[HN Gopher] Strava was used to locate the most powerful people
___________________________________________________________________
Strava was used to locate the most powerful people
Author : kawera
Score : 63 points
Date : 2024-10-29 20:08 UTC (2 hours ago)
(HTM) web link (www.theguardian.com)
(TXT) w3m dump (www.theguardian.com)
| abetusk wrote:
| Strava is a fitness app. So, apprently, the security detachment
| of political figures tends to use the app, presumably because
| they're into fitness and keep in shape, and their location can be
| tracked through the app.
|
| As the security detachment tend to travel with the people they
| protect, political leaders locations can be inferred.
|
| The article talks about body guards not being allowed to use
| social media/apps while on the job, they allow for provisions on
| use when not on active duty. So, I guess, the guards get a day
| off, use the app, wherever they are, broadcasting their location.
|
| Crazy stuff.
| netsharc wrote:
| Yeah, the targetting isn't that difficult, I guess. If you know
| crown prince Akeem Joffer was in New York 5 days ago, and is in
| Paris 3 days ago, you can probably diligently query Strava
| users who weren't in New York for a long time but showed up 5
| days ago, and see if they showed up in Paris 3 days ago, and
| boom, you've found a member of his entourage.
|
| Even if they use the anonymizing feature that masks their
| start/end points, if you find a few other members, you could be
| able to triangulate a big hotel near them and guess that that's
| where the crown prince stayed... and the next time you hear
| he's coming to NY/Paris, you have this information.
| kkielhofner wrote:
| Shouldn't be much of a surprise, this made news back in 2018
| when the same was realized with soldiers and secret military
| bases:
|
| https://www.theguardian.com/world/2018/jan/28/fitness-tracki...
| mandevil wrote:
| Cell phone tracking is better at surveillance than the best stuff
| the military has.
|
| https://www.washingtonpost.com/national-security/2024/02/22/...
| has a fun story about a time at Fort Irwin (US Army laser tag in
| the desert) one side couldn't figure out how an attack helicopter
| got through their defenses, until they did some queries on a
| commercial cell phone tracking database and found the cellphone
| moving across the desert at 120mph. Hole identified, plugged for
| the next round.
|
| And also talks about how the Ukrainians and Russians are having a
| great deal of trouble with cell phone OPSEC even after years of
| shooting war.
| taeric wrote:
| Probably not better than the best stuff the military has...
| Still really good, mind.
|
| And, yeah, unintended uses are usually prime locations for
| security breaches. For a long time (maybe still?) metadata on
| pictures that people post would reveal far more than people
| meant. Thumbnails of cropped pictures, even.
| FactKnower69 wrote:
| >Probably not better than the best stuff the military has...
|
| Military tech is always a decade ahead of civilian, that's
| why the US has easily won every armed conflict they've
| entered into in the past 50 years
| chatmasta wrote:
| I'm not sure this has been true since the advent of the
| internet. I don't believe there's an entire shadow sphere
| of academia that is decades ahead of what's openly
| published.
|
| For nuclear energy, this might be true. But for nearly any
| other topic I'm very skeptical.
| paganel wrote:
| > has easily won every armed conflict they've entered into
| in the past 50 years
|
| That's just false. Ok, maybe you don't count Vietnam,
| because the US "entered" there in the '60s, but Afghanistan
| was a sure loss and I'd say the same for Iraq (seeing how
| it's now in Iran's sphere of influence, which it wasn't
| under Saddam). Yes, they might have won some tactical
| battles, most probably all of them, come to think of it,
| but the wars themselves were lost.
| magicalhippo wrote:
| > That's just false.
|
| Read like sarcasm to me.
| JohnMakin wrote:
| I know for a fact that swaths of critical military
| infrastructure sit in AWS, so I personally doubt this is
| true.
| beAbU wrote:
| Have they though?
| jklinger410 wrote:
| Cell phone tracking _is_ what the military has.
|
| Seeing through walls with WiFi is better. Or slurping up the
| main pipes and decrypting it. Which they also have.
| wildzzz wrote:
| An old coworker used to work on what is basically a Stingray
| for air platforms with some sort of directional finding
| capability. Presumably, you'd strap it to a drone and fly it
| over villages where you suspect bad guys are. Do this every few
| days and in multiple locations and you'd establish patterns of
| movements and links between networks of people.
| mikeryan wrote:
| Along these lines some cyclists have had their gear stolen by
| thieves who figured out where they live from Strava data.
|
| They have a feature to block part of your route when near your
| home but some folks aren't aware of it (or learn the hard way)
| nickff wrote:
| That feature is fairly recent, and I believe it is now enabled
| by default.
