Signal-desktop HTML tag injection advisory

#1

Post by throwwwafgk » Tue, May 15, 2018, 12:46 PM UTC

Signal-desktop HTML tag injection advisory
ivan.barreraoro.com.ar

Re: Signal-desktop HTML tag injection advisory

#2

Post by opmac » Tue, May 15, 2018, 1:49 PM UTC

Ah, Electron /sigh.

Luckily this is fixed in the latest version (v1.11.0), so if you're a Signal user (you should be!) and you haven't upgraded already, you should upgrade immediately.

Re: Signal-desktop HTML tag injection advisory

#3

Post by RVuRnvbM2e » Tue, May 15, 2018, 1:53 PM UTC

SIGFAIL? Where's the vanity domain and whitepaper?

Re: Signal-desktop HTML tag injection advisory

#4

Post by FranOntanaya » Tue, May 15, 2018, 1:57 PM UTC

Good old unsanitized HTML. Brings memories of the first bulletin boards.

Re: Signal-desktop HTML tag injection advisory

#5

Post by r3bl » Tue, May 15, 2018, 1:57 PM UTC

I know that an unsanitized HTML input is a stupid issue to begin with, but update issued within 24 hours of discovery (and within 5 hours from disclosure)? That's really impressive.

Re: Signal-desktop HTML tag injection advisory

#6

Post by AnaniasAnanas » Tue, May 15, 2018, 2:01 PM UTC

Funny considering how EFF suggested using Signal instead of GPG yesterday before the GPG "vulnerability" was published.

Re: Signal-desktop HTML tag injection advisory

#7

Post by masklinn » Tue, May 15, 2018, 2:06 PM UTC

r3bl wrote: post #5

I know that an unsanitized HTML input is a stupid issue to begin with, but update issued within 24 hours of discovery (and within 5 hours from disclosure)? That's really impressive.

> I know that an unsanitized HTML input is a stupid issue to begin with

Input is never the issue, output is: you don't know how the input will be used/rendered, so it should be messed with as little as possible.

Re: Signal-desktop HTML tag injection advisory

#8

Post by seba_dos1 » Tue, May 15, 2018, 2:07 PM UTC

opmac wrote: post #2

Ah, Electron /sigh. Luckily this is fixed in the latest version (v1.11.0), so if you're a Signal user (you should be!) and you haven't upgraded already, you should upgrade immediately.

> (you should be!)

I don't see how going from one IM silo to another just because it's encrypted is going to help with anything. Especially one that's hostile towards alternative clients. I'm using XMPP with OMEMO, as I should be :P

Re: Signal-desktop HTML tag injection advisory

#9

Post by bcaa7f3a8bbc » Tue, May 15, 2018, 2:12 PM UTC

RVuRnvbM2e wrote: post #3

SIGFAIL? Where's the vanity domain and whitepaper?

Or SIGINT, would be a good NSA joke. https://en.wikipedia.org/wiki/SIGINT

Re: Signal-desktop HTML tag injection advisory

#10

Post by AdmiralAsshat » Tue, May 15, 2018, 2:13 PM UTC

Is this a joke?

>Solution/Vendor Information/Workaround

>For safer communications on desktop systems, please consider the use of a safer end-point client like PGP or GnuPG instead.

---

Meanwhile, regarding yesterday's PGP flaw:

https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you...

>EFF’s recommendations: Disable or uninstall PGP email plugins for now. Do not decrypt encrypted PGP messages that you receive. Instead, use non-email based messaging platforms, like Signal, for your encrypted messaging needs.