alp1n3_eth

How intermittent of an issue is it? I don't think collecting client side HAR files from real customers is the way to go, even if they're willing. What happens when the next weird error shows up? More HAR files?

Echoing some other suggestions, but to a different extent, increase logging in the problem areas both client-side and server-side. It might be directly related to the token refresh since it only happens there, so a great place to start is within that functionality. Log the entire connection's info to both services (front and back logging) and if users are manually submitting tickets you should be able to track them down by userID / IP in the logs.

Also extend the fuzzing capabilities w/ your tests through browser (potentially could be headless, depending on the issue) automation that authenticates and uses the app "normally". Keep it on repeat using the app and when token refresh time comes see if the error pops up. Throw some extra variables in their, ensure its off the corporate network or routed through DCs farther away to see if it's a latency issue somewhere else. You could log the HAR file for this.

Multiple versions of tests might need to be run in parallel with different modifiers, such as one being allowed to directly communicate w/ the origin, vs. another going through the CDN like a standard customer would.

This is also an edge-case, but I've seen it popup sometimes; ensure that there aren't any other required variables that are missing during the refresh process. Sometimes specific functionality in some apps is tied to a custom header, and sometimes the value isn't updated to what the app expects. Things like that which could throw the process of from another angle.

I just did the same switch for the same reasons, except I was a newbie to Neovim. The Vim keybindings and way it "handles things" is amazing, but the Neovim-powered bridge to getting it to be a full IDE with bulletproof config and extension support was a PITA out of the box.

Generally I want things to "just work" and if there's extra fancy settings I'm happy to learn them later / slowly as a I go through it. Minor updates to plugins in Neovim would break things, a lot of the error output was next to useless, and I spent waaaaaay too much time debugging what was wrong.

I switched to Zed w/ Vim keybindings and it's a perfect balance.

I understand the want for these new social networks to be less-controlled and more distributed, but I think there is a line in general for dopamine dependence and algorithmic targeting.

TikTok, Reels, YT Shorts, all are a net-drain when it comes to doom-scrolling/wasting time. I [[kind of]] understand keeping more traditional methods and making more open versions: Pixelfed (Insta), Bluesky (Twitter), etc. as people want some form of connection, but I don't think these short vid platforms should be put on a pedestal.

I'm glad I was introduced to NeoVim, because it led me to using Vim bindings in Zed.

As a new user to NeoVim, I was okay with investing some time, but man it feels like each update to NeoVim itself, or even the popular plugins, breaks something that I then need to go hunt down and fix. Every answer online isn't any better, pointing to 5 different doc pages. I like my IDEs to "just work" and continue to do so after I have them configured.

In the U.S. the opposite is encouraged as we lack a lot of safe harbor laws surrounding responsible disclosure. Something as simple as seeing individual's social security numbers hardcoded into HTML could get you dragged through the mud by your state's leaders and the potential threat of jail time.

It's why you'll see a black & white approach to this among bug hunters, instead of a grey / middle-of-the-road one. Some will try to disclose responsibly, the company will deny, and by disclosing through their BBP you've technically agreed to their NDA, so you can't say a word about it even if it still exists a year later. Others will find it and just post it publicly right away, as they don't want to agree to an NDA, and a public action leads to them actually fixing it quickly instead of letting the vuln sit around forever.

Haha thank you for doing the math! I was lazy and just added the populations and a plus at the end.

From what I know* (heavy on the asterisk there), they are. I'm guessing at their setup at this point, but it sounds like the "large" data is probably being stored (while encrypted) in a different way / separately than the messaging. Since it's supposedly E2E (not gonna pretend I've hand verified it), it's decrypted on the device, but it needs to be grabbed in the first place from said separate place.

So, I'm guessing the images are encrypted where they're stored. And from his post it sounds like it doesn't happen with the messages, so the motivation for using CloudFlare probably is around egress pricing, or they could be using CloudFlare R2 for storage as well.

Signal's default setup is more usability focused while supporting E2E, and less about tinfoil hat threat models about being present on a continent you're a citizen of.

The items you mentioned can essentially be configured, for those that want the insane level of privacy / security. Messages can be auto-deleted 30 seconds after being seen, a proxy can be configured to route all your traffic through it, and tons of other things can be done to customize it more to the user's liking.

