安全与密码学2020encrypto.de
移动即时通讯应用中联系人发现机制的大规模滥用
Large-scale Abuse of Contact Discovery in Mobile Messengers
进阶 · 约 60 分钟读完前置知识：移动通讯应用基础、隐私与匿名性概念、API 枚举攻击基础
导读
这篇论文系统研究移动加密通讯应用的联系人发现机制如何被大规模滥用：攻击者可利用通讯录/电话号码查询接口枚举注册用户、推断社交关系，甚至建立行为画像。论文评估了 Signal、Telegram、WhatsApp 等实现，发现不同应用的泄露程度差异很大，其中 Telegram 的暴露尤其严重，而 Signal 通过设计把联系人发现所暴露的信息压得很低。
HN 关注点：端到端加密通讯应用的联系人发现是否会破坏隐私，以及论文标题/新闻稿是否夸大了 Signal 等应用的问题。
HN 评论精选
这几条评论里：质疑 2 补充 2
质疑论文实际显示 Signal 泄露极少、Telegram 泄露严重，批评标题/新闻稿有标题党之嫌。
相关论文对 Signal 泄露的信息总结得很简洁：Signal 主要以用户隐私为核心，因此通过联系人发现服务几乎不暴露用户信息。关于注册用户，唯一可获得的信息是其能否接听语音和视频通话；如果用户设置过，还可通过单独 API 获取其加密头像。但用户名和头像只有在用户明确同意给请求者查看、且双方至少交换过一条消息时才能解密。所以 Signal 在这项研究里表现很好，却仍出现在标题里。论文实际发现 Telegram 会向全世界实时暴露：某个电话号码被多少 Telegram 用户的通讯录收录。能不能把标题从（标题党的）大学新闻稿改成更准确反映论文内容？
galadran查看英文原文
The associated paper [1] summarises the information revealed by Signal succinctly: The Signal messenger is primarily focused on user privacy, and thus exposes almost no information about users through the contact discovery service. The only information available about registered users is their ability to receive voice and video calls. It is also possible to retrieve the encrypted profile picture of registered users through a separate API call,if they have set any. However, user name and avatar can only be decrypted if the user has consented to this explicitly for the user requesting the information and has exchanged at least one message with them. So Signal comes out excellently from this, yet is mentioned in the title. However, the paper does find that Telegram reveals to the world, in real time, exactly how many Telegram users have a particular phone number in their address book... Can we change the title from the (click baiting) university press release to one which more accurately reflects the content of the paper? [1] https://encrypto.de/papers/HWSDS21.pdf
补充端到端加密服务难以隐藏“谁在使用服务”；Signal 的 secure enclave 只能保护社交图谱，枚举/IP 关联仍可发现用户，争论应回到是否该有发现/增长工具。
这基本是问：端到端加密服务应不应该允许用户自动发现/互相发现？WhatsApp 直接以明文元数据保存全球社交图谱和每个用户的社交图谱；Signal 让每个用户把地址簿上传到安全隔离区（secure enclave），从而在一定程度上可抗辩要求交出某用户社交图谱的传票。但这挡不住有决心的攻击者列出服务上所有电话号码/用户名，再发现谁在使用服务（前者是个人的社交图谱，被隐藏；后者是全体用户图谱，可被发现）。我没见 Signal 公开说过这点，所以这是我的观点：我认为 Signal 其实无法保护“谁在使用服务”，只能保护他们在服务上说什么以及谁在谁的通讯录里。即使没有地址簿查询工具，有全知视角的攻击者也能关联 IP 日志学到很多。核心问题是：端到端加密系统是否该有任何用户增长/发现工具？某种程度上真正的问题是“Signal 到底需不需要增长”。我认为需要，但这更多是因为人们想做增长产品，而非教条。总之，我不认为 Signal 隐藏了谁在使用服务，只隐藏了用户说什么（以及谁在谁通讯录里）。
josh2600查看英文原文
This is basically a question of "should e2ee services allow users to auto-discover/discover each other or not?" Whatsapp just has a plaintext metadata mapping of the global social graph and each user's social graph. Signal has every user upload their address book into a secure enclave so that they can at least somewhat plausibly resist a subpoena for a user's social graph. This does not stop a determined attacker from making a list of all phone numbers/usernames on the service and discovering who is using the service (IE the former being an individual's social graph, which is hidden, vs the graph of all users which is discoverable). I don't think I've ever seen Signal say this, so this opinion is mine and not theirs, but I don't think Signal can actually protect who uses the service, only what they say on the service and who is in their social graph. A determined attacker, even if they didn't have this address book lookup tool, could correlate IP logs and learn a lot if they had an omniscient view of user traffic. The core question is this: should e2ee systems have any user growth/discovery tools or not? On some level the real question is "does Signal need to grow at all?". I think the answer is "yes" but that's not particularly grounded in any dogma other than people want to work on growing products. In summary, I don't think Signal hides who uses the service, only what their users say on the service (and who is in whom's address book). In this way Signal conceals each user's individual social graph but not the total social graph of who is using the service.
