Looks like this was fixed [1]. Doesn't fill me with confidence if this type of issue can occur though.
[1] https://github.com/signalapp/Signal-Android/issues/10247#iss...
Signal on Android: Images sent to wrong contacts
51–60 of 403 posts
Re: Signal on Android: Images sent to wrong contacts
#52Well, from a glass half-full perspective this provides a user with perfect plausible deniability about any illegal content found on Signal on their phone, or a message claiming to be from them to another user.
Maybe it's a feature, not a bug ? :)
Re: Signal on Android: Images sent to wrong contacts
#53Fixed on 7/21. Forgot to close the issue:
Re: Signal on Android: Images sent to wrong contacts
#54Earlier quoted context omitted.
This underscores why it’s important to allow third party clients to connect. When only the first-party client is allowed, the failings of its UI drag down the core, too — it doesn’t matter how good the core is if it’s permanently mated to a half-baked UI.
And when third parties can connect, the protocol can't evolve because every change becomes "good to simplement" but it takes an enormous amount of time, resources And influence to change to "mandatory to implement". As always it's a delicate balance between security And ease of use, and Signal has always been up front in favoring the former.
This doesn't have to be the case. Look at how stripe does it with their API which would be a disaster if older versions just stopped working. Versioning is doable even with chat apps.
Re: Signal on Android: Images sent to wrong contacts
#55> [..] his Signal randomly sending images to me that he didn't intend to, even without initiating the addition of any attachments on the GUI... he even sees one of my messages displayed on his side with a random image attached to it, as if i have sent that image to him, even though that image is not even present on my phone. https://github.com/signalapp/Signal-Android/issues/10247#iss... Yikes. > [..] I've also recen…
> webworxshop opened this issue on 4 Dec 2020
Triple yikes.
Though it looks like the issue was finally closed minutes ago:
> Hi there, sorry, this issue was fixed in 5.17 (which hit 100% production on 7/21). There was another issue tracking this and it looks like I forgot to close this one.
Still, that's a lot of time for such a bug to exist!
Re: Signal on Android: Images sent to wrong contacts
#56Earlier quoted context omitted.
> I've also recently had a probably unrelated issue where my mic was still audible to the other party after I hung up the call. That one there is a cataclysmic security land mine. Absolutely unacceptable. That was the last straw after [0]. I don't think I can recommend Signal at this time. To Downvoters: So these bugs are all fine then? They are not security issues then? Not only having images being sent to the wrong…
Why on Earth are people downvoting you? This is an absolute dealbreaker for any messaging app, much less one whose raison d'etre is privacy and secure messaging.
Probably because the common mindset here is that anyone can make a mistake, and that the person who did it learned their lesson and will never do it again.
Re: Signal on Android: Images sent to wrong contacts
#57> [..] his Signal randomly sending images to me that he didn't intend to, even without initiating the addition of any attachments on the GUI... he even sees one of my messages displayed on his side with a random image attached to it, as if i have sent that image to him, even though that image is not even present on my phone. https://github.com/signalapp/Signal-Android/issues/10247#iss... Yikes. > [..] I've also recen…
The first issue was fixed and just closed, and seems like it was very difficult to track down.
It was closed 4 minutes ago; when was it fixed? ETA: Ah, 4 days ago (more than half a year after it was opened).
Re: Signal on Android: Images sent to wrong contacts
#58While I suppose the protocol is not at fault and it's a UI and client bug it's still a huge problem. Just today I was thinking ”it's been weeks since they moved the GIF button to a different place but there's still the old button at the old place and when you click on it there's a pop-up "wrong, the button is somewhere else now"”. Why even keep the old button in the old place ? And it led me to thinking "what else co…
This is the same app that only 6 months ago had an outage lasting more than a full day[0] - an outage that to my knowledge remains unexplained. The protocol is one thing but these clowns are obviously not careful or reliable engineers.
[0] https://www.theverge.com/2021/1/17/22235707/signal-back-app-...
Re: Signal on Android: Images sent to wrong contacts
#59Earlier quoted context omitted.
> Has this app/service really been audited properly? Yes, repeatedly: https://community.signalusers.org/t/wiki-overview-of-third-p... Edit: that said, this did make me revisit a question I asked signal via their Careers portal a long while back. Reposted here: https://news.ycombinator.com/item?id=27952315
And yet there are serious bugs like this that slip through the net, a simple benchmark of any chat app should not be showing other people's messages like what Signal is doing. I would expect that an app that has repetitive audits would have resulted in this bug being fixed already.
At least the main audits are clearly described as auditing internal components, so it's not surprising app-level errors aren't covered by them.
Re: Signal on Android: Images sent to wrong contacts
#60Signal has been adding lots of silly social media like features lately, not surprising that they are messing up the core value prop. I’m shopping for a new encrypted messenger. They used to say every program expands in scope until it can read email, now every app expands until you can add Snapchat filters to your selfies.
I use delta-chat (chat over imap) and it’s fantastic. Decentralized / federated e2e chat, running on the Internet’s most well-known, resilient, universally supported, self-hostable infrastructure: email.
How does delta deal with new chats, fallback and other standard email client stuff? Does it allow mixing encrypted and unencrypted messages? What happens if I use an alternative mail client, will I still be able to read email from people after the project dies and the clients stop working?
I don't think people will appreciate it when I suddenly start using email as a standard communications method, but it's worth a shot. The client looks like a copy of Telegram (a good thing, in my opinion) and everyone already has email, so I'm willing to give it a shot I guess. I'm currently on the Matrix camp but it's not like that's a protocol many non techs use in the real world.
I'm just wary of using email for this because of all of the previous failures to secure email, like PGP, S/MIME and variations thereof.