4 ms·
Sorry, I'm really ignorant about these things, but once you have the ip of the phone that sent some message, couldn't you trace that to the physical phone? So y
by pyrois 12y ago
Sorry, I'm really ignorant about these things, but once you have the ip of the phone that sent some message, couldn't you trace that to the physical phone? So you want to know who posted "foobar", you wait until you have someone's user id that posted "foobar", and then use the IP address of the most recent outgoing message to identify the phone. Since there's typically one user per phone, won't that identify the user?
- tedks 12y agoYik Yak is an anonymous network, so a userID here is only on the device and not associated with any post. A user can't get the userID from a post.
- lotyrin 12y agoGet User ID, log in as user (no passwords), check "your" post history.
- tedks 12y agoLet's say you're the NSA. Edward Snowden posts "the NSA is spying on u" on yik yak. You see the yak on the Ft. Meade yak feed. How do you get Edward Snowden's yik yak userID? This post doesn't show anything that lets you do this from a posted yak.
- mikeash 12y agoDeploy the hack on the local network and grab the ID of every user. Then check each ID to see if they made that post. Of course, this requires either foresight or for Edward to keep posting afterwards, but neither is outlandish.
- tedks 12y agoThis assumes that Edward Snowden continues posting in the same geofence as well. Using a GPS spoofer, you can just pick a random geofence each time. Further, you can obtain a new userID just by reinstalling the app, so the information can be totally destroyed by the user as well. It's very hard to leverage this attack into anything more interesting than getting a userID banned.
- lnanek2 12y agoKnowing the IP is pretty useless. The closest you can get publicly if you know that is the general region, but this app is already a nearby radius app, so you already know that. If you have law enforcement powers you can try to get the subscriber info who was using that IP during that time period, but normal people don't have that ability. Even the article has to fall back to saying you have to just keep monitoring packets with that IP and hope the user uses some non-HTTPS web site that reveals their name. Although, honestly, most ISPs don't give you a static IP any more so the same user could be a different IP address multiple times a day.
- mintplant 12y agoAs demonstrated in the article, this gives you a local IP address which you could use to find the hostname of the device. For iOS devices, the hostname often contains the owner's name.