Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes, I read it. Information about your IP address is leaked, as that's how Cloudflare routes you to a given datacenter.

And I strongly disagree that being able to uncover somebody's rough geographic location is not a privacy problem.

I wouldn't be surprised if this, for example, lets you deduce if somebody is currently home, at work, or commuting (as all three ISPs might be hitting different Cloudflare datacenters). That's not information everybody is comfortable broadcasting to the world.



If you aren't comfortable broadcasting it, then maybe take measures so that it doesn't get to that point. Privacy is not by default, ever


To quote Signal themselves:

> Privacy isn’t an optional mode — it’s just the way that Signal works. Every message, every call, every time [1]

While I don't consider this a critical bug requiring an immediate technical remediation from Signal, this should definitely be either fixed or called out in the documentation at some point.

[1] https://support.signal.org/hc/en-us/articles/360007320391-Is...


The sentence before the one you quoted gives the essential context:

> Signal conversations are always end-to-end encrypted, which means that they can only be read or heard by your intended recipients.

They're not saying that it is an anonymisation proxy, they're saying the messages and calls are encrypted for the recipient rather than to the server


They also use AWS so good luck using it on your actual IP


Privacy by default is Signal's entire brand


Weather predictions are the weather channel's entire brand, but people understand the concept well enough to know that this doesn't mean it's infallible. There is a limit to how many warning stickers we need in the world. If you want to rely on a particular feature, maybe check that the product supports said feature. Signal does encryption, not onion routing




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: