131–140 of 403 posts
How can an unencrypted copy of some media end up at the wrong user? Isn't that supposed to be end-to-end encrypted, especially when stored on the signal servers?
E2EE won't protect you from a client accidentally encrypting and submitting files in the wrong chats.
Is this some kind of cache bug? Pretty serious, whatever it is, and judging by the linked issue, they either haven't taken it seriously, or worse, they aren't able to pinpoint the bug.
Earlier quoted context omitted.
But the issue is fixed. Forgetting to close a bug report is different than not fixing the bug
True, but the issue was fixed in 5.17, which was released only 10 days ago [1]. For an issue opened December last year, that's still quite a lot of time before a fix could be found. [1] https://github.com/signalapp/Signal-Android/commit/a47448b6c...
Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
Earlier quoted context omitted.
I use delta-chat (chat over imap) and it’s fantastic. Decentralized / federated e2e chat, running on the Internet’s most well-known, resilient, universally supported, self-hostable infrastructure: email.
I really like the idea of delta chat, except that I cannot bring myself to allow it access to my full imap mailbox. And most providers do not offer a way to scope access to only selected folders.
Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
I'm not sure if 8 months can be categorized as fast... The issue was posted on Dec 4, 2020, and the fix (5.17) was released on July 21.
Also, sounds like quite a big issue considering that Signal is all about privacy...
Earlier quoted context omitted.
Which is why I said at worst . Please read. Could you recommend a better chat app that is user friendly enough for regular people to use that is not Signal or WhatsApp and is cross platform? Quill are at least working on E2E, not introducing a cryptocurrency like Signal and don't require your phone number.
That is idiotic. It's strictly, objectively worse than Signal and not even acceptable in the worst case .
I'd rather use a chat app that takes security matters seriously and urgently and will eventually have E2E.
What's more 'idiotic' is prioritising and bolting on cryptocurrencies [0] than fixing urgent security issues, leaving it for months unfixed, while also claiming to be private and secure, and also requiring your phone number.
[0] https://www.wired.com/story/signal-mobilecoin-payments-messa...
Earlier quoted context omitted.
Some details on how this assumption was made would be nice, but I think it's pretty obvious that any developer involved in a project can make a reasonable assumption of how rare a bug is depending on the technical details on what is required for the bug to happen. For example, if we say for the sake of argument that a hypothetical bug requires you to have more than ten contacts of the exact same name and these also n…
>for the sake of argument that a hypothetical bug requires you to have more than ten contacts of the exact same name and these also need to share the same country and area code This is only rare if you have a small social circle. My circle has multiple first name-collisions of at least 5 participants, but my circle is not very big and the area code is also quite small. Some countries do not use area codes for mobile…
How can an unencrypted copy of some media end up at the wrong user? Isn't that supposed to be end-to-end encrypted, especially when stored on the signal servers?