Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Please do not make it public” (Tencent’s Sogou Input Method)

citizenlab.ca

Post reply on HN
Print view View original

21–30 of 43 posts

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#21

Post by capableweb »

phyzome wrote: post #14

Even though it's part of the original post's title, "please do not make it public" is an extremely misleading quote.

How is it misleading exactly?

> Vulnerability disclosed to IMETS@tencent.com.

> Vulnerability disclosed again via Tencent Security Response Centre (TSRC) web portal.

> Tencent: “Thank you for your interest in Tencent security. There is no low or low security risk for this issue. We look forward to your next more exciting report.”

> Tencent: “Sorry, my previous reply was wrong, we are dealing with this vulnerability, please do not make it public, thank you very much for your report.”

> Tencent’s initial rejection of our disclosure and subsequent about-face served as inspiration for the title of this report.

It's a direct quote from a Tencent reply.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#22

Post by hangonhn »

Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

Developer ignorance rather than hubris. People who don't really know anything about cryptography has the naive and wrong impression that encryption renders your secret completely safe against anything and that only by getting the key or a major cipher vulnerability would the plaintext be revealed. They treat it like a blackbox because they don't know anything. In recent years, some of the crypto libraries have methods (i.e. Fernet) that are much safer and takes care of these issues for you but it's still very possible to make mistakes. I've seen engineers use a static IV for AES because they didn't know how they would be able to search for the encrypted data other than making the ciphertext the same for a given key and plaintext. Basically they severely weakened it because they didn't understand the purpose of a random IV. Again, they thought key + plaintext -> encrypt = super secure.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#23

Post by paxys »

capableweb wrote: post #21
phyzome wrote: post #14

Even though it's part of the original post's title, "please do not make it public" is an extremely misleading quote.

How is it misleading exactly? > Vulnerability disclosed to IMETS@tencent.com. > Vulnerability disclosed again via Tencent Security Response Centre (TSRC) web portal. > Tencent: “Thank you for your interest in Tencent security. There is no low or low security risk for this issue. We look forward to your next more exciting report.” > Tencent: “Sorry, my previous reply was wrong, we are dealing with this vulnerability,…

Just because it is a direct quote doesn't mean it can't be misleading when shared without all the necessary context. Tencent asked for it to not be made public during the period while they were actively fixing it and well within any standard vulnerability disclosure deadline.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#24

Post by Nextgrid »

newaccount74 wrote: post #5
Waterluvian wrote: post #3

“These findings underscore the importance for software developers in China to use well-supported encryption implementations such as TLS instead of attempting to custom design their own.” I’m very interested in better understanding this. Why do they elect to do this? Is this just developer hubris, as found everywhere? Does this relate to government regulation or control, whether above or under the table?

My experience with TLS is that it is not trivial to use. Understanding how to use eg. OpenSSL APIs correctly to ensure that a connection is secure, the certificates are valid, etc. is not trivial. The APIs are poorly documented, hard to use, and many examples you can find are outdated (some OpenSSL APIs return different numbers on success/failure depending on version). The platform native libraries are not much bette…

It's still more trivial than rolling your own?

I would understand (not approve of it, but merely understand) completely ignoring security/authentication - that would obviously be easier and avoid having to answer hard questions and make hard decisions.

But here it seems like they've put even more effort actually designing some custom encryption scheme based on (wrongly-applied) cryptographic primitives complete with custom request encapsulation format, etc. This is more work than just swapping your TCP channel with a TLS one and reasonably trivial auxiliary code to load/renew certificates. In this case since they're running it over HTTP it's even easier to just put a reverse-proxy in front that will add HTTPS on top.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#25

Post by 015a »

capableweb wrote: post #21
phyzome wrote: post #14

Even though it's part of the original post's title, "please do not make it public" is an extremely misleading quote.

How is it misleading exactly? > Vulnerability disclosed to IMETS@tencent.com. > Vulnerability disclosed again via Tencent Security Response Centre (TSRC) web portal. > Tencent: “Thank you for your interest in Tencent security. There is no low or low security risk for this issue. We look forward to your next more exciting report.” > Tencent: “Sorry, my previous reply was wrong, we are dealing with this vulnerability,…

Because they said it essentially as soon as the vulnerability is reported. That's an entirely reasonable thing to ask for; don't make this public, we're working on it. And its a totally normal allowance from security researchers.

