A security researcher made a tool that let them quickly check which of Cloudflare's data centers had cached an image, which allowed them to figure out what city a Discord, Signal, or Twitter/X user might be in.

cross-posted from: https://lemmy.ca/post/37638868 !privacy@lemmy.dbzer0.com

This affects Signal too

An issue with Cloudflare allows an attacker to find which Cloudflare data center a messaging app used to cache an image, meaning an attacker can obtain the approximate location of Signal, Discord, Twitter/X, and likely other chat app users. In some cases an attacker only needs to send an image across the app, with the target not clicking it, to obtain their location.

https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117?ref=404media.co

Signal, an open-source encrypted messaging service, is widely used by journalists and activists for its privacy features. Internally, the app utilizes two CDNs for serving content: cdn.signal.org (powered by CloudFront) for profile avatars and cdn2.signal.org (powered by Cloudflare) for message attachments.

    • theunknownmuncher@lemmy.worldEnglish
      17·
      14 days ago

      I support this because most all cloudflare websites require browser fingerprinting otherwise they will not serve you the page. The moment I enable the jShelter addon, I am cut off from a significant portion of the internet

    • melroy@kbin.melroy.org
      13·
      13 days ago

      Fully agreed, sorry to see people down voting you. But the Internet was not meant to be run by a single company called Cloudflare, it’s a dangerous prospective. Since the more people depend on Cloudflare the more powerful it become and the more depend people will become. We need alternative solutions to protect against DoS and more.

  • boaratio@lemmy.worldEnglish
    12·
    13 days ago

    I don’t want to be a contrairian, but your cellphone carrier does this non stop. Cloudflare is not a good company, but this is the least of your problems.

      • boaratio@lemmy.worldEnglish
        7·
        13 days ago

        I’m not trying to wear a tinfoil hat, but Snowden clearly revealed that the government is easily able to purchase cellphone location data based on GPS and tower data more easily than they can go through the FISA courts.

        • Danitos@reddthat.comEnglish
          3·
          13 days ago

          Your cellphone provider very likely already sells this data.

          I know mine does, because I attended a webinar of a buying company where they explicitly mentioned this.

        • ByteOnBikes@slrpnk.netEnglish
          2·
          13 days ago

          Ah, thought you meant though metadata. Like a end user snooping through some obscure meta data method (even after cleaning) let’s you triangulate something.

  • melroy@kbin.melroy.org
    7·
    13 days ago

    Another reason to not use Cloudflare. Not that long ago they also “lost the log records” (this incident happened on November 14, 2024). I strongly believe the internet can become better without Cloudflare, especially now basically the whole world is depending on it.

    • sunzu2@thebrainbin.org
      7·
      13 days ago

      It is impossible to use most of corpo internet if you block cloudflare. Shit is wild.

      Not sure who is down voting you lol

      I wish people would respond with a rebuttal so we can move convo forward.

      • melroy@kbin.melroy.org
        2·
        12 days ago

        I also have no idea why is down voting me lol. But you are 100% right. Could you imagine in the year 2000 that everything needs to behind Cloudflare in 2025 in order to have a functional internet? This shit is indeed wild.

    • melroy@kbin.melroy.org
      2·
      12 days ago

      Sorry to see so many people still down vote me. What is wrong with you? The internet has become a joke. Moving all to cloudflare will only make the problem worse.