Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another flaw in Signal desktop app leaks chats in plaintext

thehackernews.com

Post reply on HN
Print view View original

61–70 of 232 posts

Re: Another flaw in Signal desktop app leaks chats in plaintext

#61

Post by ehPReth »

mintplant wrote: post #27
pfg wrote: post #9

Earlier quoted context omitted.

As much as I'm not a fan of JavaScript, the problem is not so much the language but rather the choice of Electron and all that comes with it. Heck, even a web version or Chrome app would've successfully mitigated these attacks. Electron means you're one XSS away from remote code execution, and even worse, it makes it way harder to mitigate XSS through CSP (which Signal did utilize, but script-src 'self' can easily be…

Signal Desktop actually used to be a Chrome app. Then Google announced the deprecation of that feature and they ported it over to Electron.

Sad day for Chrome OS users. No more Signal updates! :(

Re: Another flaw in Signal desktop app leaks chats in plaintext

#62

Post by esaym »

tptacek wrote: post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

>Desktop applications are incredibly risky

Oh so just use your phone that has a 100 background crapware apps running and a hidden baseband OS running under the parent OS/UI?

Re: Another flaw in Signal desktop app leaks chats in plaintext

#63

Post by pfg »

rndgermandude wrote: post #57
pfg wrote: post #9

Earlier quoted context omitted.

As much as I'm not a fan of JavaScript, the problem is not so much the language but rather the choice of Electron and all that comes with it. Heck, even a web version or Chrome app would've successfully mitigated these attacks. Electron means you're one XSS away from remote code execution, and even worse, it makes it way harder to mitigate XSS through CSP (which Signal did utilize, but script-src 'self' can easily be…

While I agree that Electon offers a massive amount of footguns, neither Javascript nor Electon was the issue in this case. The issue was using innerHTML (or rather $.html()) with strings concatenated together from user input. Something you should never do. Could as well just call eval() directly on it, or pass the input to gcc, compile it and run the resulting binary. The Signal devs thought $.html() does some kind o…

So to be clear, a lot of the blame definitely belongs in the "all that comes with it" bucket here, which is one of the reasons why you should think twice about developing desktop apps using a platform that forces you to deal with not only the usual desktop app security concerns, but also all the things that make web apps vulnerable.

Still, when you ship an app with a relatively strict Content Security Policy as Signal did (including using script-src 'self'), you don't really expect a simple XSS vulnerability to lead to RCE, but it turns out that policy doesn't really do much in an Electron app.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#64

Post by e12e »

08-15 wrote: post #58
tptacek wrote: post #43

Earlier quoted context omitted.

No matter what Signal does with Desktop, it will remain a standard desktop application, meaning it will in general be as secure as the least secure application sharing that desktop.

What's a desktop and what does it mean to share it? My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. (Are you referring to MicroSoft Windows[TM] by any chance? Yeah, that's different.)

> My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other.

You are probably mistaken.

https://github.com/esonn/x11log

http://blog.martin-graesslin.com/blog/2015/01/why-screen-loc...

You might want to look at qubesos :

https://www.qubes-os.org/doc/gui/

Re: Another flaw in Signal desktop app leaks chats in plaintext

#65

Post by pvg »

esaym wrote: post #62
tptacek wrote: post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

>Desktop applications are incredibly risky Oh so just use your phone that has a 100 background crapware apps running and a hidden baseband OS running under the parent OS/UI?

Remember that time another app (and the baseband!) compromised Signal on iOS?

Re: Another flaw in Signal desktop app leaks chats in plaintext

#66

Post by e12e »

dasyatidprime wrote: post #59
08-15 wrote: post #58

Earlier quoted context omitted.

What's a desktop and what does it mean to share it? My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. (Are you referring to MicroSoft Windows[TM] by any chance? Yeah, that's different.)

What are you using for X security context isolation? I've been wanting a good solution for that one for a while now, and the end of my list is still “write my own isolating proxy” since I never found a good one.

See: https://www.qubes-os.org/doc/gui/

(they have essentially written 2500 lines of c that acts as a proxy of sorts)

Re: Another flaw in Signal desktop app leaks chats in plaintext

#67

Post by caf »

rndgermandude wrote: post #57
pfg wrote: post #9

Earlier quoted context omitted.

As much as I'm not a fan of JavaScript, the problem is not so much the language but rather the choice of Electron and all that comes with it. Heck, even a web version or Chrome app would've successfully mitigated these attacks. Electron means you're one XSS away from remote code execution, and even worse, it makes it way harder to mitigate XSS through CSP (which Signal did utilize, but script-src 'self' can easily be…

While I agree that Electon offers a massive amount of footguns, neither Javascript nor Electon was the issue in this case. The issue was using innerHTML (or rather $.html()) with strings concatenated together from user input. Something you should never do. Could as well just call eval() directly on it, or pass the input to gcc, compile it and run the resulting binary. The Signal devs thought $.html() does some kind o…

Surely the collective noun for footguns is a cache :)

Re: Another flaw in Signal desktop app leaks chats in plaintext

#68

Post by 08-15 »

dasyatidprime wrote: post #59
08-15 wrote: post #58

Earlier quoted context omitted.

What's a desktop and what does it mean to share it? My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. (Are you referring to MicroSoft Windows[TM] by any chance? Yeah, that's different.)

What are you using for X security context isolation? I've been wanting a good solution for that one for a while now, and the end of my list is still “write my own isolating proxy” since I never found a good one.

Nothing... but can X11 applications actually steal data from each other? I wouldn't know how to do that, but I know precious little about the X11 protocol. (Screen shots are an awkward option, I guess.)

If I was worried enough (I'm not), I could use multiple logins. Two different X servers under different users would be completely isolated.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#69

Post by seba_dos1 »

rndgermandude wrote: post #57
pfg wrote: post #9

Earlier quoted context omitted.

As much as I'm not a fan of JavaScript, the problem is not so much the language but rather the choice of Electron and all that comes with it. Heck, even a web version or Chrome app would've successfully mitigated these attacks. Electron means you're one XSS away from remote code execution, and even worse, it makes it way harder to mitigate XSS through CSP (which Signal did utilize, but script-src 'self' can easily be…

While I agree that Electon offers a massive amount of footguns, neither Javascript nor Electon was the issue in this case. The issue was using innerHTML (or rather $.html()) with strings concatenated together from user input. Something you should never do. Could as well just call eval() directly on it, or pass the input to gcc, compile it and run the resulting binary. The Signal devs thought $.html() does some kind o…

>The Signal devs thought $.html() does some kind of escaping:

Uhm... that's a really rookie mistake to make. Like, one of the very basics of jQuery usage. I'm not exactly sure what to think about it after seeing this commit you linked...

Re: Another flaw in Signal desktop app leaks chats in plaintext

#70

Post by tedunangst »

pvg wrote: post #65
esaym wrote: post #62

Earlier quoted context omitted.

>Desktop applications are incredibly risky Oh so just use your phone that has a 100 background crapware apps running and a hidden baseband OS running under the parent OS/UI?

Remember that time another app (and the baseband!) compromised Signal on iOS?

No?
Post reply on HN