Hacker News Reader

Comment by barbazoo | Hacker News Reader

> The API allows an application to check if a mobile device is in proximity of a given location. The API request contains the location to be checked and an accuracy range in km (between 2km and 200km). The API response indicates whether the location is within the accuracy range of the last known location of the MSISDN.

I'd say this can only "give away" the location if you already roughly know where someone is AND no rate limit exists.

View on HN

With adjustable accuracy range you can do binary search to find out where someone is.

Which is where API rate limits come in. But if you really need to know where someone is, today, just be a telco with its own mobile infrastructure, and you can pretty much query the current network+cell ID of any of your subscribers without any limitations.

Same goes for anyone with, say, subpoena powers in your jurisdiction and/or sufficient (social) engineering skills. And cell ID to geo mapping is also a solved problem...

API rate limits don't keep you from doing the nasty stuff when you want to target one specific individual.

Depends on the limit and how it's implemented

Even if API rate limit exists and is strictly enforced, it's also easy to bypass it with multiple API keys and over time. Most people adhere to a weekly schedule.

Rate limits can also be based on the message contents, e. g. max 20 lookups per day for a cell.

Assuming you already know what continent somebody is on, 20 circles of 200km radius (120 miles) should cover most of the major population centers.

If you live out in Nebraska or the middle of the Sahara this attack is easy to defend against, but humans tend to clump up.

Sounds like a great way to DoS someone out of being able to use their banking app.

> AND no rate limit exists.

Sounds like you can just easily triangulete someone using this API.

Yeah, the apple air tags do something similar, the more devices the more accurate the location

Reply on news.ycombinator.com