Telegram Trilateration: Abusing “People Near Me” and tracking people's location

https://github.com/jkctech/Telegram-Trilateration

by gaius_baltar • 4 years ago

94 35 4 years ago

new_guy• 4 years ago

Man, I read that as 'People of Color' before 'Proof of Concept' and was very confused.

Oh, my gods, I was so confused until I read your comment. I thought "people of color" as well, and looked through the entire readme trying to understand the relevance. This might be one of those times where writing out the full phrase is worthwhile

smegsicle• 4 years ago

that's horrible- people just go around calling other people 'POCs'? how dehumanizing!

trompetenaccoun• 4 years ago

This is messed up. Why would they ever make it so accurate?

na85• 4 years ago

Same reason they made their crypto trivial for the server to MITM.

Whether malice or ineptitude it's hard to say but it's one of those.

0xy2• 4 years ago

Secret Chats cannot be MITM'ed and MTProto2 has never had serious security problems despite multiple audits.

That's in contrast to WhatsApp, which backs up your private key to the cloud by default. And in contrast to Signal, which has inexcusable software bugs such as sending private photos to random contacts in your list (is it really E2E encrypted if you can't be sure who the recipient was?).

naoqj• 4 years ago

https://9to5mac.com/wp-content/uploads/sites/6/2020/08/how-t...

kadoban• 4 years ago

The linked page says Telegram fixed this, but they only say they're now rounding the results. Hasn't this come up previously in other services and rounding is _not_ enough? It seems like it just makes it very slightly less obviously possible but doesn't prevent exploitation.

Scaevolus• 4 years ago

It depends on when they do the rounding.

If they round the final distance number, all you've done is reduced the accuracy to concentric circles like a dartboard, and you simply need more samples to regain the precision.

If they round the input location to the centroid of some larger region-- a square several kilometers on a side or a map shape for a region-- there's no precise information to be leaked.

diebeforei485• 4 years ago

On an iPhone, that's what disabling "Precise Location" does.

throw8722913• 4 years ago

Is there a go-to library for this thing? So many apps mess this up.

throw8722913• 4 years ago

Telegram fixed it one or two weeks ago, problably because of the war.

batch12• 4 years ago

From what I recall, some services that rounded locations could still be abused by brute forcing the current location of the attacker to identify the threshold of rounding. This has been mitigated in some cases by changing the rounding threshold or truncating the value.

tejado• 4 years ago

Here is a full implementation of it: https://github.com/tejado/telegram-nearby-map

Aachen• 4 years ago

I tried this Telegram feature out some years ago but have it turned off since then. Spammers still find me, overly sexy profiles starting a conversation with a "xyz is 3km away" banner above the chat. One legit person also started a conversation once, they said I appeared as within a few km in a nearby city, so it doesn't seem to be my home address that I'm sharing.

Is there a way to find out which location I've been sharing? (I'd be happy to PM someone my phone number if you've already set up this trilateration script.)

And secondarily (damage is done now anyway) how to remove this last seen location?

celticninja• 4 years ago

Don't use telegram. It's not encrypted, it's not safe.

RF_Savage• 4 years ago

Telegram is fine for public and semi-public use. We mostly use it as a an IRC replacement with better multimedia capabilities. We also bridge some channels to IRC.

It's fine as long as people understand that it offers privacy only a notch above email. Now the security is on the level of a post card in an envelope instead of a bare postcard levels of security offered by email.

username1902• 4 years ago

This (admittedly terrible, but now rectified) location flaw aside, what safety disadvantages does Telegram have over other communication platforms without end-to-end encryption like Discord, Teams, Slack, or Messenger?

older5• 4 years ago

Here's explanation from Moxie: https://threadreaderapp.com/thread/1474067549574688768.html

aWRr• 4 years ago

This is extra interesting given the recent (un?)importance of Telegram in the Ukraine conflict. EFF wrote about it recently here: https://www.eff.org/deeplinks/2022/03/telegram-harm-reductio...

axegon_• 4 years ago

WTF!?!?!?!? Why would anyone put a feature like that!?!?!?!?!?!?!?!?!?!?!?

Telegram Trilateration: Abusing “People Near Me” and tracking people's location

Related Stories