Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

Post reply on HN
Print view View original

311–320 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#311

Post by deanCommie »

lostlogin wrote: post #123
deanCommie wrote: post #103

Earlier quoted context omitted.

> Just today I was thinking ”it's been weeks since they moved the GIF button to a different place but there's still the old button at the old place and when you click on it there's a pop-up "wrong, the button is somewhere else now"”. That's actually a UX FEATURE. Google Maps did exactly the same thing when they reorganized and move the toggle between maps/satelite/traffic layers. The answer is pretty straightforward:…

> Leaving the old button in the old place is actually kind of a clever way to "Deprecate" a UX feature. That would drive me demented in 5 minutes.

Which would force you to learn the location of the new feature, and in the next version the button would be gone.

Re: Signal on Android: Images sent to wrong contacts

#312

Post by chithanh »

tablespoon wrote: post #301
chithanh wrote: post #294

Earlier quoted context omitted.

Signal typically delay releasing the server source code, so the latest version of the server is not open source. In one case it took them almost a year (no public commits between 20 April 2020 and 6 April 2021). https://github.com/signalapp/Signal-Android/issues/11101#iss... Among the official reasons given was staying ahead of spammers. In this instance it was also speculated that the payment function which they wer…

One of the biggest problems with open source software is enormously entitled users; who don't pay for it, don't work on it, yet feel remarkably offended when some whim of theirs is not catered to. Just saying.

If you call it a "whim" if I point out that the latest version of the Signal server is proprietary software most of the time then so be it.

Or maybe you are referring to the other commenters who were entitled to expect that the one critical task of a crypto messenger is ensuring the confidentiality of communication, which has been broken by this bug (and at least one similar bug before it, https://github.com/signalapp/Signal-Android/issues/7909 ).

You can both be grateful that Signal is free and at the same time call out shenanigans of its owners. Just saying.

Re: Signal on Android: Images sent to wrong contacts

#313

Post by rvz »

godelski wrote: post #198
Arnt wrote: post #176

Earlier quoted context omitted.

Yes, indeed. This kind of bug is an argument for having metrics.

I'm not convinced. The bug is rare and requires a specific set of circumstances that not many people are going to perform. That is not an argument to collect metrics, or in other words, change the entire paradigm of Signal (no collection of Metadata). It does propose an argument for more audits, more eyes, and more care. But we do not expect Signal to be perfect, as no software is. Systematic failure, on the other ha…

> I'm not convinced. The bug is rare and requires a specific set of circumstances that not many people are going to perform.

I don't think you would say the exact same thing if this happened to closed-source apps like WhatsApp or Discord and open-source apps like Telegram or Element. All of these apps have funding behind them and lots of resources to urgently address security issues when reported or discovered.

The same goes for Signal and they knew about this issue and left this open and unfixed for months. They have $60M in funding, fully open-source, full time engineers working on it and the priority was a secret cryptocurrency project over a critical security issue.

No matter how 'rare' the bug was is pointless. There is no excuse for not prioritising for critical security issues and leaving them unfixed for months as these issues risk ruining their main selling point on privacy and security.

> It does propose an argument for more audits, more eyes, and more care.

Yet despite having a string of audits, it seems the priority for Signal was 'cryptocurrencies' last year and creating a new coin to be listed on an exchange for that purpose, instead of fixing this 7 month old critical issue that they knew about.

Re: Signal on Android: Images sent to wrong contacts

#314

Post by Moru »

MrAwesome wrote: post #39

Several years ago, when I worked at FB, I ran into a similar bug on an early internal version of a Messenger rewrite. Sent pictures to one chat, showed up in another. My bug report on it kicked off an absolute maelstrom of dev activity and investigation. High level engineers showed up in the comments. Lots of immediate followup. The severity was clearly understood and resolving it was clearly prioritized. I exclusive…

The bug seems to reuse images already present on your device, not send new images to other users.

Re: Signal on Android: Images sent to wrong contacts

#315

Post by stathibus »

asdfasgasdgasdg wrote: post #204
lwhi wrote: post #87

Earlier quoted context omitted.

