainly is not. There are open source/decentralized options that you are free to use.
  - sp332 12y ago
    Google doesn't have to literally be the government to wield power that only a government (or not even a government) should have.
    - mpyne 12y ago

hifier 12y ago

I could be wrong, but it seems that the way Secret is designed it cannot be truly anonymous. They need to be able to decrypt your secrets to show them to others, and they need to be able to associate them with your account to show them to you when you log in. This means that Secret knows who you are (to the extent that your login credentials reveal your identity) and what you've posted. If coerced or attacked there is no reason to believe that posts to Secret will in fact be kept a secret.

coldcode 12y ago
I'm not convinced there is any ultimate way to build a secret type app that allows for perfect secrecy. Ultimately anything build on top of the internet has a chain of IP address that have to exist in order to send message back and forth. Add a system with a server in the middle and it doesn't seem like there is any way to avoid someone (or a chain of someones) to figure out the far endpoint. If you can get at least some information leakage (cell phone connections, other IP accesses, etc) I would think you could eventually figure out the device on the other end. The only hope you have to keep the source secret is to make it too difficult or expensive to uncover so no one bothers.
- josephagoss 12y ago
  Could something like ring signatures be used here?
- pinkyand 12y ago
  It all depends on what are the powers your attackers have. If your attackers can monitor the whole web, inject packets as he wish and control every computer in the world - there probably isn't any way to offer secrecy. On the other hand, if we're talking about an adversary with a more limited capabilities - maybe he can access only 50% of the computers in the world and that cannot crack encryption at will - Than there are papers talking about theoretically sound systems that can give you anonymity with very high reliability.
- Mimu 12y ago
  If they just store secret without anything else, that would be pretty hard to get back to the original author though. I don't know a lot about security, but if they remove the whole "linked friends" part, I would qualify it as safe. On the other hand I guess the whole point is knowing your friends secrets, not just people secrets.

kenjackson 12y ago

Secret should consider changing their algorithm. How about the following: You need at least 7 contacts that use Secret, but approximately half (or 1/3 or 1/4, whatever gives the best experience) of your messages will come from people NOT on your contact list. That is, most of the posts will be from people you don't know. But enough will be from your contacts to keep it personal...

Pwntastic 12y ago
Well there are two separate streams, people outside your circle, and people in/around your circle. So that would kind of defeat the purpose of the "friends" stream entirely.
bentcorner 12y ago
The allure of Secret is that you know that a given secret is from someone you know. Diluting the pool is harmful to that message. What they could do instead is only share secrets if you have N contacts in common. This solves the bot problem - the target will not add the bots. You could also have some sort of threshold before showing secrets as well. That said, I've never used Secret so this may or may not work. It'd be interesting to play with the Secret data to see how the social circles overlap and what kind of traffic patterns they see.
- gus_massa 12y ago
  If you know N+1 contacts of X, then you create N+1 bots. Each bot has only N of the N+1 contacts. So, each bot receive the secrets from everyone except one person.
ultrasaurus 12y ago
It's still vulnerable to a binary search to find an author: create an account with the first half of your contacts and another with the second half, see which account has the secret (if it's in neither, it's from outside your network and you don't care) and repeat the process on that half. You'll figure the account with a dozen or two accounts created.

jrochkind1 12y ago

The thing about this particular attack is... it's pretty obvious, isn't it? I had never heard of this app before, but reading the article, as soon as they got to describing how it works (you give it emails/phone numbers of your friends, you only see secrets from them), I correctly guessed what the attack would be. Now, maybe it wouldn't have been obvious to me without the setup (there's been a successful attack, and now we're going to describe how Secret works like this, setting you up to understand the attack). But if Secret has security engineers, intimately familiar with their system, and trying to identify possible attacks -- how could they have not identified this? It makes one think the bug bounty program IS their security program. Which is probably true of much software, but this is software focused on secrets! On the other hand, maybe it just seems that obvious in retrospect? Apparently they have already given out 42 security bounties, and this one wasn't identified until now, so I dunno. It sure seems obvious though.

