Another flaw in Signal desktop app leaks chats in plaintext • Hacker News Board

Re: Another flaw in Signal desktop app leaks chats in plaintext

#91

Post by debacle » Fri, May 18, 2018, 2:12 AM UTC

twr wrote: post #84

seba_dos1 wrote: post #69

Earlier quoted context omitted.

>The Signal devs thought $.html() does some kind of escaping: Uhm... that's a really rookie mistake to make. Like, one of the very basics of jQuery usage. I'm not exactly sure what to think about it after seeing this commit you linked...

I don't know if this is correct, but, I once got the impression that Signal Desktop was under the sole purview of a new hire at OWS. In other words, Moxie doesn't review the commits. I hope I'm wrong, but even if I'm not, I suppose it makes no difference, as he's arguably responsible either way.

Isn't this supposed to be an app for secure communication? Theo would have a conniption.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#92

Post by bigiain » Fri, May 18, 2018, 2:19 AM UTC

08-15 wrote: post #58

tptacek wrote: post #43

Earlier quoted context omitted.

No matter what Signal does with Desktop, it will remain a standard desktop application, meaning it will in general be as secure as the least secure application sharing that desktop.

What's a desktop and what does it mean to share it? My applications share an X11 display, and if I'm not mistaken, they are pretty well isolated from each other. (Are you referring to MicroSoft Windows[TM] by any chance? Yeah, that's different.)

I dunno if it's still true, but it used to be that every process running in your X11 window had access to every keystroke from every other application. Like, say, every password you type into a terminal window or browser... If it _is_ still true (and I've noticed a bit of recent discussion asking why Ubuntu 18LTS is switching back from Wayland to X11 which hints to me that it might be), then your apps are _very_ much not "pretty well isolated"...

Re: Another flaw in Signal desktop app leaks chats in plaintext

#93

Post by verroq » Fri, May 18, 2018, 2:24 AM UTC

Is there a native Signal client that isn’t an Electron abomination?

It is clear at the point the Signal desktop people has no idea what they are doing and cannot be trusted to write a secure desktop application.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#94

Post by bigiain » Fri, May 18, 2018, 2:28 AM UTC

esaym wrote: post #62

tptacek wrote: post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

>Desktop applications are incredibly risky Oh so just use your phone that has a 100 background crapware apps running and a hidden baseband OS running under the parent OS/UI?

Signal runs just fine on an iPod Touch (after a little fussing around getting it set up with a phone number...)

If you're paranoid enough, it's easy enough to avoid installing things that're likely to be crapware on your secure comms device.

Apart from Signal, the only other non iOS supplied apps I have installed on mu iPod are a bitcoin wallet and Onion Browser - both of which I angst a little about, since they're both in the first category of app I'd attempt to subvert if I were a nation state actor, or a blackhat looking to steal bitcoin from people least likely to report it to authorities...

Re: Another flaw in Signal desktop app leaks chats in plaintext

#95

Post by kasey_junk » Fri, May 18, 2018, 2:30 AM UTC

4ad wrote: post #32

tptacek wrote: post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

Desktop applications are incredibly risky, yes; as for iOS mobile apps we can't even know, as these devices don't allow auditing what software is running on them. PGP has many problems and I hope a better replacement will come along, but the first step of secure messaging can't be using devices with closed, unauditable software...

A reason you are getting downvotes is that it’s not true that closed source software is unauditable.

This is a common but untrue belief. It’s a fundamental axciom of software security that you can’t trust source, so you must diagnose the binary.

Source may be helpful, but in the grand scheme of things lots of other properties are more important.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#96

Post by bigiain » Fri, May 18, 2018, 2:33 AM UTC

pvg wrote: post #65

esaym wrote: post #62

Earlier quoted context omitted.

>Desktop applications are incredibly risky Oh so just use your phone that has a 100 background crapware apps running and a hidden baseband OS running under the parent OS/UI?

Remember that time another app (and the baseband!) compromised Signal on iOS?

FWIW, the sort of people with access/leverage to be able to compromise a device through the baseband probably don't leave behind traces revealing it happened. They just drop hints to the local cops that they ought to find a reason to pull you over for a traffic stop and coincidentally smell pot smoke to give them probably cause to search your car...

(waves at the NSA guys...)

I _hope_ that sort of capability is still a year or two away from guys with an Ettus USPR and a bunch of open source software and hacking tools glued together with Python... But keep your eyes on DefCon and CCC to be sure...

Re: Another flaw in Signal desktop app leaks chats in plaintext

#97

Post by vjeux » Fri, May 18, 2018, 2:33 AM UTC

symlinkk wrote: post #7

tormeh wrote: post #5

Maybe secure chat clients shouldn't be written in JavaScript or other languages that have excessive dynamicness? Signal seems to be written mostly in languages that are bad for security (significantly worse than the best alternatives). Maybe I'm just a language nerd without any clue about the trade-offs, but I trust the Wire software more. Note that this just applies to mobile clients and server - Wire, like Signal,…

None of this is caused because of them using a dynamic language. It's caused because the developers used a function literally called "dangerouslySetInnerHTML" that doesn't escape HTML. That's it. It's just lazy programming.

We called it that way in React in order to call out attention to the fact that it was actually dangerous. React also properly escapes everything else it prints.

The app isn't using React but jQuery, which doesn't have those protections.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#98

Post by bigiain » Fri, May 18, 2018, 2:37 AM UTC

cornholio wrote: post #48

Jedi72 wrote: post #41

On their Android app, first thing it makes you do is give them permission to read your SMSs. It wont let you vefiry by entering a code. I immediately uninstalled - doesn't seem like a privacy focussed organisation to me.

That sounds absolutely horrendous. Even Whatsapp allows you to verify using a fixed line and claim that number on the mobile for privacy. Coupled with the recent LocationSmart revelations, it would make Signal unusable for those who wish to keep their location private. You absolutely need to provide the mobile number of the actual terminal being used.

Not true. I have Signal running in an iPod Touch.

I needed to give them a phone number I could read SMS from to set it up, but there's no need for that to be "the mobile number of the actual terminal being used".

Re: Another flaw in Signal desktop app leaks chats in plaintext

#99

Post by tptacek » Fri, May 18, 2018, 2:41 AM UTC

bigiain wrote: post #96

pvg wrote: post #65

Earlier quoted context omitted.

Remember that time another app (and the baseband!) compromised Signal on iOS?

FWIW, the sort of people with access/leverage to be able to compromise a device through the baseband probably don't leave behind traces revealing it happened. They just drop hints to the local cops that they ought to find a reason to pull you over for a traffic stop and coincidentally smell pot smoke to give them probably cause to search your car... (waves at the NSA guys...) I _hope_ that sort of capability is still…

They probably don't leave traces because compromising a modern Apple device through the baseband would be quite a trick, given that it's an independent peripheral connected to the AP over on-chip USB.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#100

Post by pvg » Fri, May 18, 2018, 2:46 AM UTC

bigiain wrote: post #96

pvg wrote: post #65

Earlier quoted context omitted.

Remember that time another app (and the baseband!) compromised Signal on iOS?

FWIW, the sort of people with access/leverage to be able to compromise a device through the baseband probably don't leave behind traces revealing it happened. They just drop hints to the local cops that they ought to find a reason to pull you over for a traffic stop and coincidentally smell pot smoke to give them probably cause to search your car... (waves at the NSA guys...) I _hope_ that sort of capability is still…

No, it's cheaper for them to just replace the person you're talking to with a Cylon.