Fixed in 5.17, though I only have 5.16.1 available to me despite the fact it’s supposed to be available from a few days ago.
My Android phone has 5.17.3. What platform are you on?
Signal on Android: Images sent to wrong contacts
91–100 of 403 posts
Re: Signal on Android: Images sent to wrong contacts
#92Signal has been adding lots of silly social media like features lately, not surprising that they are messing up the core value prop. I’m shopping for a new encrypted messenger. They used to say every program expands in scope until it can read email, now every app expands until you can add Snapchat filters to your selfies.
It’s not enough for signal to work for tech people. You have to be able to convince your family and friends to use it, it’s a network effects problem. They are adding features so that ordinary people can have private communications
ordinary people don't give a flying f** about being able to send someone crypto currency via their messaging app.
Re: Signal on Android: Images sent to wrong contacts
#93Earlier quoted context omitted.
Email. Why are we still trying to push these instant messaging apps that are a privacy and security nightmare? (I realise email has security issues too).
Email has weaker EtoE encryption than these IM solutions. Even with GPG. Too much metadata is leaked. However the decentralised nature of email is one crucial advantage it has over these apps.
You could in theory (but this is like putting plasters on a colander) relocate some of the MIME meta data (Subject:, To:, From:) to the email body and then encrypt it.
So basically obfuscate the MIME headers and use some kind of guid@domain type addresses for the MTA routing.
Re: Signal on Android: Images sent to wrong contacts
#94Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?
‘Many forms of secure messaging systems have been tried, and will be tried in this world of sin and woe. No one pretends that Signal is perfect or all-wise. Indeed it has been said that Signal is the worst messaging except for all those other forms that have been developed from time to time…’
Winston S Churchill, 11 November 1947
Re: Signal on Android: Images sent to wrong contacts
#95How can an unencrypted copy of some media end up at the wrong user? Isn't that supposed to be end-to-end encrypted, especially when stored on the signal servers?
Re: Signal on Android: Images sent to wrong contacts
#96Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
> This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-submitted logs to try to track it down.
Without telemetry, can you actually back up the claim that this issue was extremely rare?
Re: Signal on Android: Images sent to wrong contacts
#97I love Signal and have advocated for its use. But I have to say that this issue is trust-breaking.
I lovingly forgive the occasional bug or unpolished feature and I understand that the team behind Signal are human and that programming is hard. But sending messages to the wrong people is very high on the list of things a messenger should never ever ever do!
Having an issue like this remain open for 7.5 months hints at a systemic issue, which is probably be related to Signal being underfunded/understaffed. But regardless of the reason and of everyone's good intentions, the fact remains that similar issues can and probably will happen again, and may again take months to fix.
Re: Signal on Android: Images sent to wrong contacts
#98Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?
How much did you pay for it again?
Re: Signal on Android: Images sent to wrong contacts
#99The bugfix comments says:
> The TL;DR is that if someone had conversation trimming on, it could create a rare situation where a database ID was re-used in a way that could result in this behavior.
How is this bug even possible with E2E encryption?
If picture.png exists on user A's phone and gets sent to user B, shouldn't it be client-side encrypted in such a way that user C, even if they receive it via some database ID screwup, are unable to view it (because it was encrypted with user B's public key)?
Re: Signal on Android: Images sent to wrong contacts
#100Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?
Probably by installing some hardened memory on your phone to prevent cosmic bitflips or the such.
Unless you are going to go to NASA lengths of hardware reliability, you can't really hope much for the software that has to deal with the issues of... how many different android phones are there?