People Nearby is a service offered by Telegram that allows a user to discover other Telegram users, based only on geographical proximity. Nearby users are reported with a rough estimate of their distance from the position of the reference user, allowing Telegram to claim location privacy In this paper, we systematically analyze the location privacy provided by Telegram to users of the People Nearby service. Through an extensive measurement campaign run by spoofing the user's location all over the world, we reverse-engineer the algorithm adopted by People Nearby to compute distances between users. Although the service protects against precise user localization, we demonstrate that location privacy is always lower than the one declared by Telegram of 500 meters. Specifically, we discover that location privacy is a function of the geographical position of the user. Indeed, the radius of the location privacy area (localization error) spans between 400 meters (close to the equator) and 128 meters (close to the poles), with a difference of up to 75% (worst case) compared to what Telegram declares. After our responsible disclosure, Telegram updated the FAQ associated with the service. Finally, we provide some solutions and countermeasures that Telegram can implement to improve location privacy. In general, the reported findings highlight the significant privacy risks associated with using People Nearby service.

翻译：“附近的人”是Telegram提供的一项功能，允许用户基于地理邻近性发现其他Telegram用户。附近用户会显示其与参照用户位置之间的粗略距离估计，这使得Telegram声称用户的位置隐私得到保护。本文系统分析了Telegram“附近的人”服务为用户提供的位置隐私保护水平。通过在全球范围内伪造用户位置进行大规模测量活动，我们逆向解析了“附近的人”用于计算用户间距离的算法。尽管该服务可防止精确定位用户，但我们证明其实际位置隐私保护水平始终低于Telegram声明的500米。具体而言，我们发现位置隐私保护范围与用户地理位置相关：位置隐私区域半径（定位误差）在赤道附近为400米，在极地附近为128米，与Telegram声明值相比最大差异达75%（最坏情况）。在负责任披露后，Telegram已更新该服务相关FAQ。最后，我们提出Telegram可采用的若干解决方案与改进措施以提升位置隐私保护。总体而言，本研究的发现揭示了使用“附近的人”服务所伴随的重大隐私风险。