57
Anyone can track WhatsApp and Signal users' activity, knowing only their phone number: "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers" (arxiv.org)
submitted 10 months ago by to c/privacy@lemmy.ml
7 comments fedilink hide all child comments
 

This is a year-old paper but now there is an easy-to-use implementation of the attack: https://github.com/gommzystudio/device-activity-tracker

Signal developers' verdict is WONTFIX: https://github.com/signalapp/Signal-Android/pull/14463

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 15 points 10 months ago* (2 children)

You can literally turn off read receipts in signal

But you can't turn off delivery receipts, which is what this attack uses.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 10 months ago (1 child)

    But you can turn off sealed sender messages from anyone, so they'd have to already be a trusted contact

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 13 points 10 months ago

    But you can turn off sealed sender messages from anyone, so they’d have to already be a trusted contact

    The setting to mitigate this attack (so that only people who know your username can do it, instead of anybody who knows your number) is called Who Can Find Me By Number. According to the docs, setting it to nobody requires also setting Who Can See My Number to nobody. Those two settings are both entirely unrelated to Signal's "sealed sender" thing, which incidentally is itself cryptography theater, btw.

  • permalink
  • fedilink
  • source
  • parent