Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another flaw in Signal desktop app leaks chats in plaintext

thehackernews.com

Post reply on HN
Print view View original

51–60 of 232 posts

Re: Another flaw in Signal desktop app leaks chats in plaintext

#51

Post by saagarjha »

tormeh wrote: post #5

Maybe secure chat clients shouldn't be written in JavaScript or other languages that have excessive dynamicness? Signal seems to be written mostly in languages that are bad for security (significantly worse than the best alternatives). Maybe I'm just a language nerd without any clue about the trade-offs, but I trust the Wire software more. Note that this just applies to mobile clients and server - Wire, like Signal,…

JavaScript may have many problems, but I don't really think security is one of them. In a properly isolated sandbox, such as a web browser, it's much more difficult to gain arbitrary code execution privileges than a native desktop app.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#52

Post by saagarjha »

tptacek wrote: post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

A properly sandboxed desktop application is no more dangerous than an iOS app. Of course, Chrome doesn't work in that sandbox, and they're using Electron, so this doesn't quite work.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#53

Post by saagarjha »

JasonFruit wrote: post #40
tptacek wrote: post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

This may or may not be true, but in a lot of cases where you need encryption, you also need not to have a GPS tracker on you while you're using it. You have (at least slightly) more chance of being anonymous with a dedicated laptop computer than you have with any smartphone.

Ignoring the recent LocationSmart revelations, if you disable location access you should basically have the same level of geospatial anonymity.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#54

Post by [deleted] »

ams6110 wrote: post #45
pfg wrote: post #9

Earlier quoted context omitted.

As much as I'm not a fan of JavaScript, the problem is not so much the language but rather the choice of Electron and all that comes with it. Heck, even a web version or Chrome app would've successfully mitigated these attacks. Electron means you're one XSS away from remote code execution, and even worse, it makes it way harder to mitigate XSS through CSP (which Signal did utilize, but script-src 'self' can easily be…

> Electron means you're one XSS away from remote code execution So, electron is the new flash. I'll be avoiding that, then.

[deleted]

Re: Another flaw in Signal desktop app leaks chats in plaintext

#55

Post by 08-15 »

rixrax wrote: post #23
JasonFruit wrote: post #10

When will people start using plain old PGP — a tool that does one thing only, and does it right? Sure, it's a little harder than using just one tool that handles contacts, communication, formatting, and encryption, while making popcorn and walking the dog, but it works, and it's secure if you use it right. Our efforts to make encryption easy are going to get someone killed.

Surely this is sarcasm. Just in case it isn't, it's only fitting to link back to what Moxie Marlinspike wrote about PGP/GPG: https://moxie.org/blog/gpg-and-me/ (HN commentary: https://news.ycombinator.com/item?id=9104188 ). TL;DR: When will people start using gpg: they won't.

After reading that article I want to use PGP just so I never run the risk of interacting with people like Moxie.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#56

Post by saagarjha »

tptacek wrote: post #43
08-15 wrote: post #38

Earlier quoted context omitted.

Care to explain? I mean, in principle. I distrust Signal Desktop, whether it's built on Chrome or on Electron, because either of those "platforms" are more complex than my OS (Debian GNU/Linux). But you seem to be making a more general point... what's the reasoning?

No matter what Signal does with Desktop, it will remain a standard desktop application, meaning it will in general be as secure as the least secure application sharing that desktop.

If all your software comes from the App Store and is properly sandboxed, it's possible for this to approach the security of iOS. Of course, many people will install unsandboxed software, making this extremely difficult to actually achieve, but it's at least possible.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#57

Post by rndgermandude »

pfg wrote: post #9
tormeh wrote: post #5

Maybe secure chat clients shouldn't be written in JavaScript or other languages that have excessive dynamicness? Signal seems to be written mostly in languages that are bad for security (significantly worse than the best alternatives). Maybe I'm just a language nerd without any clue about the trade-offs, but I trust the Wire software more. Note that this just applies to mobile clients and server - Wire, like Signal,…

As much as I'm not a fan of JavaScript, the problem is not so much the language but rather the choice of Electron and all that comes with it. Heck, even a web version or Chrome app would've successfully mitigated these attacks. Electron means you're one XSS away from remote code execution, and even worse, it makes it way harder to mitigate XSS through CSP (which Signal did utilize, but script-src 'self' can easily be…

While I agree that Electon offers a massive amount of footguns, neither Javascript nor Electon was the issue in this case. The issue was using innerHTML (or rather $.html()) with strings concatenated together from user input. Something you should never do. Could as well just call eval() directly on it, or pass the input to gcc, compile it and run the resulting binary.

The Signal devs thought $.html() does some kind of escaping: https://github.com/signalapp/Signal-Desktop/commit/9d41b8616... (this commit made something that was easy to exploit into something that was even easier to exploit).

To be honest, I'd lay more blame on the authors of the DOM spec making innerHTML a setter than on Electron, and jQuery exposing this misfeature even more with $.html(), teaching an army of web developers to do the wrong thing. We've all seen numerous (XSS) vulnerabilities in all kinds of websites, browser extensions, Electron apps, etc resulting from this API, tho in Electron apps it gets particularly devastating as often you'd get code execution not just in a sandboxed website but full code execution under the current user credentials in the system.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#58

Post by 08-15 »

tptacek wrote: post #43
08-15 wrote: post #38

Earlier quoted context omitted.

Care to explain? I mean, in principle. I distrust Signal Desktop, whether it's built on Chrome or on Electron, because either of those "platforms" are more complex than my OS (Debian GNU/Linux). But you seem to be making a more general point... what's the reasoning?

No matter what Signal does with Desktop, it will remain a standard desktop application, meaning it will in general be as secure as the least secure application sharing that desktop.

What's a desktop and what does it mean to share it?

My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. (Are you referring to MicroSoft Windows[TM] by any chance? Yeah, that's different.)

Re: Another flaw in Signal desktop app leaks chats in plaintext

#59

Post by dasyatidprime »

08-15 wrote: post #58
tptacek wrote: post #43

Earlier quoted context omitted.

No matter what Signal does with Desktop, it will remain a standard desktop application, meaning it will in general be as secure as the least secure application sharing that desktop.

What's a desktop and what does it mean to share it? My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. (Are you referring to MicroSoft Windows[TM] by any chance? Yeah, that's different.)

What are you using for X security context isolation? I've been wanting a good solution for that one for a while now, and the end of my list is still “write my own isolating proxy” since I never found a good one.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#60

Post by e12e »

saagarjha wrote: post #53
JasonFruit wrote: post #40

Earlier quoted context omitted.

This may or may not be true, but in a lot of cases where you need encryption, you also need not to have a GPS tracker on you while you're using it. You have (at least slightly) more chance of being anonymous with a dedicated laptop computer than you have with any smartphone.

Ignoring the recent LocationSmart revelations, if you disable location access you should basically have the same level of geospatial anonymity.

There's a "herd immunity" component - if you're in a group of 10 000 people with GPS tracking on - your position might be possible to guess quite precisely based on meta data like IP, network latency etc - that can be compared across a large population.
Post reply on HN