| hondo77 wrote:
| If by "is fairly recent" you mean "has been around for over
| six years", yes.
| slibhb wrote:
| Was there a breach with Strava or did people simply choose to
| publish their location publicly?
| basiccalendar74 wrote:
| not a data breach
| pndy wrote:
| They recently introduced "Athlete Intelligence" [1][2] feature
| that wasn't received well by users so I'd guess this is a pr
| stunt so people would forget about it
|
| [1] -
| https://www.forbes.com/sites/cyrusfarivar/2024/10/12/strava-...
|
| [2] - https://communityhub.strava.com/t5/strava-features-
| chat/opt-...
| sam_lowry_ wrote:
| The problem with Strava is how invasive their location sharing
| is.
|
| One has to actively search to disable it. And the integrations
| with Garmin Connect and the others are even worse.
| notatoad wrote:
| it's not "invasive", it's a location sharing app.
|
| if you don't want to share your location, you probably should
| not use location-sharing apps.
| RobRivera wrote:
| A fitness app that features location-sharing features.
|
| When I think of location sharing apps, I think of garmin
| inreachme for search amd rescue.
| blackeyeblitzar wrote:
| What's the point of Strava? Can't people easily cheat on the
| results to outcompete others? Like what happens if I use an
| e-bike to beat the best times?
| r00fus wrote:
| Strava is a social app with a gamification angle. I use the
| social to share my rides (only) with people who follow me and
| to view people I follow to get inspired.
|
| I also use the gamification to compete - but really only
| against myself.
| jerlam wrote:
| There is no reward for getting the best time. Also, the people
| that you beat are extremely motivated to investigate and flag
| your activity; it will look pretty obvious that it was ridden
| on an e-bike due to incorrect / missing data like heart rate
| and wattage.
|
| I have the record on a short inconsequential running course
| near me. I occasionally get a notification that someone beat my
| record and I am forced to look at it; it is always someone on a
| bike or car, and I flag it and it eventually goes away. Also,
| my own record activity has been flagged multiple times despite
| it only being slightly faster than the second place finisher -
| I no longer bother trying to contest it. The joke is on the
| flagger since I have run the exact same record time, several
| times, so I still have the course record.
| bigiain wrote:
| Not everyone is as chill about that as you.
|
| https://www.forbes.com/sites/kashmirhill/2012/06/20/a-quanti.
| ..
| mikeryan wrote:
| The vast majority of Strava users are only competing with
| themselves or, at best, to be atop a daily leaderboard for a
| somewhat popular segment.
| recursive wrote:
| It's fun. Don't take the leaderboards too seriously. The kind
| of people that would care about high placement at any cost tend
| not to be the kind of people who care about strava. (mostly)
|
| People that can legitimately get a KOM on a segment tend to be
| known in a local community. If someone new shows up at #1, it's
| pretty obvious looking at their workout if its legit or not to
| someone familiar with the sport.
|
| What's the point of wikipedia? Can't people just easily publish
| fake information? Like what happens if I make an article about
| myself?
|
| It's pretty much a solved problem.
| Beretta_Vexee wrote:
| The cycling leaderboard around where I live are full of
| professional cyclists capable of overtaking an e-bike while
| remaining in zone 2. People don't use Strava in the hope of
| getting a good place on the board but to compare themselves
| with their friends, club members and the pros.To follow their
| own development and that of their friends, to discover new
| paths, new events, and so on.
|
| Above all, it's a social network based around sport. No baby
| photos, no politics, just people happily practising their sport
| - it's the anti-Tweeter and it's great.
| netsharc wrote:
| In video form (the Guardian article talks about a Le Monde
| investigation):
|
| - Pt 1: https://www.youtube.com/watch?v=4eQKnV0zsMc
|
| - Pt 2: https://www.youtube.com/watch?v=KX7f1PwXEWg
| homarp wrote:
| https://www.lemonde.fr/en/international/article/2024/10/29/p...
| netsharc wrote:
| Zelensky has suddenly perked up...
|
| The 2nd video focuses on the US Secret Service, finding 26
| profiles of Biden's protection (and 100+ users who were
| geolocated inside the S.S. training facility). During the
| credits of that video, a journalist says, "Despite our
| warning about this issue to the US authorities, 14 of the 26
| profiles are still public."
| r00fus wrote:
| This is why I only use Strava to share with my followers.
|
| Yes, it's an extra step after my workout to edit, add pics if
| any, choose my activity level if I was too lazy to put on my HR
| monitor, and then only post to my followers.
|
| Yes, this means I get less likes and can't participate in
| challenges etc. But it's really about sharing with my colleagues
| and friends so they can motivate me for my next ride.
