Technology preview: Private contact discovery for Signal

Re:Technology preview: Private contact discovery for Signal by Animats on Wednesday September 27, 2017 @01:17AM (#15345097)

If you pass links to known sticker images, and the recipient has to retrieve them by means outside the Signal protocol, that reduces security. An observer can detect when a receiver fetches a sticker image, and they can tell which one. For example, noting that a message has forced the loading of collection "Gay"[1] provides much useful information to an observer.

[1] http://chpic.su/en/stickers/Gayer/

[ Parent | on HN ]

Re:Technology preview: Private contact discovery for Signal by thaumasiotes on Wednesday September 27, 2017 @01:33AM (#15345150)

So send them entirely inline. Sending a sticker is not fundamentally different from sending an image that isn't called a "sticker".

[ Parent | on HN ]

Re:Technology preview: Private contact discovery for Signal by Animats on Wednesday September 27, 2017 @01:49AM (#15345217)

Having to send stickers every time ups the overhead. Also, if stickers are well known variable length files, it may be possible to make good guesses about which stickers are attached.

[ Parent | on HN ]

Re:Technology preview: Private contact discovery for Signal by yorwba on Wednesday September 27, 2017 @02:21AM (#15345326)

You could negotiate sticker sending by hash: the first message only contains the hash value, if the recipient already has that sticker stored, it can be displayed immediately. Otherwise the full data can be requested.

EDIT: That scheme can be used to probe whether or not someone already has a specific sticker stored, so it might have to be separated per-contact to avoid leakage.

[ Parent | on HN ]