Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another flaw in Signal desktop app leaks chats in plaintext

thehackernews.com

Post reply on HN
Print view View original

181–190 of 232 posts

Re: Another flaw in Signal desktop app leaks chats in plaintext

#181

Post by codedokode »

hawkice wrote: post #160
ddtaylor wrote: post #107

I don't know if this is exploitable, but they are using many different methods to escape HTML content: https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1... Then here it's a different function: https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1... Then sometimes they use the underscore library to do it: https://github.com/signalapp/Signal-Desktop/blob/d1f7f5ee8c1... Which their implementation seem…

The first one doesn't escape single quotes or slash, but I have no idea how to get any HTML parser to treat just those as anything but text. Underscore's implementation will be correct, I'm sure.

Slash doesn't need to be encoded. Only 5 characters that have special meaning have to be encoded (&, , " and ').

Re: Another flaw in Signal desktop app leaks chats in plaintext

#182

Post by def_true_false »

al_chemist wrote: post #44
tptacek wrote: post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

> don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are. It's risky to use an open source OS. If you are serious about security, use Android or iOS. Instead of direct ssl connection to XMPP server, it's much safer to send all your data with Google Cloud Messaging. /s Desktop computers are currently the most open sourced, least opaque, least spyware…

I'm pretty sure Signal doesn't send all your data through GCM.

Edit: https://support.signal.org/hc/en-us/articles/217524107

Re: Another flaw in Signal desktop app leaks chats in plaintext

#183

Post by rando444 »

ccnafr wrote: post #178

Wasn't this domain imitating the actual Hacker News banned years ago? Plus, I think they violate rules because this is just blog spam. The actual source of the story is: https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injec...

I don't see anything imitating this website.. other than a technology based news feed and a similarly used name.

I used to browse a website called "hacker news" back in the late 90s / early 2000s, but I wouldn't go as far as to call News YC a copy of that.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#184

Post by codedokode »

jancsika wrote: post #136
tptacek wrote: post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

> Desktop applications are incredibly risky, far more so than iOS mobile apps are. Ok, I'll play. I get to choose 10 arbitrary apps from the Apple App store for you to install on an Iphone model of your choice. You get to choose 10 arbitrary apps for me to install from the default Debian repos (which I believe excludes nonfree). Let's say Sid to make it interesting. Who is going to be in worse shape after installing…

Mobile OS have much better isolation between apps than Debian has. In default Debian configuration any app can access all of your data, microphone, webcam, Internet, GPS sensors etc. While the maintainers do a good job reviewing all of the software, having isolation on OS level provides better security.

For example, Chrome has process sandboxing. It might seem unnecessary because the code is written by highly professional developers, but it helps Chrome to be the most difficult to exploit browser. I am sure that if Debian could adopt something similar to Android permission system, it would make it even more secure.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#185

Post by belorn »

tedunangst wrote: post #157
RVuRnvbM2e wrote: post #150

Earlier quoted context omitted.

Doesn't that answer assume some or all of the following? a) Apple does a better job reviewing apps than Debian maintainers do. b) iPhone app code is better quality than Debian packages. c) iOS sandboxing is better than Linux. Default configuration may mean c) is true. However not if you use wayland, apparmor, seccomp, namespaces etc. What do you think about a) and b)?

The beep local root suggests the Debian review system has room to improve. It's a pretty deep barrel. You're sure there's no crud at the bottom?

How is the beep local root different from jail breaks in the past? Seems both are local privilege exploit, and I recall seeing that iphone has had a long list of those in the past.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#186

Post by hawkice »

codedokode wrote: post #181
hawkice wrote: post #160

Earlier quoted context omitted.

The first one doesn't escape single quotes or slash, but I have no idea how to get any HTML parser to treat just those as anything but text. Underscore's implementation will be correct, I'm sure.

Slash doesn't need to be encoded. Only 5 characters that have special meaning have to be encoded (&, , " and ').

Which raises the best question: how would you exploit someone not escaping single quotes? I do not know. Perhaps it isn't possible.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#187

Post by ccnafr »

rando444 wrote: post #183
ccnafr wrote: post #178

Wasn't this domain imitating the actual Hacker News banned years ago? Plus, I think they violate rules because this is just blog spam. The actual source of the story is: https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injec...

I don't see anything imitating this website.. other than a technology based news feed and a similarly used name. I used to browse a website called "hacker news" back in the late 90s / early 2000s, but I wouldn't go as far as to call News YC a copy of that.

I was referring to the fact of imitating the HN brand by capitalizing on the domain name so they could scoop up all the traffic and SEO love. That's why the domain was banned to begin with a few years back. There was a whole discussion about it.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#188

Post by lmm »

aidenn0 wrote: post #164
tptacek wrote: post #43

Earlier quoted context omitted.

No matter what Signal does with Desktop, it will remain a standard desktop application, meaning it will in general be as secure as the least secure application sharing that desktop.

Is there currently any desktop application delivery/sandboxing mechanism that has any hope of changing this situation in the future?

Something like Qubes is the only way we'll ever get decent security on the desktop, I'd say.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#189

Post by lmm »

bigiain wrote: post #94
esaym wrote: post #62

Earlier quoted context omitted.

>Desktop applications are incredibly risky Oh so just use your phone that has a 100 background crapware apps running and a hidden baseband OS running under the parent OS/UI?

Signal runs just fine on an iPod Touch (after a little fussing around getting it set up with a phone number...) If you're paranoid enough, it's easy enough to avoid installing things that're likely to be crapware on your secure comms device. Apart from Signal, the only other non iOS supplied apps I have installed on mu iPod are a bitcoin wallet and Onion Browser - both of which I angst a little about, since they're b…

If you're willing to adopt "run a dedicated device for crypto" approach, something like Tails running on a USB-key-like device gives you the same kind of security position and without having to trust Apple.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#190

Post by jscissr »

hawkice wrote: post #186
codedokode wrote: post #181

Earlier quoted context omitted.

Slash doesn't need to be encoded. Only 5 characters that have special meaning have to be encoded (&, , " and ').

Which raises the best question: how would you exploit someone not escaping single quotes? I do not know. Perhaps it isn't possible.

I think escaping quotes only matters for attributes (which can use ' or "). Example:
Exploit:

    foo.jpg" onload="alert('pwned')
Post reply on HN