Hacker News Reader

Comment by myself248 | Hacker News Reader

> Protesters believe Chinese security officials have exploited the function by uploading large quantities of phone numbers.

> The app automatically matches phone numbers with the user names in the group. Chinese authorities then only need to request the owners of the phone numbers from the local telecom service in order to learn the users’ true identities.

> Telegram has detected evidence that Chinese authorities may have uploaded numbers to identify protesters, said a person with direct knowledge of the situation.

Signal does/did this too: https://news.ycombinator.com/item?id=12590979

View on HN

This is a flaw common to services that rely on phone numbers as IDs. In many countries, one cannot purchase a SIM card without showing ID (and the seller makes a photocopy of the ID to provide to the authorities). That means that there cannot be true anonymity. Know the phone number, know the person.

I am always baffled when people claim that PGP-encrypted e-mail is passé because it leaks metadata, when Signal and Telegram leak metadata too and, furthermore, metadata that can be immediately associated with a specific person in many countries.

re: needing an ID for SIM cards, that's interesting!

Here in New Zealand, I can freely purchase any prepay SIM without ID and use it straight away. Most, if not all dairies carry them too.

In europe it's mixed: https://www.reddit.com/r/europe/comments/9ziqfi/european_cou...

I recently visited what is apparently a prepaid-SIM-without-ID island of the Czech Republic, accustomed to places where registration is required. The person in the telecom store selling me the SIM looked at me with an almost disarming "this is the Czech Republic" look when I asked if she needed to see my passport.

In Germany you now apparently need to show ID and provide an address, though no proof of residence so any address seems acceptable.

In Germany, I need to do PostIdent or handover my address+copy of my ID/passport to buy a SIM card. To further check things, telecom sends letters to corresponding address too sometimes.

Not over the border in Australia.

Not the same crossing the Tasman sea. It's mixed in Australia. One can only have 5 pre-paid mobile numbers under 1 name (activation limit). However, you can still buy SIM packs from supermarkets or convenient stores, not sure if activation requires ID, it may depend on provider.

NZ is obviously loose due to large number of tourists, I reckon. So easy to get SIM cards, I've got 2 (spark and 2 degrees). US also requires ID to get SIM last time I was in bay area (2016).

> not sure if activation requires ID

Pretty sure they all do. I've used prepaid on all the major carriers and bigger MVNOs and I needed to give some form of ID to the signup process.

In Russia one cannot (in theory; actually it's possible sometimes). In Japan an ID is required as far as I know.

In Japan ID is required for voice service, but I think not for data only.

You can't sign up for Signal with a data only SIM

Yes, you can. Data only SIM cards can receive SMS's. At least in Portugal they do.

Oh, interesting. I don’t think they can in Japan

I can confirm that you don't need an ID for data only in Japan.

The same is true in Hong Kong, no ID required.

You can even purchase cards without ID that also work in Mainland China and aren't subject to the great firewall.

VOIP numbers are much more anon-accessible. You can buy a ready to go google account with voice enabled if you know where to look.

and where might one look?

Anyone can get a phone number anonymously from https://jmp.chat/ if they like. JMP lets you signup over Tor, and after the free trial you can pay in Bitcoin or other cryptocurrencies to keep the number.

You also don't need to use these private numbers with friends, keep your main number and just use this or some voip number for stuff you want private.

The problem is this would both a) need to be used by Signal as the primary number ID b) your friend would need to know this separate number just for chat (unless you also use it for calls and other stuff then no biggie)

Of course this also kills new friend discovery, which is probably not needed by most.

I haven't tried using SIP on my phone app while simultaneously having a SIM number so I'm not sure Signal can be routed through an arbitrary number on your phone. But I could be wrong. Maybe someone else knows?

Furthermore, a phone number allows the government to determine rough location in real time or see an archive of previous locations for several months. Also, in some countries (guess which) all SMS messages and phone calls are recorded and stored for at least 6 months.

It is dangerous to use such messengers like Signal (or Telegram) with a real phone number.

Unless of course you don't tie your real identity to your phone plan or more accurately your IMEI.

Which I've done personally for many years. They won't tell you it's possible at the stores but they don't ask questions if you say you forgot your drivers licence at home.

As stated above, in many countries you have to by law

Didn't say it was, but the ones requiring IDs are more the exception than the rule, meaning hundreds of millions of people, and hardly anyone knows to do it so it's worth mentioning.

Fortunately that's not the only identity separation you can create, which IMO is as or more important day to day than encryption and other technical solutions.

But nothing beats limiting government power through policy which seems to unpopular these last few decades.

Is it the exception? Every country I’ve bought a SIM card in recently has required a passport or ID

Requiring IDs is not the exception these days. Also, limiting government power through policy seems unpopular because it doesn't work.

Only if you're actually actively using a SIM card with that phone number, no?

Not the same thing. The flaw in Telegram happens with the group feature.

Are you sure? I wanted to install Telegram and it insisted on having the contacts permission from the get go. I think it's sending contacts to their database so they can match friends.

Isn't there a secure messaging app that doesn't require a phone number and doesn't ask me to upload my contacts?

Matrix doesn't ask for anything. But I wouldn't use it for super critical things, cause the user interface (of the Riot client) is confusing enough that I'm afraid I'll make mistakes in verifying devices or fingerprints or something. Weird things happened when I tried it myself (I got more device IDs than devices, and I'm not sure where the other ones came from ... )

Then don't use so called 'secure' services that rely on phone numbers. There exist plenty of secure chat apps that don't have this flaw. LINE is probably my favorite.

Secure until the government asks.

https://linecorp.com/en/security/article/35

Fair, but it's E2E by default, and only requires a (burner) email address to sign up. If you're careful, there's not much to be gleaned from the remaining data.

Doesn't LINE require a phone number or a Facebook account? Seeing as Facebook will often ask for a photo of you to verify your account before you can use it now, this doesn't seem like a fix for the anonymity issue.

You can sign up with a phone number or email address.

*Untrue. See comments below.

How? As far as I am aware, you can link an email to an account once it is created, though it doesn't really do much, but you require a phone number to create one. Indeed their website claims you need a phone number or Facebook account. I just tried registering using the Chrome extension and it required a phone number.

https://linecorp.com/en/security/article/164

It appears you are correct. Now I wonder if that's changed recently or age is catching up with me. I've not used it in over a year, but what you said is definitely the case now.

Reply on news.ycombinator.com