> For safer communications on desktop systems, please consider the use of a safer end-point client like PGP or GnuPG instead.
It seems like rather poor timing to make such a derogatory comment.
Signal-desktop HTML tag injection advisory
11–20 of 41 posts
Re: Signal-desktop HTML tag injection advisory
#12Ah, Electron /sigh. Luckily this is fixed in the latest version (v1.11.0), so if you're a Signal user (you should be!) and you haven't upgraded already, you should upgrade immediately.
> (you should be!) I don't see how going from one IM silo to another just because it's encrypted is going to help with anything. Especially one that's hostile towards alternative clients. I'm using XMPP with OMEMO, as I should be :P
As soon as I saw the Signal client was a web browser disguised as a desktop application, I have expected the discovery of similar issues. But as I only use Signal as an upgraded version of Plain Old Telephone for secure communication of the common people (I guess this is why the OP said "you should", not as an attack to other chats, because it serves a purpose), only talk to those people who knew my personal phone number, I didn't worry it too much. For other communications, I use PGP+E-mail, OTR/OMEMO+XMPP, IRC, Matrix, etc.
Re: Signal-desktop HTML tag injection advisory
#13Is this a joke? >Solution/Vendor Information/Workaround >For safer communications on desktop systems, please consider the use of a safer end-point client like PGP or GnuPG instead. --- Meanwhile, regarding yesterday's PGP flaw: https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you... >EFF’s recommendations: Disable or uninstall PGP email plugins for now. Do not decrypt encrypted PGP messages that you receive.…
And ironically enough, both security issues are triggered by HTML, without HTML world would be a much better place. Seriously speaking, using plain commandline PGP or GnuPG can be a safer form of communication on desktops, but not with email clients that support HTML, and don't forget the inherent drawback of no forward secrecy.
Re: Signal-desktop HTML tag injection advisory
#14Is this a joke? >Solution/Vendor Information/Workaround >For safer communications on desktop systems, please consider the use of a safer end-point client like PGP or GnuPG instead. --- Meanwhile, regarding yesterday's PGP flaw: https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you... >EFF’s recommendations: Disable or uninstall PGP email plugins for now. Do not decrypt encrypted PGP messages that you receive.…
Please do not quote with codeblocks as it is unreadble on mobile.
Re: Signal-desktop HTML tag injection advisory
#15Is this a joke? >Solution/Vendor Information/Workaround >For safer communications on desktop systems, please consider the use of a safer end-point client like PGP or GnuPG instead. --- Meanwhile, regarding yesterday's PGP flaw: https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you... >EFF’s recommendations: Disable or uninstall PGP email plugins for now. Do not decrypt encrypted PGP messages that you receive.…
Please do not quote with codeblocks as it is unreadble on mobile.
Ironically enough it is more readable on my laptop.
Re: Signal-desktop HTML tag injection advisory
#16Just one additional note that might not be immediately clear from the advisory: Exploiting this requires the attacker to first manually place malware (a malicious JavaScript file) on your computer or on a Samba network share that your computer is already connected to.
Re: Signal-desktop HTML tag injection advisory
#17Ah, Electron /sigh. Luckily this is fixed in the latest version (v1.11.0), so if you're a Signal user (you should be!) and you haven't upgraded already, you should upgrade immediately.
> (you should be!)
Too bad, I don't have a phone. I never understood why Moxie thought that only allowing phone users would be a good idea.
Also, considering how Moxie is against other clients (see the libresignal case) and at the same time considering that Signal is centralised (and Moxie refuses to federate) I would argue that you should not be using it.
Re: Signal-desktop HTML tag injection advisory
#18If you're interested in the how, who, what and where, there's a more chatty account of how this vulnerability was discovered, reported, fixed and disclosed here: https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injec...
(submitted yesterday at https://news.ycombinator.com/item?id=17070032)
Re: Signal-desktop HTML tag injection advisory
#19Just one additional note that might not be immediately clear from the advisory: Exploiting this requires the attacker to first manually place malware (a malicious JavaScript file) on your computer or on a Samba network share that your computer is already connected to.
Yeah. That fact seems pretty hidden in the reports. Due to proper CSP only local files will be executed.
If you are who I think you are, maybe you could speculate if there is actually any use for this other than loading local files (local file execution) and crashing signal?
Re: Signal-desktop HTML tag injection advisory
#20I know that an unsanitized HTML input is a stupid issue to begin with, but update issued within 24 hours of discovery (and within 5 hours from disclosure)? That's really impressive.
> I know that an unsanitized HTML input is a stupid issue to begin with Input is never the issue, output is: you don't know how the input will be used/rendered, so it should be messed with as little as possible.
Depends entirely on your application. Often you know, or are willing to constrain, the uses of an input.