CloudflareCDN 0click location deanonymization attack targeting Signal, Discord and other platforms

Personally, I don’t see what you expect Signal to do except use a CDN with fewer endpoints. And if they did that, then messages would load slower.

Signal already defaults to not relaying calls, which means that for calls between contacts, your IP is directly exposed to the other party. This is done for performance, quality, and cost-saving reasons.

If you’re worried about protecting your IP from websites you connect to, including Cloudflare and other CDNs, then this is a good advertisement for using a VPN or Tor.

Note that if you use a VPN in the default setting of “Recommended”, “Fastest”, or similar, then this may not do much against this specific issue. You’ll connect from your IP to the nearest VPN IP with capacity and then to the nearest CDN entry point.

Maybe the biggest takeaway is that users should always assume that the IP address that they are using to access online resources can be discovered (or estimated) by more parties than they may expect, and to take steps to protect it accordingly.

@phnx SimpleX uses server routing to help mitigate against things like this, but even they suggest using Orbot.

10 Likes