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

What does it mean for it to "not be acceptable?" Accepting or not accepting the bug is not an option on the table. It happened. The options you have open to you are to use or not use the freely provided software, or donate or not donate to the foundation providing it. Users cannot be assured that future bugs will not occur. That is an assurance that is not available with most consumer software, and certainly not with…

Yes, Signal is a messaging app whose whole reason for existing is privacy, but it does not actually guarantee any privacy features; it just tries its best. Despite this "who cares if it works" premise, they have raised tens of millions of dollars.

I dream of a world where commercial software is held to the same standards as even the lowest quality commercial hardware.

Re: Signal on Android: Images sent to wrong contacts

#316

Post by stathibus »

tablespoon wrote: post #154
lwhi wrote: post #87

Earlier quoted context omitted.

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

> How can users be assured that this type of issue won't occur again? By not using software. And I mean software in general, not this software in particular. You're basically asking for assurance that they won't have any more bugs, but no one can actually provide such an assurance in the real world.

Yes, they can.

Re: Signal on Android: Images sent to wrong contacts

#317

Post by stathibus »

alfiedotwtf wrote: post #281
GekkePrutser wrote: post #273

Earlier quoted context omitted.

One thing I wonder is: how could this happen at all? Considering the E2E Encryption in place, I would expect the incorrect recipient simply wouldn't be able to decode the image considering they never have exchanged keys with the sender?

"How could this happen at all" > I remember before Jellybean Android, sending SMS would break up my message and send it to multiple people, and the Android alarm clock would drift by hours. So how could this happen? Because software is hard.

Its not hard - its bad. Do better.

Re: Signal on Android: Images sent to wrong contacts

#318

Post by asdfasgasdgasdg »

stathibus wrote: post #315
asdfasgasdgasdg wrote: post #204

Earlier quoted context omitted.

What does it mean for it to "not be acceptable?" Accepting or not accepting the bug is not an option on the table. It happened. The options you have open to you are to use or not use the freely provided software, or donate or not donate to the foundation providing it. Users cannot be assured that future bugs will not occur. That is an assurance that is not available with most consumer software, and certainly not with…

Yes, Signal is a messaging app whose whole reason for existing is privacy, but it does not actually guarantee any privacy features; it just tries its best. Despite this "who cares if it works" premise, they have raised tens of millions of dollars. I dream of a world where commercial software is held to the same standards as even the lowest quality commercial hardware.

Concretely, what would you like to see done? Should the foundation be hit with a fine or a lawsuit for this bug? Would that improve the overall security stance of the public at large?

Re: Signal on Android: Images sent to wrong contacts

#319

Post by dane-pgp »

rakoo wrote: post #269
sschueller wrote: post #54

Earlier quoted context omitted.

This doesn't have to be the case. Look at how stripe does it with their API which would be a disaster if older versions just stopped working. Versioning is doable even with chat apps.

But Signal isn't just a chat app, it's an app with a very strong focus on security, and you can't have backward compatibility with security. Otherwise you end up with some servers still implementing SSLv3 years after its due date, or GPG with settings that make it insecure by default. You must force everyone in the ecosystem to use the latest version of the API, but even that is not enough: if there's an issue with t…

> You must force everyone in the ecosystem to use the latest version of the API

Couldn't Signal just announce a "flag day"[0] in advance and say that their servers would block connections from clients that don't support a specific version of the API by that date? For non-essential upgrades, the API change should be announced well in advance, but client developers might be given just a few days notice before security patches become mandatory. (Given the circumstances of this bug, though, perhaps several months of leeway would be more fair).

[0] https://en.wikipedia.org/wiki/Flag_day_%28computing%29

Re: Signal on Android: Images sent to wrong contacts

#320

Post by lucasyvas »

All facts aside about how it's now resolved and only surfaced using a certain setting, etc...

This an absolutely horrific bug - worse than even an encryption snafu. Can you imagine depending on Signal's privacy features, possibly with your life, and encountering this bug?

Fuck - this could ruin someone that hasn't even done anything wrong.

If I knew this bug existed and I was on this team, I would have been in all out panic mode all these months. Literally shitting my pants.

Post reply on HN