Fixed: https://github.com/signalapp/Signal-Android/issues/10247#iss...
A rather vague explanation. Sounds a bit evasive.
Where is the commit that fixes it?
Signal on Android: Images sent to wrong contacts
81–90 of 403 posts
Re: Signal on Android: Images sent to wrong contacts
#82Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
Can you provide a link to the commit that fixes it?
Shouldn't there have been an announcement to inform users what has been leaked and under which circumstances?
How can user A send an image to user B that neither of them took? Isn't everything end-2-end encrypted? Then how can unencrypted data from user C end up on the device of user B?
Re: Signal on Android: Images sent to wrong contacts
#83Signal has been adding lots of silly social media like features lately, not surprising that they are messing up the core value prop. I’m shopping for a new encrypted messenger. They used to say every program expands in scope until it can read email, now every app expands until you can add Snapchat filters to your selfies.
I hate the new ability to add emoji responses to message chat bubbles. It has turned my conversations (especially group ones) into a Facebook like experience where everyone expects a cry face emoji or heart on everything they say. It gives me that same feeling of dread I used to get when I had a Facebook. I just want to send and receive text messages, not be engaged constantly to my phone.
Which makes it like using Slack!
I for one would rather they spent less time on these ‘features’.
Re: Signal on Android: Images sent to wrong contacts
#84Re: Signal on Android: Images sent to wrong contacts
#85Earlier quoted context omitted.
I use delta-chat (chat over imap) and it’s fantastic. Decentralized / federated e2e chat, running on the Internet’s most well-known, resilient, universally supported, self-hostable infrastructure: email.
How does delta deal with new chats, fallback and other standard email client stuff? Does it allow mixing encrypted and unencrypted messages? What happens if I use an alternative mail client, will I still be able to read email from people after the project dies and the clients stop working? I don't think people will appreciate it when I suddenly start using email as a standard communications method, but it's worth a s…
> Does it allow mixing encrypted and unencrypted messages? What happens if I use an alternative mail client, will I still be able to read email from people after the project dies and the clients stop working?
Yes. It uses the AutoCrypt standard, which exists independent of delta chat and has standalone software, + plugins for various email clients. I use a plugin for mutt so I can read my delta chat messages without the official client. You can issue new key pairs or turn off e2e as you like.
> I don't think people will appreciate it when I suddenly start using email as a standard communications method, but it's worth a shot
Fair, though perhaps technically simpler than getting others to download Yet Another Chat App™.
> ...previous failures to secure email, like PGP, S/MIME and variations thereof.
Did PGP and S/MIME fail? Services like ProtonMail use that tech to great effect. IMO it never hit the main stream because mainstream mail providers, etc want to read your email. There's some argument about usability but after using ProtonMail I don't buy those arguments.
Re: Signal on Android: Images sent to wrong contacts
#86Signal has been adding lots of silly social media like features lately, not surprising that they are messing up the core value prop. I’m shopping for a new encrypted messenger. They used to say every program expands in scope until it can read email, now every app expands until you can add Snapchat filters to your selfies.
Every time something like this comes up, I say something like, "Who wants to switch to Matrix (ie, Element, and before that, Riot Chat)?" But then, I myself don't end up doing it, largely because of the network effect on Signal. I think we need to just remember to always keep 3-5 of them open so we can have some horizontal evolution.
I’ve tried Element. I think Signal is probably easier to setup and use for most non-technical people on comparison.
Re: Signal on Android: Images sent to wrong contacts
#87Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable.
How can users be assured that this type of issue won't occur again?
Re: Signal on Android: Images sent to wrong contacts
#88Earlier quoted context omitted.
I use delta-chat (chat over imap) and it’s fantastic. Decentralized / federated e2e chat, running on the Internet’s most well-known, resilient, universally supported, self-hostable infrastructure: email.
How does delta deal with new chats, fallback and other standard email client stuff? Does it allow mixing encrypted and unencrypted messages? What happens if I use an alternative mail client, will I still be able to read email from people after the project dies and the clients stop working? I don't think people will appreciate it when I suddenly start using email as a standard communications method, but it's worth a s…
It seems to use E2E encryption with some trust-on-first-use protocol called Autocrypt:
Re: Signal on Android: Images sent to wrong contacts
#89> [..] his Signal randomly sending images to me that he didn't intend to, even without initiating the addition of any attachments on the GUI... he even sees one of my messages displayed on his side with a random image attached to it, as if i have sent that image to him, even though that image is not even present on my phone. https://github.com/signalapp/Signal-Android/issues/10247#iss... Yikes. > [..] I've also recen…
The first issue was fixed and just closed, and seems like it was very difficult to track down.
It's fixed in 5.17 and this is the release number I see on the Google playstore.
Unfortunately for my ubuntu 18.04 LTS and this is in no way Signal's fault (but maybe the desktop version doesn't have that bug ?):
$ apt-cache policy signal-desktop
signal-desktop:
Installé : 5.10.0
Candidat : 5.10.0
Table de version :
*** 5.10.0 500
500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages
100 /var/lib/dpkg/status
5.9.0 500
500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages
5.8.0 500
500 https://updates.signal.org/desktop/apt xenial/main amd64 PackagesRe: Signal on Android: Images sent to wrong contacts
#90Earlier quoted context omitted.
Which this bug was left open for months while users were experiencing this privacy issue. How can I recommend a chat app that does this and claim they are a privacy based app? and also does not respond to urgent bugs in this manner?
I'm not saying you should recommend Signal, just pointing out that "there are audits, why does it have such bugs" doesn't tell the entire story.
> just pointing out that "there are audits, why does it have such bugs" doesn't tell the entire story.
So? Isn't that the point though? Having regular audits should have caught this issue? I thought this being 'open source' this would made this even easier.
Which leads me to believe a team that has $60M~ in funding is unable to fix this issue in a matter of urgency.
Remember this issue was open for half a year with users noticing this, no matter how you slice this, this issue does not give me any more confidence in Signal being secure.