质疑哈希电话号码不能防暴力枚举，问题本质难避免；研究有教育意义，但“威胁隐私”是夸大，应重视缓解和 E2EE 普及。
我觉得要放在背景下看。他们说恶意用户可以爬取其他用户的公开信息，从而随着时间建立这些用户的行为模型。原本以为可以通过把电话号码哈希、用哈希做联系人发现来保护用户，但事实证明不准确，因为现存电话号码数量足够少，哈希可以被暴力破解。我认为让使用这类服务的人（我也是其中之一）理解其局限很重要，但只要你想想联系人发现如何工作，这也有点不言自明：除非不再用电话号码交换联系人，否则没法绕开。所以这类研究帮助非技术用户理解服务的技术局限，很好！但说它们“威胁隐私”……这感觉严重歪曲了实际情况。每个社交技术网站/应用都有这个问题，而且可以在一定程度上缓解（检测扫描尝试、限流等）。同时，这些应用正在把端到端加密带给大众。这有点只见树木不见森林。
nbadg查看英文原文
I think it's important to put this into context. They're stating that a malicious user could crawl public info of other users, thereby building (over time) a behavioral model of those users. The theory that you could protect users from that by hashing phone numbers and using the hash for contact discovery, turns out not to be accurate, because there are few enough phone numbers in existence that you can just brute force the hash. I do think it's important for people using these kinds of services (and I'm one of them!) to understand their limitations, but I also kinda find this a bit self-evident, if you think about how contact discovery works. There's simply no way around it (unless you stop using phone numbers to exchange contacts). So in the sense that studies like these help educate non-technical users of the technical limitations of services, this is great! However, to say they "threaten privacy"... That feels like a gross mischaracterization of what's going on here. Every social technology site, app, etc, has this problem, and it's something that could be, to an extent, mitigated for (detection of scanning attempts, rate limiting, etc). Meanwhile, these are the apps that are bringing E2EE to the masses. It feels like missing the forest for the trees.
补充Signal 长期讨论该问题；新用户加入会通知通讯录中已开启通知的 Signal 用户，该通知可关闭。
Signal 已经讨论过联系人发现的相关问题很久了[1,2]。不过这项研究从新角度展示了该问题，我希望看到更好的解决方案。另外对 Signal 用户：可以关闭通知功能，但如果你新加入 Signal，你通讯录里的每个 Signal 用户都会收到通知，除非他们自己关掉了该功能。
sails查看英文原文
Signal has been discussing related issue on discovery [1,2] for a while. However this research shows this issue in a new light, and I'd be happy to see a better resolution. [1] https://github.com/signalapp/Signal-Android/issues/6750 [2] https://community.signalusers.org/t/why-are-users-who-have-my-phone-number-in-their-contacts-notified-that-ive-joined-signal/1320 Additionally for Signal users: It is possible to turn the notification feature off, but if you newly join Signal, every Signal user in your address book will be notified unless they have switched it off.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2020Hacker News 讨论帖287 分 · 86 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选