“Please do not make it public” (Tencent’s Sogou Input Method)
1–10 of 43 posts
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#2Very responsible handling of a usual cryptography failure. What's more impressive is tencents developers willingness to cooperate despite the firewalls and communication issues.
Also do not make your own crypto algorithm
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#3“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.”
I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#4What is the significance of the headline? It seems like the editors are trying to play into popular stereotypes for clicks, because reading through the disclosure log, it seems like a straightforward process marred by some minor email/communication issues. No real attempt at "suppression/censorship", as the headline implies. What am I missing?
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#5“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?
My experience with TLS is that it is not trivial to use.
Understanding how to use eg. OpenSSL APIs correctly to ensure that a connection is secure, the certificates are valid, etc. is not trivial. The APIs are poorly documented, hard to use, and many examples you can find are outdated (some OpenSSL APIs return different numbers on success/failure depending on version).
The platform native libraries are not much better. For example, the SecTrust APIs on macOS / iOS are also poorly documented, hard to use, and have bugs (eg. some time ago they suddenly started to reject valid certificates from Google cloud for some reason).
Also, your code is always a ticking time bomb, because TLS algorithms are deprecated, certificates expire, etc. So you are always at the risk of your client code to stop working at some point.
So in my opinion, there are often good reasons not to use TLS. But if you make a mistake, everyone will say "You should have used TLS". I wonder what people say when they find a bug despite you using standard crypto?
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#6What is the significance of the headline? It seems like the editors are trying to play into popular stereotypes for clicks, because reading through the disclosure log, it seems like a straightforward process marred by some minor email/communication issues. No real attempt at "suppression/censorship", as the headline implies. What am I missing?
Yes, what could be wrong with some keyboard input addon that sends every keypress to Tencent, and on top of that, in a manner trivial for a passive eavesdropper to decode?
We used to call these things "keyloggers".
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#7I must've missed the bit where they explained why _a keyboard_ would be sending anything at all _across the network_ in the first place.
Anyone?
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#8What is the significance of the headline? It seems like the editors are trying to play into popular stereotypes for clicks, because reading through the disclosure log, it seems like a straightforward process marred by some minor email/communication issues. No real attempt at "suppression/censorship", as the headline implies. What am I missing?
Tencent initially misclassified the issue as not a security risk. Shortly after, they reconsidered and asked the researchers not to make it public.
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#9> “Please do not make it public” (Tencent’s Sogou Input Method) (citizenlab.ca)
Ok, so they didn't make it public and the development team fixed the bugs.
Maybe I am missing some new trend where the headline in these disclosures _has_ to come from the communication with the company. Kind of like vulnerabilities need custom websites with logos and cool made up names?
> Even with the reported vulnerabilities now resolved, the Sogou app relies on transmitting typed content to Sogou’s servers as part of its ordinary functionality.
Well besides the email firewall mess back and forth, shouldn't that have been the main headline: "Everything you're typing on your keyboard is being sent to China"?
Re: “Please do not make it public” (Tencent’s Sogou Input Method)
#10I must've missed the bit where they explained why _a keyboard_ would be sending anything at all _across the network_ in the first place. Anyone?
From TFA
> While alphabetic keyboards typically provide autocomplete features for more expedient typing, predictive features in Chinese input methods are more crucial when using input methods such as pinyin where hundreds of characters might match an inputted pinyin syllable. For longer strings of syllables, an IME will commonly reach out over the network to a cloud-based service for suggestions if suitable suggestions are not available in the input method’s local database.
Not saying whether they should, but it's pretty easy to understand why they do it.