Embed Notice

Technical details tl;dr:

- Signal (and other communication platforms) uses Cloudflare with caching enabled for media

- one can check on which Cloudflare endpoints a given attachment URL got cached (one can use a VPN for this), giving them the ability to roughly geolocate users whose Signal downloaded the file

- a patched version of Signal (or whatever app) allows the attacker to send the message with an image, and extract the attachment URL to know what URL to check for having been cached