<story><title>Large-scale Abuse of Contact Discovery in Mobile Messengers [pdf]</title><url>https://encrypto.de/papers/HWSDS21.pdf</url></story><parent_chain></parent_chain><comment><author>galadran</author><text>The associated paper [1] summarises the information revealed by Signal succinctly:&lt;p&gt;&lt;i&gt;The Signal messenger is primarily focused on user privacy, and thus exposes almost no information about users through the contact discovery service. The only information available about registered users is their ability to receive voice and  video  calls.  It  is  also  possible  to  retrieve  the  encrypted profile picture of registered users through a separate API call,if they have set any. However, user name and avatar can only be decrypted if the user has consented to this explicitly for the user requesting the information and has exchanged at least one message with them.&lt;/i&gt;&lt;p&gt;So Signal comes out excellently from this, yet is mentioned in the title. However, the paper does find that Telegram reveals to the world, in real time, exactly how many Telegram users have a particular phone number in their address book...&lt;p&gt;Can we change the title from the (click baiting) university press release to one which more accurately reflects the content of the paper?&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;encrypto.de&amp;#x2F;papers&amp;#x2F;HWSDS21.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;encrypto.de&amp;#x2F;papers&amp;#x2F;HWSDS21.pdf&lt;/a&gt;</text></comment>
<story><title>Large-scale Abuse of Contact Discovery in Mobile Messengers [pdf]</title><url>https://encrypto.de/papers/HWSDS21.pdf</url></story><parent_chain></parent_chain><comment><author>nbadg</author><text>I think it&amp;#x27;s important to put this into context. They&amp;#x27;re stating that a malicious user could crawl public info of other users, thereby building (over time) a behavioral model of those users. The theory that you could protect users from that by hashing phone numbers and using the hash for contact discovery, turns out not to be accurate, because there are few enough phone numbers in existence that you can just brute force the hash.&lt;p&gt;I do think it&amp;#x27;s important for people using these kinds of services (and I&amp;#x27;m one of them!) to understand their limitations, but I also kinda find this a bit self-evident, if you think about how contact discovery works. There&amp;#x27;s simply no way around it (unless you stop using phone numbers to exchange contacts). So in the sense that studies like these help educate non-technical users of the technical limitations of services, this is great!&lt;p&gt;However, to say they &amp;quot;threaten privacy&amp;quot;... That feels like a gross mischaracterization of what&amp;#x27;s going on here. Every social technology site, app, etc, has this problem, and it&amp;#x27;s something that could be, to an extent, mitigated for (detection of scanning attempts, rate limiting, etc). Meanwhile, these are the apps that are bringing E2EE to the masses. It feels like missing the forest for the trees.</text></comment>