I'd imagine they're caching it because of egress costs. File attachments, voice mail, video, etc. can all add up.

Blaming the user is sometimes what it boils down to. Security includes a balancing act that involves usability, and Signal is firstly targeting the masses, but includes settings that can be configured for high-risk scenarios.

This "vulnerability" requires the user to have none of the normal things a person with a more extreme threat model would have already configured. EZPZ guides online on locking down Signal.

It's just like an iPhone. They don't ship with Lockdown Mode enabled by default, as it hurts the average consumer's usability. Signal at minimum will ensure no one is snooping on your messages, and it's up to the user whether they want to take that further.

If your definition of not providing security is allowing someone to know they exist on a continent, then that user's ISP has performed terribly as well since they aren't bouncing their signal around the world by default.

Not really.

Anyone who wants to conceal what continent they're on will also be using a VPN 24/7, or will have the proxy setup in Signal (AKA running 24/7), which defeats this.

> you would be surprised how quickly this adds up

Yes, but if social engineering is involved and tracing back through user conversations across a platform, it's hardly a vulnerability, let alone one deserving of a bounty. The way this is currently functioning is intended functionality, and can be further locked down depending on the user's threat model.

This can essentially be classified as opsec failure for the Signal user. If they're trying to hide from a hit in a 300 mile radius, they've got bigger problems to worry about, and should already be using a VPN setup.

Every time you click on a link your external IP addresses is exposed, is this a vulnerability? Being online without a VPN / proxy is inherent consent to have your external IP & other required items to be shared with services / middlemen.

When it comes to Discord, if you have this strict of a threat model and you're still using it, idk what to tell you.

Thank you! That's what I get for quick scrolling through the settings. I for sure thought it would have been under Privacy (for this concern), but that makes sense too.

Just like the days of DoSing an IP from a COD Lobby

Cool writeup with some interesting techniques and approaches!

I'll echo the other comments and say "deanonymization" is stretching the definition of the word, along with "grab the user's location", as it isn't anything near precise. 150 miles is approx. a 2-hour drive on the highway from Atlanta, GA to Augusta, GA. In that radius, there's probably 700,000+ people.

I do think the auto-retrieve attachment feature of Signal is slightly concerning, as for a private messenger I'd expect there to be an option to turn it off (like turning off JS in Tor). I don't know if I'm not looking deep enough, but there doesn't seem to be a feature for that.

Signal appears to take a useful-by-default approach that balances privacy and ease-of-use in order to encourage adoption by the masses, I'd assume most people that are really concerned are hardening Signal, similar to what is in this guide: https://www.privacyguides.org/articles/2022/07/07/signal-con... . They've always recommended a VPN / proxy + a modification of settings for more high-security scenarios.

Caching isn't going anywhere, and neither is CloudFlare. The DoSing days of old in P2P multiplayer lobbies with exposed IPs seemed to carry more of a threat than this, CloudFlare's response seems to be the best out of the 3. Caching sensitive information is never recommended and the onus is on the application doing the communicating to tell their CDN / middle-service to not cache specific items.

I think I understand the situation correctly, but please correct me if I'm wrong. You're essentially asking "How does realBank.com stop fakeBank.com from sending requests on behalf of the user to realBank.com"?

The malicious site could go about a few ways of potentially using functionality based on what protections the real bank's site is using. If it's not protected against CSRF & JWTs aren't in use, it could send a request on behalf of the user.

If the bank's site allows framing, a clickjacking attack could occur.

---

From your further comments though, it also sounds like you may be talking about phishing. There are several PoCs and real-world examples of attackers hosting a fake login page for Microsoft/Apple/Facebook and interacting in real-time with the real site. This allows them to also prompt the user for an MFA code which they'll use to authenticate.

If it's this phishing scenario, there's not a big way to block these for completely public-facing sites. Anything behind a VPN / whitelist would be impossible though (ofc).

It has been under heavy scrutiny by the security community for years, it would have already been found had it existed.

With the different flavors of Linux, the varying configs, and uses, etc. it would be a less-likely target because it's overall much easier just to infect one of the numerous Windows computers or servers in a corp, then pivot to the other machines within the network from there.

