Bug? No, Telegram exposing its users' precise location is a feature working as 'expected'
- Reference: 1609866847
- News link: https://www.theregister.co.uk/2021/01/05/telegram_location_people_nearby/
- Source link:
Folk who activate this feature see a list of other users within a few miles to "quickly add people nearby... and discover local group chats."
Using a utility that fakes the location of an Android device, Ahmed Hassan was able to discover the distance of individuals from three different points, and then use trilateration to pinpoint exactly where they were. He was able to retrieve exact home addresses using this method, which is not technically difficult.
[1]
Using trilateration to pinpoint an exact location from three separate distances. Pic courtesy: Ahmed's Notes
Hassan reported the issue in the hope of a bug bounty only to be [2]told : "Users in the People Nearby section intentionally share their location, and this feature is disabled by default. It's expected that determining the exact location is possible under certain conditions."
"If you enable the feature of making yourself visible on the map, you're publishing your home address online. Lot of users don't know this when they enable that feature," Hassan said.
He also believes that there is a widespread problem with malicious users faking their location, joining local groups, and spamming users with fake Bitcoin investments or other frauds – evidence, he claims, of poor application security.
In [3]its FAQ Telegram claims to be "more secure than mass market messengers like WhatsApp and Line" based on its security protocols, but does not address the risks from malicious users.
[4]
The 'Make Myself Visible' option might be less popular if it said 'Share my address with strangers'
Similar location issues have come up before with other apps. Hassan discovered the same vulnerability in the Line messaging app, which he said "they fixed by adding a random number to the user's destination".
Last year, Strava user Andrew Seward [5]observed : "Out running this morning on a new route and a lady runs past me. Despite only passing, when I get home Strava automatically tags her in my run. If I click on her face it shows her full name, picture and a map of her running route (which effectively shows where she lives)."
Obtaining the location of nearby users is not an issue exclusive to digital devices. A stranger may follow someone home, for example. It is also not so long ago that a huge printed directory of local names, addresses, and telephone numbers used to be delivered to almost every home in many countries – and in the UK BT's online Phone Book service still offers a person search, including address details for those who have not opted out.
That said, Telegram could do better. We installed Telegram on an Android device and found that enabling People Nearby and choosing to "Show your profile" raises a warning that "users nearby will be able to view your profile and send you messages. This may help you find new friends but could also attract excessive attention."
It does not state that strangers with a small amount of knowhow can easily discover where you live. Nor does the aforementioned FAQ mention it, nor even the [6]Advanced FAQ "for the technically minded". Most of the focus is on encryption.
As [7]discussed on Hacker News, Apple made [8]some remarks on the subject at its developer event last year, stating that location information should be tailored to the requirement and that there are cases where sharing "just a little bit of location information makes sense for the app's expected functionality."
Apple also told developers at the event that "starting in iOS 14 a new option will appear in the prompts for users – Precise. This option lets the user grant an app only their approximate rather than their exact location."
The company added that "asking for full accuracy only when it's actually needed makes users more likely to give you what you need."
In the case of Telegram's requirement, it might be sufficient simply to report which users are within a seven-mile radius, for example, rather than exposing their exact distance away.
Whether or not Telegram's current behaviour is a bug is open to debate, but improved transparency and the ability to give more approximate or slightly randomised distances would be welcome.
We have asked Telegram for comment. ®
Get our [9]Tech Resources
[1] https://regmedia.co.uk/2021/01/05/telegram1.jpg
[2] https://blog.ahmed.nyc/2021/01/if-you-use-this-feature-on-telegram.html
[3] https://telegram.org/faq
[4] https://regmedia.co.uk/2021/01/05/makevisible.jpg
[5] https://twitter.com/MrAndrew/status/1305530276127428609
[6] https://core.telegram.org/techfaq
[7] https://news.ycombinator.com/item?id=25643509
[8] https://developer.apple.com/videos/play/wwdc2020/10660/
[9] https://whitepapers.theregister.com/
Re: Well, yeah.
There's a whole lot of difference between narrowing someone down to say, a square mile or two and knowing the exact spot they live.
Re: Well, yeah.
Does it matter? They shouldn't even know which country you are in, let alone block.
Exactly spot.How precise are we talking about here? Given that elevation is rarely done, in Manhattan say even the block would be useless to SWAT someone.
"In the case of Telegram's requirement, it might be sufficient simply to report which users are within a seven-mile radius, for example, rather than exposing their exact distance away."
I fail to see how that actually solves the problem, unless there's a lot of randomness added or it uses a constant arbitrary point for distance (say, everyone in a postal code is at the center of that postal code). Otherwise it just means it takes more than 3 readings, big whoop.
a huge printed directory of local names, addresses, and telephone numbers
While that is true, there's a big difference between "here's a book with twenty thousand people indexed by name, good luck"...
...and "This young brunette is Jessica, she's out for her morning run, this is her route. She lives at 6 Skylark Lane. She's single, has two cats, and plays the cello" (the additional details easily gleaned by following links to social media profiles, etc).
Re: a huge printed directory of local names, addresses, and telephone numbers
Quite. Arnie would have terminated (the correct) Sarah Connor in a jiffy.
Re: a huge printed directory of local names, addresses, and telephone numbers
First of all, it was a lot more than 20 thousand.
Second, you're right, but that is the state of technology today. People should stop buying these gadgets that reveal their entire lives for basically no advantage. Why do you need a watch that records your GPS coordinates when you run ? Can't you just run ?
'fake Bitcoin investments'
Is there any other type?
Hush, you'll provoke the bitcoin stans, who will pile in with enthusiastic raves about how it's only going UP UP UP in value, angry denunciations of your motives, and spittle-flecked claims that you're in the pocket of Big Fiat Currency / Goldman Sachs / the Midland Bank / whoever...
Well, yeah.
Share my location tends to mean that.
Not sure what the guy was trying to prove.