this is very misleading:
- clarification: desktop only works when you have a mobile device setup and pair it like these (unless you virtualize android)
- if someone gets access to the phone number they can impersonate you and then obtain info from your contacts. they'll be notified of a change in your "safety number", but unless they're being vigilant they might still comply with the bad actor
- push notifications are somewhat insecure, but group chats have nothing to do with it. the attack you describe would work in any chat, and the resolution is the same: don't invite or accept chats you don't recognize, and always verify out of band.
- if you disable notifications or use f-droid it will not go through apple or google push notification servers
- bonus point: your best bet for device security is GrapheneOS (npub1kwa…e0nj) on a modern pixel. everything else is insecure by comparison
dead oppossum (npub1z45…w90t)
xyhhx :PunkFelix:
npub1xv…0dz5h
2024-07-31 22:47:20 UTC
in reply to nevent1q…8g7w
Author Public Key
npub1xvz84pej2wh3fxsrt0ll749jnfu0u9hqkp8wyvl2eg36fshhmtvqn0dz5hSeen on
wss://relay.momostr.pinkPublished at
2024-07-31 22:47:20 UTCEvent JSON
{
"id": "e9aa04cde4fb64fef08e2c2b8dd1cef3cf2e3d82ceb140a0230d157dbd4471af",
"pubkey": "33047a873253af149a035bffff54b29a78fe16e0b04ee233eaca23a4c2f7dad8",
"created_at": 1722466040,
"kind": 1,
"tags": [
[
"p",
"71cefa2e3716d1b5a288c64493b9ced1156d487ac3133e285d151463fe225383"
],
[
"p",
"b3ba3c5045fbaf99be9cb4daa9f1d7baeedaba0fc5b91596511e2fb7a70dd7f9"
],
[
"p",
"1568b9f00df77e1acb1ce389a3b990c38f0cec6d3c801c1dece1d931a5f24005"
],
[
"e",
"08f1d37cab99cc80e13d56be599fcc0a053726c6bd1e3ab007a05621e2a09f29",
"",
"reply",
"71cefa2e3716d1b5a288c64493b9ced1156d487ac3133e285d151463fe225383"
],
[
"e",
"ae834ec75198e946fcaf9e67ce0a83ce80423f43a696cd4fb13c1abb4adc22e6",
"",
"root",
"1568b9f00df77e1acb1ce389a3b990c38f0cec6d3c801c1dece1d931a5f24005"
],
[
"proxy",
"https://438punk.house/@xyhhx/112883534420972588",
"web"
],
[
"proxy",
"https://438punk.house/users/xyhhx/statuses/112883534420972588",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://438punk.house/users/xyhhx/statuses/112883534420972588",
"pink.momostr"
],
[
"-"
]
],
"content": "this is very misleading:\n\n- clarification: desktop only works when you have a mobile device setup and pair it like these (unless you virtualize android)\n- if someone gets access to the phone number they can impersonate you and then obtain info from your contacts. they'll be notified of a change in your \"safety number\", but unless they're being vigilant they might still comply with the bad actor\n- push notifications are somewhat insecure, but group chats have nothing to do with it. the attack you describe would work in any chat, and the resolution is the same: don't invite or accept chats you don't recognize, and always verify out of band.\n- if you disable notifications or use f-droid it will not go through apple or google push notification servers\n- bonus point: your best bet for device security is nostr:npub1kwarc5z9lwhen05uknd2nuwhhthd4ws0cku3t9j3rchm0fcd6luslse0nj on a modern pixel. everything else is insecure by comparison\n\nnostr:npub1z45tnuqd7alp4jcuuwy68wvscw8semrd8jqpc80vu8vnrf0jgqzs39w90t",
"sig": "eabb83ab359e7db2637749d77be57a72d96e9aa938f8335e4aa929017318cc080d06b0541a73947fceb6f5dfdd3c435e2bc6e060be1a28e479c8e70cb204e3ac"
}