News for hackers. Stuff that matters.

A comment on Telegram Trilateration: Abusing “People Near Me” and tracking people's location.

Re:Telegram Trilateration: Abusing “People Near Me” and trac... by kadoban on Friday March 11, 2022 @06:07PM (#30647243)
The linked page says Telegram fixed this, but they only say they're now rounding the results. Hasn't this come up previously in other services and rounding is _not_ enough? It seems like it just makes it very slightly less obviously possible but doesn't prevent exploitation.
[ Parent | on HN ]
Re:Telegram Trilateration: Abusing “People Near Me” and trac... by Scaevolus on Friday March 11, 2022 @09:02PM (#30648292)
It depends on when they do the rounding.

If they round the final distance number, all you've done is reduced the accuracy to concentric circles like a dartboard, and you simply need more samples to regain the precision.

If they round the input location to the centroid of some larger region-- a square several kilometers on a side or a map shape for a region-- there's no precise information to be leaked.

[ Parent | on HN ]
Re:Telegram Trilateration: Abusing “People Near Me” and trac... by diebeforei485 on Friday March 11, 2022 @09:09PM (#30648329)
On an iPhone, that's what disabling "Precise Location" does.
[ Parent | on HN ]
Re:Telegram Trilateration: Abusing “People Near Me” and trac... by throw872291 on Friday March 11, 2022 @09:59PM (#30648600)
Android 12 has it too.
[ Parent | on HN ]
Re:Telegram Trilateration: Abusing “People Near Me” and trac... by throw872291 on Friday March 11, 2022 @09:46PM (#30648531)
Is there a go-to library for this thing? So many apps mess this up.
[ Parent | on HN ]
Re:Telegram Trilateration: Abusing “People Near Me” and trac... by throw872291 on Friday March 11, 2022 @09:40PM (#30648507)
Telegram fixed it one or two weeks ago, problably because of the war.
[ Parent | on HN ]
Re:Telegram Trilateration: Abusing “People Near Me” and trac... by batch12 on Sunday March 13, 2022 @10:20AM (#30661420)
From what I recall, some services that rounded locations could still be abused by brute forcing the current location of the attacker to identify the threshold of rounding. This has been mitigated in some cases by changing the rounding threshold or truncating the value.
[ Parent | on HN ]