Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Another flaw in Signal desktop app leaks chats in plaintext

thehackernews.com

Post reply on HN
Print view View original

11–20 of 232 posts

Re: Another flaw in Signal desktop app leaks chats in plaintext

#11

Post by andrepd »

>Researchers—Iván Ariel Barrera Oro, Alfredo Ortega, Juliano Rizzo, and Matt Bryant—responsibly reported the vulnerability to Signal, and its developers have patched the vulnerability with the release of Signal desktop version 1.11.0 for Windows, macOS, and Linux users.

>However, The Hacker News has learned that Signal developers had already identified this issue as part of a comprehensive fix to the first vulnerability before the researchers found it and reported them.

>Signal app has an auto-update mechanism, so most users must have the update already installed. You can read this guide to ensure if you are running updated version of Signal.

Seems everything is patched, and was already going to be patched before the vuln was reported.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#12

Post by roywiggins »

JasonFruit wrote: post #10

When will people start using plain old PGP — a tool that does one thing only, and does it right? Sure, it's a little harder than using just one tool that handles contacts, communication, formatting, and encryption, while making popcorn and walking the dog, but it works, and it's secure if you use it right. Our efforts to make encryption easy are going to get someone killed.

literally this week

https://news.ycombinator.com/item?id=17064129

Re: Another flaw in Signal desktop app leaks chats in plaintext

#13

Post by JasonFruit »

roywiggins wrote: post #12
JasonFruit wrote: post #10

When will people start using plain old PGP — a tool that does one thing only, and does it right? Sure, it's a little harder than using just one tool that handles contacts, communication, formatting, and encryption, while making popcorn and walking the dog, but it works, and it's secure if you use it right. Our efforts to make encryption easy are going to get someone killed.

literally this week https://news.ycombinator.com/item?id=17064129

Literally not PGP, but clients built around it to make encrypted email easy. Read the article you linked.

EDIT: typo.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#14

Post by 4ad »

roywiggins wrote: post #12
JasonFruit wrote: post #10

When will people start using plain old PGP — a tool that does one thing only, and does it right? Sure, it's a little harder than using just one tool that handles contacts, communication, formatting, and encryption, while making popcorn and walking the dog, but it works, and it's secure if you use it right. Our efforts to make encryption easy are going to get someone killed.

literally this week https://news.ycombinator.com/item?id=17064129

The PGP vulnerability is actually in e-mail clients, and it affects almost nobody. And how often do PGP vulnerabilities happen?

Signal got two vulnerabilities that affect everyone JUST THIS WEEK.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#15

Post by 4ad »

connorelsea wrote: post #8
tormeh wrote: post #5

Maybe secure chat clients shouldn't be written in JavaScript or other languages that have excessive dynamicness? Signal seems to be written mostly in languages that are bad for security (significantly worse than the best alternatives). Maybe I'm just a language nerd without any clue about the trade-offs, but I trust the Wire software more. Note that this just applies to mobile clients and server - Wire, like Signal,…

there is plenty of secure software written in javascript. poor engineering can occur in any language

Can you provide some examples?

Re: Another flaw in Signal desktop app leaks chats in plaintext

#16

Post by kasey_junk »

JasonFruit wrote: post #10

When will people start using plain old PGP — a tool that does one thing only, and does it right? Sure, it's a little harder than using just one tool that handles contacts, communication, formatting, and encryption, while making popcorn and walking the dog, but it works, and it's secure if you use it right. Our efforts to make encryption easy are going to get someone killed.

If you can find 3 crypto engineers who aren’t PGP maintainers that agree with this I might start using PGP for secure comms.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#17

Post by kenforthewin »

4ad wrote: post #15
connorelsea wrote: post #8

Earlier quoted context omitted.

there is plenty of secure software written in javascript. poor engineering can occur in any language

Can you provide some examples?

openpgp.js, professionally audited several times over https://openpgpjs.org/

Re: Another flaw in Signal desktop app leaks chats in plaintext

#18

Post by connorelsea »

4ad wrote: post #15
connorelsea wrote: post #8

Earlier quoted context omitted.

there is plenty of secure software written in javascript. poor engineering can occur in any language

Can you provide some examples?

Implying in any way that all JS programs are insecure and all other languages are secure is ridiculous and probably harmful, leading people to insecure choices in other languages. I've seen plenty of security vulnerabilities in strongly typed languages in my days as a software dev

Re: Another flaw in Signal desktop app leaks chats in plaintext

#19

Post by roywiggins »

JasonFruit wrote: post #13
roywiggins wrote: post #12

Earlier quoted context omitted.

literally this week https://news.ycombinator.com/item?id=17064129

Literally not PGP, but clients built around it to make encrypted email easy. Read the article you linked. EDIT: typo.

It relies on several features of PGP that mean that messages aren't tamper-proof. If PGP made sure messages replayed and altered by attackers would not decrypt, then the attacks wouldn't work- you couldn't replay an email back to someone to steal it.

It relies on a client having an HTML renderer, but the underlying issue is messages that can be tampered with.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#20

Post by 0xCMP »

JasonFruit wrote: post #13
roywiggins wrote: post #12

Earlier quoted context omitted.

literally this week https://news.ycombinator.com/item?id=17064129

Literally not PGP, but clients built around it to make encrypted email easy. Read the article you linked. EDIT: typo.

Ah, so don't use the now secured opensource client using Signal's protocol. We should use PGP with all the weak yet-to-be-patched clients. Cause it's not PGP which got hacked it was the client. Very different from how the Signal client got hacked not their protocol. /s
Post reply on HN