Signal on Android: Images sent to wrong contacts • Hacker News Board

Re: Signal on Android: Images sent to wrong contacts

#181

Post by goodpoint » Sun, Jul 25, 2021, 8:19 PM UTC

lwhi wrote: post #87

greysonp wrote: post #78

Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

> How can users be assured that this type of issue won't occur again?

By writing code defensively. Despite the other comments, it's possible.

The key is to be redundant: for example, off-by-one errors are very common when accessing an set of indexed items by number.

Yet you can split the set (e.g. an array) in multiple ones to make it more unlikely that you pick the wrong item (e.g. picture vs users).

You can also "tag" the outgoing image with some attributes, e.g. the recipient and a sent/not-sent flag.

You can cross-check and stop if something is inconsistent. Many other things are possible e.g. to protect from RAM bit flips.

It's not a matter of language or tooling, it's a matter of mindset.

Re: Signal on Android: Images sent to wrong contacts

#182

Post by NullPrefix » Sun, Jul 25, 2021, 8:20 PM UTC

hutrdvnj wrote: post #178

NullPrefix wrote: post #172

Earlier quoted context omitted.

Your argument depends on Signal implementing username support, because we do not support unicode in phone numbers.

My argument depends on an alternate universe in which signal supports it, everything else being equal, because why not.

Does that alternate universe support phone numbers with unicode characters too?

Re: Signal on Android: Images sent to wrong contacts

#183

Post by hnarn » Sun, Jul 25, 2021, 8:22 PM UTC

NullPrefix wrote: post #170

desine wrote: post #139

Earlier quoted context omitted.

>for the sake of argument

Yes. And for the sake of the same argument I made a counter argument, stating that some initially believed to be rare circumstances are actually not that rare.

"For the sake of argument" does not mean "I invite you to debate this", it means the exact opposite: "let's assume this is correct/we agree/etc. for a while and debate what comes after". So in this case you are doing the exact opposite of what the phrase "for the sake of argument" is requesting.

https://idioms.thefreedictionary.com/for+the+sake+of+argumen...

> I know you want to go to Stanford, but just for the sake of argument, let's talk about what some of the other schools you got into have to offer.

This does not mean "I invite you to make a counter-argument as to why no other schools than Stanford are worth going to".

Re: Signal on Android: Images sent to wrong contacts

#184

Post by rococode » Sun, Jul 25, 2021, 8:24 PM UTC

spullara wrote: post #180

rococode wrote: post #65

Earlier quoted context omitted.

They've just posted an update saying that the issue was fixed on July 21. It's certainly good that it's fixed... But that's still over 7 months before it was fixed, including a 2 month period where people were still bumping the issue asking for help with no response from maintainers (afterwards, the issue went quiet until ~2 weeks ago). And there was at least one other issue on the same problem a few months later tha…

It was fixed a long time and only closed recently, see the message from the dev.

No, the dev writes on GitHub that "this issue was fixed in 5.17 (which hit 100% production on 7/21)". Releases show 5.17.0 was released on July 15. They've also linked the commits that fix the bug - the fixes were committed 10 days ago.

Re: Signal on Android: Images sent to wrong contacts

#185

Post by bryant » Sun, Jul 25, 2021, 8:25 PM UTC

goodpoint wrote: post #181

lwhi wrote: post #87

Earlier quoted context omitted.

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

> How can users be assured that this type of issue won't occur again? By writing code defensively. Despite the other comments, it's possible. The key is to be redundant: for example, off-by-one errors are very common when accessing an set of indexed items by number. Yet you can split the set (e.g. an array) in multiple ones to make it more unlikely that you pick the wrong item (e.g. picture vs users). You can also "t…

> By writing code defensively. Despite the other comments, it's possible.

I'm going to tack onto this and suggest that signal drastically slow down the pace of feature development. They don't have the same profit motivations other companies have. The messaging market, at least in its current state, is largely known. These both give Signal an advantage in that they can slow down and harden the product while baking security into their DevOps practices as a first class citizen.

Tl;dr: signal needs to slow down.

Re: Signal on Android: Images sent to wrong contacts

#186

Post by maqp » Sun, Jul 25, 2021, 8:25 PM UTC

aadjklskljads wrote: post #129

godelski wrote: post #61

Earlier quoted context omitted.

