Hacker News Reader

Comment by A1kmm | Hacker News Reader

If it is exactly 1 km you could triangulate to find someone's location.

A program to do that would do a bisection search along a line (faking coordinates for the location of the device) to find the point on the line where you transition to seeing the person's messages. Then, repeat along other two lines in different directions. Each transition point gives a circle of 1 km radius on which the person is present, and the one point shared by all three circles is their location.

This could be mitigated by rounding off coordinates to be coarse enough that it doesn't give their precise location before calculating the distance.

View on HN

Tinder once had this exact problem. You could find users' exact locations via triangulation, since the API reported an exact distance from your location: http://blog.includesecurity.com/2014/02/how-i-was-able-to-tr...

Grindr as well, which due to the nature of that app could have had bad effects should someone with ill-intent take advantage. There were even a few apps in the Google Play store that would pinpoint other grindr users.

Yep, this is a big problem in the human rights space these days. When we train on apps with LGBT communities in the Middle East and Africa, we have to spend a lot of time on this issue.

More info: https://grindrmap.neocities.org/

Comparison amongst gay dating apps (from 2014) https://grindrmap.neocities.org/overview.html

This is trilateration, not triangulation. Triangulation works if you know the angles, trilateration works if you know the distances and uses circles.

Source: I've done this before and it is very accurate and creepy.

> This could be mitigated by rounding off coordinates to be coarse enough that it doesn't give their precise location before calculating the distance.

Reporting a slightly different location to users or varying the search radius per user search could help.

Could this be defeated by a "snap to grid" technique? The installed client takes the actual location of the user and locates the nearest grid point (the resolution of which is up for debate) and reports as at that location?

Or increase the radius randomly after a pair of users have communicated for the first time.

That's not sufficient because a hostile actor could have three phones with three accounts.

Due to the fact that distance matching is done server side the application doesn't have any knowledge with regard to distance. The only knowledge one has is whether or not one receives messages from an other user.

Using triangulation to pinpoint an other users location would therefore require to move in and out of range (while the targeted user is continuously sending messages). Thus significantly more difficult than if the actual distance measure was depicted in the UI or leaked elsewhere.

Finally closing the API to outside requests limits the ease with which the above could be automated. Any idea's for further improving these security measures are most welcome!

> would therefore require to move in and out of range (while the targeted user is continuously sending messages).

That, or a number of co-operating clients located at various locations in and out of the range.

A simple fix would be to have every sender generate a random vector of random length 0-100 meters (and re-generate every time you've moved at least 100 meters, you don't want to regenerate if the sender doesn't move as you'd be able to zero-in on a prolific sender), and have the message "originate" from the end of that vector.

> Using triangulation to pinpoint an other users location would therefore require to move in and out of range (while the targeted user is continuously sending messages).

Or spoofing their actual location.

How exactly do you close the API to outside requests? It's not hard to reverse engineer most APIs, either by decompiling the app or just watching the wire.

You don't. That is impossible.

I can't tell how it works from the site, but a good approach is to randomize the distance threshold a bit each time. For example: if users are within 1km, always connect; if more than 2km apart, never connect; 1.xkm apart, connect with probability x.

That kind of thing combined with some rate limits (how often one can attempt to connect to a user) should be effective.

(edit) Actually, I think I like mseebach's suggestion even more: For each user, pick a random location about 100m away from them, then pretend they're there until they've moved far enough away, then repeat.

Heh, it's like salting their location.

Believe it or not, but this is exactly what the Chinese government mandates. It's known as China shifting[0], and can cause quite a lot of headaches.

[0] https://en.m.wikipedia.org/wiki/Restrictions_on_geographic_d...

I'm thinking of ideas like [differential privacy](https://en.wikipedia.org/wiki/Differential_privacy).

I am not sure if your original solution will actually work.

For example an attacker can just spoof enough accounts to sample from your distribution to figure out the true center. Imagine spoofing a grid of users with let's say K fake accounts per dot, then if you plot the histogram of who managed to connect you will see a very clear bump in the 2d histogram in the shape of circle.

The solution in your edit is much better.

There are many solutions to this, some already listed. For best effect apply all of them together: Rate limiting api requests and movement, hysteresis on distance, randomness on distance, snap to grid, increasing randomness the more you seem to be trilaterating, etc.

Some of thrm will also solve the problem of just discovering a user, starting a chat and then instantly loosing them, even though you were both siting still, as you were on the border.

I don't understand the anonymous angle. Why does everything have to be anonymous now? Like, you know if it uses the internet or touches a switch/router/server etc outside of your own home at any point that it's certainly, most definitely NOT anonymous at this point.

Anonymous has become a pointless buzzword in this NSA-era we be living in. Just say it's a hyper-local instant messaging app, because any half woke individual will know that nothing on the internet is anonymous really anymore. A percentage of all our internet activity is sitting on a rack somewhere in the Utah desert.

Get over it.

There is a difference between the NSA being able to trace your identity vs. a profit-driven corporation being able to connect your identity to your online speech, location, and contacts. The first is governed by due process and need-to-know, the second is essentially public knowledge if the ad-tech revenue is sufficiently tempting.

Even in a pseudonymous environment where the venue operator presumably knows who you are (like HN), the assumption that other users cannot easily trace your words to your IRL identity reduces friction in communication. Environments where everyone publicly posts under their real identity, with those posts retained forever, tend towards low-information social signaling.

> NSA -- due process and need-to-know

Lol. Have you read the news in the last 30 years?

I do agree somewhat with your point though.

Doesn't look like the application shows the distance in the UI. As long as they don't leak it in the packets (hopefully they don't given how they claim anonymity) triangulation would require the target to be sending messages continuously on a consistent interval for you to detect whether or not they are at the 1 kilometre 'border.'

... why not just fake your phone's GPS coordinates and perform a binary search?

Well, they could make it harder by relaying messages to people 1km+rand() around you

Reply on news.ycombinator.com