The title induces readers into thinking that they said this in some other context. Example 1: They aren't working toward fixing it, don't release this, lets just keep it hush hush. This isn't what happened. Example 2: They did fix it, but they didn't want the researcher to publish details of the problem after they fixed it. This also isn't what happened.

Assuming I understand the context correctly; its absolutely an inflammatory title that has no place in security disclosure articles like this.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#26

Post by Nextgrid »

taldo wrote: post #10
myself248 wrote: post #7

I must've missed the bit where they explained why _a keyboard_ would be sending anything at all _across the network_ in the first place. Anyone?

From TFA > While alphabetic keyboards typically provide autocomplete features for more expedient typing, predictive features in Chinese input methods are more crucial when using input methods such as pinyin where hundreds of characters might match an inputted pinyin syllable. For longer strings of syllables, an IME will commonly reach out over the network to a cloud-based service for suggestions if suitable suggestio…

It's impressive that users are ok with this. This is even beyond the (now generally-accepted) analytics and ad targeting, it's literally "we'll send all your keystrokes to a remote server", a literal keylogger.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#27

Post by netsharc »

015a wrote: post #25
capableweb wrote: post #21

Earlier quoted context omitted.

How is it misleading exactly? > Vulnerability disclosed to IMETS@tencent.com. > Vulnerability disclosed again via Tencent Security Response Centre (TSRC) web portal. > Tencent: “Thank you for your interest in Tencent security. There is no low or low security risk for this issue. We look forward to your next more exciting report.” > Tencent: “Sorry, my previous reply was wrong, we are dealing with this vulnerability,…

Because they said it essentially as soon as the vulnerability is reported. That's an entirely reasonable thing to ask for; don't make this public, we're working on it. And its a totally normal allowance from security researchers. The title induces readers into thinking that they said this in some other context. Example 1: They aren't working toward fixing it, don't release this, lets just keep it hush hush. This isn'…

Yeah, kinda disappointing that the CitizenLab folks are exploiting the (I presume) non-mastery of subtle English of the developers to create a "clickbait" title.

If they were English speakers they would've written something along the lines of "We thank you that you respected the vulnerability disclosure policy and notified us. We expect you'll continue respecting the policy and not publish this vulnerability before we resolve the issue and after a period of time where the updated software has been uploaded."

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#28

Post by JohnFen »

paxys wrote: post #23
capableweb wrote: post #21

Earlier quoted context omitted.

How is it misleading exactly? > Vulnerability disclosed to IMETS@tencent.com. > Vulnerability disclosed again via Tencent Security Response Centre (TSRC) web portal. > Tencent: “Thank you for your interest in Tencent security. There is no low or low security risk for this issue. We look forward to your next more exciting report.” > Tencent: “Sorry, my previous reply was wrong, we are dealing with this vulnerability,…

Just because it is a direct quote doesn't mean it can't be misleading when shared without all the necessary context. Tencent asked for it to not be made public during the period while they were actively fixing it and well within any standard vulnerability disclosure deadline.

I agree. I don't see anything here that seems out of line.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#29

Post by miki123211 »

> In this report, we analyze Tencent’s Sogou Input Method, the most popular Chinese input method with over 455 million monthly active users and versions of the app for multiple platforms, including Windows, Android, and iOS. Sogou Input Method accounts for 70% of Chinese input method users, with products by iFlytek and Baidu taking second and third place, respectively. This part is surprising to me. Are the Chinese input methods provided directly by the operating systems not enough? I'm surprised that Microsoft, Apple et al provide such a sub-par service in China that over 450 million people were bothered enough to install a third-party keyboard.

Re: “Please do not make it public” (Tencent’s Sogou Input Method)

#30

Post by ysavir »

capableweb wrote: post #21
phyzome wrote: post #14

Even though it's part of the original post's title, "please do not make it public" is an extremely misleading quote.

How is it misleading exactly? > Vulnerability disclosed to IMETS@tencent.com. > Vulnerability disclosed again via Tencent Security Response Centre (TSRC) web portal. > Tencent: “Thank you for your interest in Tencent security. There is no low or low security risk for this issue. We look forward to your next more exciting report.” > Tencent: “Sorry, my previous reply was wrong, we are dealing with this vulnerability,…

When I read the title, my impression wasn't that it regarded keeping a vulnerability private until fixed, but that there was some functionality that tencent didn't want people to know about.
Post reply on HN