This is a year-old paper but now there is an easy-to-use implementation of the attack: https://github.com/gommzystudio/device-activity-tracker
Signal developers' verdict is WONTFIX: https://github.com/signalapp/Signal-Android/pull/14463
Anyone can track WhatsApp and Signal users' activity, knowing only their phone number: "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers"
https://arxiv.org/abs/2411.11194
9 Comments
juko_kun@sh.itjust.works · 5 pts · 249d
Is there any reason to use Signal over Matrix?
tomenzgg@midwest.social · 7 pts · 249d
https://soatok.blog/2024/08/14/security-issues-in-matrixs-olm-library/
This is the most strongly written writeup I know of (whether it's something you, likewise, find worth being wary about is, naturally, up to you, though).
Screen_Shatter@lemmy.world · 4 pts · 249d
I remember trying to sign up for signal and stopped when it wanted my phone number. It's no longer anonymous at that point. When I talk about it theres always people who come at me about it being secure and whats my attack vector? Well, its not secure. My vector is a desire to be anonymous, and clearly the anonymity this presents is a facade.
ryannathans@aussie.zone · 2 pts · 250d
You can literally turn off read receipts in signal
cypherpunks@lemmy.ml · 16 pts · 250d
But you can't turn off delivery receipts, which is what this attack uses.
ryannathans@aussie.zone · 1 pts · 249d
But you can turn off sealed sender messages from anyone, so they'd have to already be a trusted contact
cypherpunks@lemmy.ml · 13 pts · 249d
The setting to mitigate this attack (so that only people who know your username can do it, instead of anybody who knows your number) is called Who Can Find Me By Number. According to the docs, setting it to nobody requires also setting Who Can See My Number to nobody. Those two settings are both entirely unrelated to Signal's "sealed sender" thing, which incidentally is itself cryptography theater, btw.
ThatGuyNamedZeus@feddit.org · -13 pts · 250d
You can't avoid being monitored on whatsapp, on signal however, just be careful about what you download and be sure to have a good antivirus running and up to date on your devices
cypherpunks@lemmy.ml · 20 pts · 250d
those best practices don't mitigate the attack in this paper