This is a year-old paper but now there is an easy-to-use implementation of the attack: https://github.com/gommzystudio/device-activity-tracker
Signal developers’ verdict is WONTFIX: https://github.com/signalapp/Signal-Android/pull/14463
This is a year-old paper but now there is an easy-to-use implementation of the attack: https://github.com/gommzystudio/device-activity-tracker
Signal developers’ verdict is WONTFIX: https://github.com/signalapp/Signal-Android/pull/14463
You can literally turn off read receipts in signal
But you can’t turn off delivery receipts, which is what this attack uses.
But you can turn off sealed sender messages from anyone, so they’d have to already be a trusted contact
The setting to mitigate this attack (so that only people who know your username can do it, instead of anybody who knows your number) is called Who Can Find Me By Number. According to the docs, setting it to nobody requires also setting Who Can See My Number to nobody. Those two settings are both entirely unrelated to Signal’s “sealed sender” thing, which incidentally is itself cryptography theater, btw.