| marcellus23 wrote:
| You can set your activities to be private by default, you don't
| need to change it for every activity individually after you
| upload it.
| r00fus wrote:
| Yes, mine are. I explicitly share some activities.
| zardo wrote:
| > This is why I only use Strava to share with my followers.
|
| You travel with one of the most powerful people in the world?
| tonymet wrote:
| I wouldn't trust their security restrictions. Their API and
| authentication is primitive. For a while I ran a basic bot to
| automate data extraction. Their security is 20+ years behind
| other social networks .
|
| You likely have bot followers and API calls that can read your
| latest activity GPX data
| loeg wrote:
| Facebook is barely 20 years old. No active social network is
| "20+ years" advanced of any other, because it's longer than
| their entire history.
| soco wrote:
| It's not clear to me whether the location was made using the
| public, as in shared, information, or information set as
| private. So did they masquerade as followers, or hacked the
| system?
| loeg wrote:
| You're a bodyguard for a head of state? Probably no one cares
| about your location.
| OgsyedIE wrote:
| The simplest solution to this is bureaucratic. Establish an app
| approval cybersecurity office within some agency and have the
| office make two lists: apps that have specific security
| configurations that need to be enabled and apps that are outright
| banned.
|
| Then you just make compliance with the lists necessary for
| certain security clearances.
| Muromec wrote:
| Nononon, you make one list:
|
| - apps that are allowed to be installed, pinned by version with
| a person responsible for monitoring them
| tonymet wrote:
| Strava has suffered from this and had known attacks for 10+ years
| now. There was a famous case around Colorado of a mistaken
| doxxing attack driven by Reddit. Due to mistaken identity,
| attackers pursued an innocent victim using their Strava account.
| The Strava location was the cause of both the mistaken identity
| case and abused to find and dox the victim.
|
| Strava's anonymization algorithm (the bubble feature) is
| primitive and trivially de-anonymized with basic triangulation.
|
| The company has never adequately responded to privacy concerns
| despite many abuse cases.
| paganel wrote:
| People should just stop using Strava, or at least stop making
| their Strava data public to the world (not sure if that's an
| option cause I've never used that app). They should just
| run/cycle, whatever, forget about gps.
| loeg wrote:
| > not sure if that's an option cause I've never used that app
|
| You can make your account private, or individual activities
| private (including by default).
| loeg wrote:
| > Strava's anonymization algorithm (the bubble feature) is
| primitive and trivially de-anonymized with basic triangulation.
|
| That is not true. It picks a single random centroid _near_ your
| privacy location and does the privacy feature based on that.
| Triangulation finds the random centroid, which is crucially
| _not_ your hidden location.
| TrevorJ wrote:
| Not sure if the format for this article is standard these days,
| but oh man do I hate it.
| davidsawyer wrote:
| Reads like a remix of how Axios articles are.
| cj wrote:
| Related:
|
| Strava heatmap can be used to locate military bases -
| https://news.ycombinator.com/item?id=16249955 - Jan 2018 (271
| comments)
|
| Turns out soldiers enjoy tracking their runs around the base!
| aynyc wrote:
| Strava deserves all the blames it get, but don't you need some
| serious skills to find out who are the agents guarding
| Biden/Harris/Trump? I mean, if you can literally track down the
| names of Secret Service agents guarding VIPs, then you can
| probably easily track them with other means (phone for example)
| no?
|
| Speaking out of most likely ignorance of Secret Service, I was in
| the US Marines. I dealt with marine snipers a few times during
| training exercises, we were mainly serve as security protections.
| I've seen them train, shoot and handle combat scenarios. If any
| of those marine snipers want to take shot at a VIP, I can't
| imagine Secret Service will be able to do anything to stop it.
| Some of the snipers are putting rounds into a postal stamp at
| 1,000 yard / 900 meters.
| loeg wrote:
| > Strava deserves all the blames it get
|
| Not sure why Strava deserves any blame here. It's explicitly a
| social network for sharing your location and other training
| data. If you use it and share your location, that's it
| functioning exactly as designed.
| MR_Bulldops wrote:
| Strava has (rightfully) received no blame, so they were
| accidentally right!
| loeg wrote:
| It's pretty clear that at least some users in this thread
| blame Strava for some things.
| kjrfghslkdjfl wrote:
| FitoTrack.
|
| That's all I have to say about this.
| harry8 wrote:
| I also endorse FitoTrack on droid as a user.
|
| Along with Out-Run on iphone.
|
| Both work well and are pleasant to use. Record your exercise
| for yourself with no cloud.
| TheRealPomax wrote:
| I guess strava users didn't learn from the first time.
___________________________________________________________________
(page generated 2024-10-29 23:01 UTC)