Signals, Intelligence

ELI5: The Axolotl Ratchet

The Address Book is the Social Network

Yo’ Metadata So Fat It Uses Google Earth To Take A Selfie

  • Specific location (home, place of work, etc.)
  • Mobility pattern (from home, via commuter route, to work) — very unique, just 4 locations is enough to identify 90% of people.
  • Paired mobility pattern with a known device (known as “mirroring”, when two or more devices travel together; including car telemetry!)
  • IMEI (mobile phone device ID)
  • IMSI (mobile phone telco subscriber ID)
  • Identifiers, e.g. names, locations
  • Voice fingerprinting
  • Keywords

The Map is the Territory

  1. Your ISP knows you sent and/or received data from the Signal server. They know when and they know how much.
  2. Google (and/or Apple) know that the Signal app on a specific device received a notification, and at what time.
  3. Open Whisper Systems knows which device sent and received messages, at which time, and to whom.
  4. Open Whisper Systems know which device is registered to which phone number.

The Metadata is the Message

--

--

--

Information Security Researcher :: https://gru.gq :: keybase.io/grugq :: https://www.patreon.com/grugq

Love podcasts or audiobooks? Learn on the go with our new app.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
thaddeus t. grugq

thaddeus t. grugq

Information Security Researcher :: https://gru.gq :: keybase.io/grugq :: https://www.patreon.com/grugq

More from Medium

We Got it WRONG When it Comes to the CIA Triad

The Philosophy of Enigma Machine

Myth Busting the Biggest Cybersecurity Buzzwords

plagues, aliens, and artificial intelligence… by an optimist (of sorts)