ryandrake 12y ago
It's not obvious in retrospect. It's obvious from the outset. I installed the app once to check it out. The first thing it asked for in order to proceed was an E-mail or phone number. Again, THE FIRST SCREEN REQUIRES PERSONAL INFO. It should be plainly obvious to anyone who gets past the first screen that your use of the app is not anonymous.
kalleboo 12y ago
Read the whole article. It was a known attack, their defense against it is dummy account/bot detection systems, and they claim that they were broken somehow due to an infrastructure upgrade which is why it worked for this guy.
- psykovsky 12y ago
  That sounds like a bunch of excuses, if you ask me.
  - samspot 12y ago
    The why's always sound like excuses. If you don't want to hear excuses then don't ask why.

Sami_Lehtinen 12y ago

App is just extremely badly designed. If service is supposed to be anonymous it's good idea not to store any identifying information. If there's need to store some for legal reasons that can be encypted easily. So there's absolutely no way to recover it without the administrator. Even if the servers would be seized. Unfortunately world is full of such crappy broken by design services. Simply bad engineers and engineering does fail. That's how I do it. When you're anonymous use proxy tor and random wifi or anonymous clean cellphone. Even then be very careful about writing style analysis. Anyway it's worth of noting that absolutely nothing is private with Android or iPhones etc. If you're dealing with things which require privacy you're not using mainstream smart phone.

fps 12y ago
If they don't store identifiying information, the app can't perform it's main purpose, which is to share secrets _with people you know_. In fact, I don't think it's possible for this app to work without this vulnerability. For any set of rules they can provide, a set of sockpuppet accounts can be created to fulfill those rules and only track a single real person.
- Rapzid 12y ago
  Yes, so say they make a rule like "You're account needs 5 friends and 20 secrets". So create a bunch of accounts with different sets of friends and find out where the intersections between friends and posted secrets are. Busted. This application is fundamentally flawed in it's current form. To even approach feasibility you would need to give people the power to view and approve emails that are following them. Then social circles would naturally form within the app along with a form of self governance.

thirdtruck 12y ago

This story is terrifying in the context of the recent attack on women game developers. To put the attack in contexts, imagine all the epitaphs you've heard playing FPS games online, but much worse. Then imagine having those slipped under the door of your home, scrawled over a Polaroid of you sleeping in your bedroom. Now imagine that you have no safe place to complain about this invasion of your privacy, but that you have to keep it constantly bottled up in yourself. That's a mild version of what these developers are facing.

bitlord_219 12y ago
I think you mean "epithets."
- thirdtruck 12y ago
  Correct. I just hope that no actual epitaphs come of this nonsense.

jamieb 12y ago

"“The thing we try to help people acknowledge is that anonymous doesn’t mean untraceable,” says Byttow.

nikcub 12y ago

Anonymous application that users install on their phones that identify them, using their personal email addresses and real-life social networks turns out to not be so anonymous. mindblown.gif As was pointed out when Secret launched by many, the model can never be secret. It has been interesting to watch the company feel their way around in the dark to a conclusion that anybody in infosec or who understands security/anonymity could have told them before they launched.

pkfrank 12y ago

I tweeted this back on Feb 19 (https://twitter.com/PeterKimFrank/status/436186142950850560 https://twitter.com/PeterKimFrank/status/436186142950850560): .@getsecret Un-veiler-service: 1) Empty contacts 2) Re-add incrementally 3) Identify "secret" posters 4) ?? 5) Profit Seems way too obvious.

saurabhnanda 12y ago

was never into this app nonsense, but installed Secret a week ago because a VC chided me for not having it (and therefore not being able to connect, generally, with the new mobile masses). How do I delete all my account info along with the BS that I "anonymously" posted?