Hacker News Reader

Comment by sim7c00 | Hacker News Reader

depending on the circumstance, the rough area might already be useful to adversaries of the person trying to hide. I wouldn't expect things like criminals etc. to suffer from this, 300 miles is a big radius for example... but if you want to know if 'the guy is still in country' or something like that (for instance law enforcement) it's useful for them. such parties could then collaborate with local resources to do further investigations. knowing which local resources in what area to enable might save a lot of 'costs'.

as you said, impressive and insightful. :D kinda feel like the docs on it were a bit chatGPT aided, they are super clear and full of 'certain sentences'. (this is totally an excellent use-case for that, so not bashing on it at all!).

nice read.

View on HN

You would know if they are over a cellular network or checking on mobile.

If someone sends you a youtube link and you hit play, YT knows who you are, both from a network perspective and potentially the logged in user.

If you are using signal in a high risk environment, you should be using it from a system that contains no extra information about you. This is the same posture one should take when using Tor.

Basic opsec.

I don't think these kinds of things are in signals threat model. It is meant? as a message platform for people with nothing to hide?

i don't think you can call opsec basic, since it requires tons of knowledge about technology and techniques adversaries might deploy against you. targets of attacks don't neccesarily have this kind of knowledge.

opsec is _incredibly_ hard for a person not deeply into technology and this type of information. you might argue that you need to stick with certain tools and techniques that are known good, but new vulnerabilities and techniques implemented against you can completely shatter previous knowledge on whats good and bad opsec and still break it despite doing it 'very well'. (like certain darknet markets being closed down due to new vulnerabilities being found in the platforms they use...)

most people who rely on opsec/tradecraft for a living, also rely on teams of people to help them maintain it and validate it constantly... (or eventually fail and get bitten).

you are right though that its unlikely a company or app producer would have a threat model tuned to people who want to hide stuff. those things generally tend to be closed down sooner or later. (encrochat and such services...)

You are absolutely right, I think it should be basic opsec, but is probably advanced opsec seeing how many folks get tripped up by this stuff.

This means, never using a browser context you have ever logged into any service that is personally identifying. That also means the order in which you load pages. If your ritual is open pintrest followed by slashdot, that is now your finger print.

It isn't just what you do, but how you do it and the ordering between those events. You also don't want to accidentally deanon yourself or your peers, even when everyone is trusted because it also leaks group membership information.

The mental framework for opsec can be modeled as vector calculus and differential geometry. You have to think of the flow of information across a surface and in the integral of that flow. Assume an adversary with perfect total information.

Law enforcement could probably just ask cloudflare for the exact IP address that retrieved the attachment.

Anyone can do this are per the TFM, which is an excellent read.

do you think law enforcement in Iran will get an answer from cloudflare?

Only if they're from a friendly country. If the reason a user needs anonymity is geopolitical, that isn't a guarantee.

Reply on news.ycombinator.com