Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

Post reply on HN
Print view View original

161–170 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#161

Post by eganist »

greysonp wrote: post #78

Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…

Question: do you guys have a software or product security team? I suggested the roles to workwithus @ Signal on 5/18/2018 and have never seen a public follow-up in the form of career postings.

Asking because such a team may be best equipped to serve as both the support and internal accountability function for such while minimizing business conflicts when engineering is facing challenges integrating security into DevOps natively.

At this point, it's probably warranted; the last time I asked was when Signal was seeing its spree of XSS defects in the desktop app. If Signal has one, a simple "yes" will suffice, but without a reply, I have to assume not.

Re: Signal on Android: Images sent to wrong contacts

#162

Post by markovbot »

dmosley wrote: post #49
ubercow13 wrote: post #35

Earlier quoted context omitted.

Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition. Which type of privacy breach is more likely to have tangible and direct negative effects on an average user's life - a nation state storing their communications in a database, Facebook graphing their contacts and using them for friend recommendations, or their friends/family/boss/acquaintances be…

I agree these bugs that Signal has are serious. With hat said, your examples aren't that great for counters. "a nation state storing their communications in a database" - The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison. "Facebook graphing their contacts and using them for friend recommendations" - but, it's not just for friend recommendations and poss…

>The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison.

wasn't that kind of the point?

Re: Signal on Android: Images sent to wrong contacts

#163

Post by renewiltord »

lwhi wrote: post #87
greysonp wrote: post #78

Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

The answer is that you can’t be assured. Act as you will with that info.

Re: Signal on Android: Images sent to wrong contacts

#164

Post by tylermenezes »

greysonp wrote: post #78

Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…

> we were able to get a fix out very quickly.

Is 6 months really what Signal considers quick for a bug that leaks private data?

Re: Signal on Android: Images sent to wrong contacts

#165

Post by renewiltord »

deanCommie wrote: post #103
johnchristopher wrote: post #7

While I suppose the protocol is not at fault and it's a UI and client bug it's still a huge problem. Just today I was thinking ”it's been weeks since they moved the GIF button to a different place but there's still the old button at the old place and when you click on it there's a pop-up "wrong, the button is somewhere else now"”. Why even keep the old button in the old place ? And it led me to thinking "what else co…

> Just today I was thinking ”it's been weeks since they moved the GIF button to a different place but there's still the old button at the old place and when you click on it there's a pop-up "wrong, the button is somewhere else now"”. That's actually a UX FEATURE. Google Maps did exactly the same thing when they reorganized and move the toggle between maps/satelite/traffic layers. The answer is pretty straightforward:…

Yeah, I actually like this UI feature. I would have been very frustrated if they had just changed it over on Google Maps. I use Timeline all the time and it was important to me.

Re: Signal on Android: Images sent to wrong contacts

#166

Post by renewiltord »

ikiris wrote: post #92
Rd6n6 wrote: post #24

Earlier quoted context omitted.

It’s not enough for signal to work for tech people. You have to be able to convince your family and friends to use it, it’s a network effects problem. They are adding features so that ordinary people can have private communications

ordinary people don't give a flying f** about being able to send someone crypto currency via their messaging app.

But everyone wants to send money or money-equivalents. I use Venmo almost every other day.

Re: Signal on Android: Images sent to wrong contacts

#167

Post by colesantiago »

dunefox wrote: post #144
colesantiago wrote: post #138

Earlier quoted context omitted.

How can you be so sure if you haven't tried it? I'd rather use a chat app that takes security matters seriously and urgently and will eventually have E2E. What's more 'idiotic' is prioritising and bolting on cryptocurrencies [0] than fixing urgent security issues, leaving it for months unfixed, while also claiming to be private and secure, and also requiring your phone number. [0] https://www.wired.com/story/signal-m…

I agree that adding a crypto coin the way they did it is idiotic as well. But I wouldn't ditch an encrypted app for one that will 'eventually' be E2E encrypted. matrix.org is E2E encrypted and secure now and it's being used by France and Germany.

Matrix / Element is unfortunately just far too technical for end users and the general population, but it is better than IRC.

A mistake was the naming, for example you refer to the name of the protocol 'Matrix' instead of the name of the client 'Element'. Having a naming issue risks confusing lots of people, other than that I have already mentioned it as an alternative.

Re: Signal on Android: Images sent to wrong contacts

#168

Post by helmholtz »

geofft wrote: post #157
nerbert wrote: post #94

Earlier quoted context omitted.

‘Many forms of secure messaging systems have been tried, and will be tried in this world of sin and woe. No one pretends that Signal is perfect or all-wise. Indeed it has been said that Signal is the worst messaging except for all those other forms that have been developed from time to time…’ Winston S Churchill, 11 November 1947

Sure, but there's a small theoretical difference with democracy. You have to live under some system of government. You don't have to use a secure messenger. You can choose to have sensitive conversations in person or not have them at all. I agree that in practice, a lot of people are going to use their phones for relatively sensitive conversations, and in practice, Signal remains the best choice for doing so. But the…

You make some fair points. But even from the eyes of those people, what is the alternative? Is iMessage guaranteed to not have any hidden exploits out there? And on the flip side, what do they lose out on by only having those conversations in person? Well, I'd argue that their world becomes a lot smaller, and there sources are instantly at a higher risk.

Re: Signal on Android: Images sent to wrong contacts

#169

Post by WesolyKubeczek »

hnarn wrote: post #104
andrewguenther wrote: post #96

Earlier quoted context omitted.

> This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-submitted logs to try to track it down. Without telemetry, can you actually back up the claim that this issue was extremely rare?

Some details on how this assumption was made would be nice, but I think it's pretty obvious that any developer involved in a project can make a reasonable assumption of how rare a bug is depending on the technical details on what is required for the bug to happen. For example, if we say for the sake of argument that a hypothetical bug requires you to have more than ten contacts of the exact same name and these also n…

> a hypothetical bug requires you to have more than ten contacts of the exact same name and these also need to share the same country and area code

Sounds like the village a part of my family tree comes from.

Re: Signal on Android: Images sent to wrong contacts

#170

Post by NullPrefix »

desine wrote: post #139
NullPrefix wrote: post #126

Earlier quoted context omitted.

>for the sake of argument that a hypothetical bug requires you to have more than ten contacts of the exact same name and these also need to share the same country and area code This is only rare if you have a small social circle. My circle has multiple first name-collisions of at least 5 participants, but my circle is not very big and the area code is also quite small. Some countries do not use area codes for mobile…

>for the sake of argument

Yes.

And for the sake of the same argument I made a counter argument, stating that some initially believed to be rare circumstances are actually not that rare.

Post reply on HN