Careless Whisper: Silently Monitoring Users on Mobile Instant Messengers

Postedabout 1 month agoActive23 days ago

Original: Exploiting silent delivery receipts to monitor users on instant messengers

wakawaka28

10 points

3 comments

arxiv.orgResearchstory

informativeneutral

Debate

40/100

Online SafetyInstant MessagingData_security

Key topics

Online Safety

Instant Messaging

Data_security

Discussion Activity

Light discussion

First comment

N/A

Peak period

Day 12

Avg / period

1.3

Key moments

01Story posted
Nov 28, 2025 at 11:38 PM EST
about 1 month ago
Step 01
02First comment
Nov 28, 2025 at 11:38 PM EST
0s after posting
Step 02
03Peak activity
2 comments in Day 12
Hottest window of the conversation
Step 03
04Latest activity
Dec 10, 2025 at 12:25 PM EST
23 days ago
Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (3 comments)

Showing 4 comments

rzl

about 1 month ago

1 reply

This has been making the rounds in privacy-focused forums and whatnot and still no comment from the foundation. That doesn't inspire a lot of confidence in the Signal Foundation. If nothing else, I would expect that sending delivery receipts to invalid messages be considered a bug to fix, even if sending delivery receipts in general would be intentional.

Stefan-H

23 days ago

An attacker with a privileged position on the network allowing them to eavesdrop (but not decrypt) traffic could use a bug like this to identify the device on the network associated with a phone number in Signal. Given nation state level adversaries, that seems like a significant privacy issue to me.

8cvor6j844qw_d6

23 days ago

Related reading. Might be of interest while on this topic.

[1] https://www.pressherald.com/2024/02/29/the-fbis-new-tactic-c...

wakawaka28Author

about 1 month ago

Full Title: "Careless Whisper: Exploiting Silent Delivery Receipts to Monitor Users on Mobile Instant Messengers"

View full discussion on Hacker News

ID: 46085197Type: storyLast synced: 12/10/2025, 5:25:22 PM

Want the full context?