Whether targeting public facing Windows servers, or the employees' own desktops, it's easy to see why Linux would be more of an afterthought. Windows devices massively out number the number of daily-use Windows devices, which also increases the opportunity for attack.

I feel like this relies more on social engineering itself than anything else. I think confirmations / captchas should be in use for any critical functionality any way, but watching the exploit vid makes it seem like I can submit a bug for a user going to GitHub, downloading malware, then running that malware, because an email told them they should. The extra tab involvement wouldn't raise any red flags for a user?

Looking at a lot of user's feeds, its algo doesn't feel as "rage-baity" as the ones from YT or Insta. Even normal platforms, like FB and Twitter push rage bait to the top. TikTok seems to avoid those pitfalls in a lot of cases.

A forced sale would essentially gut them of their proprietary algo, which is leagues ahead of anything YT or Insta has. This algo and the associated TikTok assets can still be used a billion different ways around the world and in other apps.

Why would they ever want to help create an international competitor that could compete with them? I don't think any business would want to do that. Obviously the CCP has a level of access if they want it to data hosted in China, that's how it works with every company that has a physical location there.

The backdoor named "backdoor", the l33t h4ck3rs strike again.

I write mainly for myself, but it has other benefits as well. The act of blogging forces me to actually follow through with pieces, as I'm putting them out there. If I'm just "taking notes", it won't be as well laid out (at least until later revisions) and is very utilitarian.

Blogging forces myself to write for others, which allows me to do things like research a subject more deeply and include supporting evidence. Aside from that, it's nice to have a resource that shows enthusiasm about a field, and there are things you can point to if writing samples are necessary for a job, grant, or publication.

I think there are a lot of other benefits I haven't covered. I will preface this saying all of my blogs are also first drafts about random things. Sometimes they align with my field, but a lot of the time they are edge-cases or in an adjacent field, and sometimes they're just ramblings about random topics. Finding your reason to blog is the best way to do it, because if you have no reason or motivation to, why do it?

Totally agree with this. It's nice to have something to point at for writing samples, to show some experience in a field, and to get ahold of you.

I have a link aggregator (Bento.me) that points to my blog, GitHub, cool projects to get involved with, etc. I feel like this also shows a level of enthusiasm / involvement with the field / community as a whole as well.

I saw your other comment and also agree with the email exclusion. My blog has the ability to have comments, my GitHub has open repos, and there is a calendar link. If someone wants to dig for my email they can (as it's very public at this point lol), but I'd prefer it not be the main route I handle online comms through from people reaching that link agg.

I feel like "passive" income is anything that takes under 10 hours a week once it's up and running. There's rarely any opportunity that can be considered passive if your definition is 0 work ever once it's going. The only thing that [might] fit into that slot is investment dividends.

That's extremely unfortunate, especially about the "abandoned" labelling. I've been looking to move off GitHub recently as well, it feels like it's got a bit too much control.

Codeberg looks interesting, and there are self-hosted ones like Forejo that also look great if you're okay with the maintenance.

+1 for Copilot.

When Mint shut down I did a ton of trials and Copilot had the best UI for me and I didn't have to learn a new "system" like YNAB. It relies on Plaid, so just make sure your banks/cards/accounts are mainstream (Chase, Wells Fargo, Goldman, Vanguard, etc).

Every company can have its issues, I think it's more about how many issues there are and what the company did to address it.

My 2013 4GB RAM MacBook Air is still running great, and is used for browsing in my household. Currently writing this on an M1 Air that is phenomenal as well.

I think it's a little much to expect most small outfits to user test on every single Linux distro though. There are tons of programs that may run fine on something like stock Ubuntu, but bring it to another flavor and all of a sudden nothing works.

It's nice to see, but the extension on top of the cURL preexisting syntax is rough to look at.

Ever since stumbling upon Hurl a while ago, I've really enjoyed how easy to read the scripts are. Anyone that partially understands web/http is able to read and tell exactly what's going on in the low -> medium complexity scripts w/o even reading the docs.

Have you tried something like GraphQL playground before? https://github.com/graphql/graphql-playground

There's other tools out there that can generate similar docs or playgrounds, given you have a schema/spec of some type.