Whats the vulnerability with Signal and phone numbers?
Comment on Signal downplays encryption key flaw, fixes it after X drama
timewarp@lemmy.world 2 months agoA company that requires using a phone number prides itself in security?
9tr6gyp3@lemmy.world 2 months ago
wildbus8979@sh.itjust.works 2 months ago
It’s better now, but for years and years all they used for contact discovery was simple hashing… problem is the dataset is very small, and it was easy to generate a rainbow table of all the phone number hashes in a matter of hours. Then anyone with access to the hosts (either hackers, or the US state via AWS collaboration) had access to the entire social graph.
9tr6gyp3@lemmy.world 2 months ago
Yeah the way I remember it, they put a lot of effort into masking that social graph. That was a while back too, not recent.
wildbus8979@sh.itjust.works 2 months ago
What I’m saying though is that for the longest time they didn’t, and when they changed the technique they hardly acknowledge that it was a problem in the past and that essentially every users social graph had been compromised for years.
eager_eagle@lemmy.world 2 months ago
privacy != anonymity != security
victorz@lemmy.world 2 months ago
But in some way, privacy ≈ security. Very intertwined.
sudneo@lemm.ee 2 months ago
Privacy is not anonimity though. Privacy simply means that private data is not disclosed or used to parties and for purposes that the data owner doesn’t explicitly allow. Often not collecting data is a way to ensure no misuse (and no compromise, hence security), but it’s not necessarily always the case.
victorz@lemmy.world 2 months ago
Right, and often for that to be the case, the transferring and storing of data should be secure.
I’m mostly just pointing out the fact that when you do x ≠ y ≠ z, it can still be the case that x = z, e.g. 4 ≠ 3 ≠ 4.
Just nitpicking, perhaps.