I don't think Signal has many devs[0] and if you look at the contributors[1] you can see that Grayson is pretty much the only dev for the Android app. So seeing a second dev get involved is probably them freaking out. [0] Personally I believe this is a big bump in the road for Signal and is why a lot of people are frustrated. About promises about things like usernames (it is no longer early 2021), channels, and every…

No, Signal does not get to play the limited resources card when they so firmly discourage 3rd parties from working on their project.

No, contrary to common belief, coordinating with multiple client projects to release features simultaneously etc, is not easier. The number of meetings does not drop, the quality will not improve if you now have to check that multiple clients are safe. You won't magically get more eyes on your code, when people are working on their code, not yours. And at that point you now have to deal with people who think they have as much say as you have because their fork is "equally important". And trying to explain to a non-cryptographer hobbyist why some change needs to be done, or why some feature can/should not be implemented, is not speeding things up.

Re: Signal on Android: Images sent to wrong contacts

#187

Post by nathan_phoenix » Sun, Jul 25, 2021, 8:27 PM UTC

hutzlibu wrote: post #174

nathan_phoenix wrote: post #137

Earlier quoted context omitted.

> we were able to get a fix out very quickly. I'm not sure if 8 months can be categorized as fast... The issue was posted on Dec 4, 2020, and the fix (5.17) was released on July 21. Also, sounds like quite a big issue considering that Signal is all about privacy...

Selective quoting? "As soon as we were able to pick up a scent, it was all we worked on, and we were able to get a fix out very quickly."

Oh sorry, I interpreted it differently. Tho it still doesn't change anything, they prolonged investigating this issue for months and only put mayor work behind it when they "pick[ed] up a scent on it". Although they knew about it from day one (one Signal staff replied on the same day the issue was posted).

Re: Signal on Android: Images sent to wrong contacts

#188

Post by lwhi » Sun, Jul 25, 2021, 8:27 PM UTC

tablespoon wrote: post #154

lwhi wrote: post #87

Earlier quoted context omitted.

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

> How can users be assured that this type of issue won't occur again? By not using software. And I mean software in general, not this software in particular. You're basically asking for assurance that they won't have any more bugs, but no one can actually provide such an assurance in the real world.

I disagree. If that really is the choice, they should drop the secure moniker without further debate.

--

If you produce a product that claims to be secure, the onus is on you to back up those claims.

Off the top my my head there are many ways to implement measures that can help to encourage security going forward.

One of the benefits of coding in the open, and ascribing to opens standards and protocols is transparency and the ability for all to interrogate the code.

Can that work? It's obviously partly also down to the culture of the product team. As another poster in this thread has highlighted, the commit messages are terse and not as helpful as they could be. Perhaps more openness re. intention would help.

Also, why are we finding out about this bug over 7 months after it was reported? Transparency regarding vulnerabilities needs to be at the forefront of the products communications if the team really are serious about security.

In terms of isolating bugs; what kind of testing is in place. TDD, functional testing, beta testing?

There are so many avenues which _could_ be discussed in relation to my initial question.

Your response, is unfortunately not providing anything helpful.

Re: Signal on Android: Images sent to wrong contacts

#189

Post by varispeed » Sun, Jul 25, 2021, 8:28 PM UTC

hnarn wrote: post #104

andrewguenther wrote: post #96

Earlier quoted context omitted.

> This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-submitted logs to try to track it down. Without telemetry, can you actually back up the claim that this issue was extremely rare?

Some details on how this assumption was made would be nice, but I think it's pretty obvious that any developer involved in a project can make a reasonable assumption of how rare a bug is depending on the technical details on what is required for the bug to happen. For example, if we say for the sake of argument that a hypothetical bug requires you to have more than ten contacts of the exact same name and these also n…

Why would anyone think that re-use of ID was a good idea?

Re: Signal on Android: Images sent to wrong contacts

#190

Post by nathan_phoenix » Sun, Jul 25, 2021, 8:28 PM UTC

hutzlibu wrote: post #173

tylermenezes wrote: post #164

Earlier quoted context omitted.

> we were able to get a fix out very quickly. Is 6 months really what Signal considers quick for a bug that leaks private data?

Selective quoting? "As soon as we were able to pick up a scent, it was all we worked on, and we were able to get a fix out very quickly."

Does it change anything tho? They prolonged investigating this issue for months and only put mayor work behind it when they "pick[ed] up a scent on it". Although they knew about it from day one (one Signal staff replied on the same day the issue was posted).