Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

Post reply on HN
Print view View original

31–40 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#31

Post by nmlt »

rakoo wrote: post #28
kitsunesoba wrote: post #20

Earlier quoted context omitted.

This underscores why it’s important to allow third party clients to connect. When only the first-party client is allowed, the failings of its UI drag down the core, too — it doesn’t matter how good the core is if it’s permanently mated to a half-baked UI.

And when third parties can connect, the protocol can't evolve because every change becomes "good to simplement" but it takes an enormous amount of time, resources And influence to change to "mandatory to implement". As always it's a delicate balance between security And ease of use, and Signal has always been up front in favoring the former.

That would be the case if they’d standardize the signal protocol. Letting third parties connect has nothing to do with that. Signal can still change their API any time they want.

Re: Signal on Android: Images sent to wrong contacts

#32

Post by antihero »

Barrin92 wrote: post #22
jerkstate wrote: post #11

Signal has been adding lots of silly social media like features lately, not surprising that they are messing up the core value prop. I’m shopping for a new encrypted messenger. They used to say every program expands in scope until it can read email, now every app expands until you can add Snapchat filters to your selfies.

is Wire still around and does somebody know if it's good? I remember reading about it because it used Haskell but I never tried it out.

They can't even be bothered to do 2FA

Re: Signal on Android: Images sent to wrong contacts

#33

Post by jchook »

jerkstate wrote: post #11

Signal has been adding lots of silly social media like features lately, not surprising that they are messing up the core value prop. I’m shopping for a new encrypted messenger. They used to say every program expands in scope until it can read email, now every app expands until you can add Snapchat filters to your selfies.

I use delta-chat (chat over imap) and it’s fantastic.

Decentralized / federated e2e chat, running on the Internet’s most well-known, resilient, universally supported, self-hostable infrastructure: email.

Re: Signal on Android: Images sent to wrong contacts

#35

Post by ubercow13 »

rvz wrote: post #10
johnchristopher wrote: post #3

> [..] his Signal randomly sending images to me that he didn't intend to, even without initiating the addition of any attachments on the GUI... he even sees one of my messages displayed on his side with a random image attached to it, as if i have sent that image to him, even though that image is not even present on my phone. https://github.com/signalapp/Signal-Android/issues/10247#iss... Yikes. > [..] I've also recen…

> I've also recently had a probably unrelated issue where my mic was still audible to the other party after I hung up the call. That one there is a cataclysmic security land mine. Absolutely unacceptable. That was the last straw after [0]. I don't think I can recommend Signal at this time. To Downvoters: So these bugs are all fine then? They are not security issues then? Not only having images being sent to the wrong…

Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition.

Which type of privacy breach is more likely to have tangible and direct negative effects on an average user's life - a nation state storing their communications in a database, Facebook graphing their contacts and using them for friend recommendations, or their friends/family/boss/acquaintances being sent random private photos from their phone and audio of private conversations they have in their home, without them knowing?

One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands.

Re: Signal on Android: Images sent to wrong contacts

#37

Post by 63 »

Several years ago I had this same issue occur in Facebook Messenger. I was using a pretty slow outdated device even for the time. I went to take a picture to send with the in-app camera. I actually pressed send before the picture rendered on my screen and somehow what was sent was not the picture I took, but a picture of some man's forehead who neither of us had ever seen before. It seemed like a pretty huge bug that could be a serious problem if anyone could reliably recreate it, which I could not. I went about trying to report it but ran into so many problems and broken links searching for Facebook's bug reporting that I gave up. Here's hoping it's been fixed, though I haven't used Messenger for at least a few years now anyway.

Re: Signal on Android: Images sent to wrong contacts

#38

Post by retrac »

nmlt wrote: post #31
rakoo wrote: post #28

Earlier quoted context omitted.

And when third parties can connect, the protocol can't evolve because every change becomes "good to simplement" but it takes an enormous amount of time, resources And influence to change to "mandatory to implement". As always it's a delicate balance between security And ease of use, and Signal has always been up front in favoring the former.

That would be the case if they’d standardize the signal protocol. Letting third parties connect has nothing to do with that. Signal can still change their API any time they want.

And Microsoft could in principle choose to do a hard break with all backwards compatibility in the next version of Windows. But they won't. Eventually, the third-party base may be so large and varied, that it becomes quite painful to actually make such a change even if the letter of the law says you can.

Re: Signal on Android: Images sent to wrong contacts

#39

Post by MrAwesome »

Several years ago, when I worked at FB, I ran into a similar bug on an early internal version of a Messenger rewrite. Sent pictures to one chat, showed up in another.

My bug report on it kicked off an absolute maelstrom of dev activity and investigation. High level engineers showed up in the comments. Lots of immediate followup. The severity was clearly understood and resolving it was clearly prioritized.

I exclusively use Signal now, but the discrepancy between what I see here and what I saw there is pretty disheartening. This kind of bug is not only a massive privacy risk, but it also massively erodes user confidence and trust.

Re: Signal on Android: Images sent to wrong contacts

#40

Post by [deleted] »

rakoo wrote: post #28
kitsunesoba wrote: post #20

Earlier quoted context omitted.

This underscores why it’s important to allow third party clients to connect. When only the first-party client is allowed, the failings of its UI drag down the core, too — it doesn’t matter how good the core is if it’s permanently mated to a half-baked UI.

And when third parties can connect, the protocol can't evolve because every change becomes "good to simplement" but it takes an enormous amount of time, resources And influence to change to "mandatory to implement". As always it's a delicate balance between security And ease of use, and Signal has always been up front in favoring the former.

[deleted]
Post reply on HN