Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

151–160 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#151
post #87

Earlier quoted context omitted.

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

Probably by installing some hardened memory on your phone to prevent cosmic bitflips or the such. Unless you are going to go to NASA lengths of hardware reliability, you can't really hope much for the software that has to deal with the issues of... how many different android phones are there?

The available evidence indicates that this was due to a logic error, not to cosmic rays and/or Android ecosystem diversity.

Re: Signal on Android: Images sent to wrong contacts

#152
post #136

Earlier quoted context omitted.

I really like the idea of delta chat, except that I cannot bring myself to allow it access to my full imap mailbox. And most providers do not offer a way to scope access to only selected folders.

You can use a separate mailbox just for delta chat

Sure. But that throws away the advantage of already having an identity.

Re: Signal on Android: Images sent to wrong contacts

#153
post #104

Earlier quoted context omitted.

> This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-submitted logs to try to track it down. Without telemetry, can you actually back up the claim that this issue was extremely rare?

Some details on how this assumption was made would be nice, but I think it's pretty obvious that any developer involved in a project can make a reasonable assumption of how rare a bug is depending on the technical details on what is required for the bug to happen. For example, if we say for the sake of argument that a hypothetical bug requires you to have more than ten contacts of the exact same name and these also n…

> The fix itself should make it so that database issues like the one that caused this bug can't happen again.

I've said that a few times, and been wrong about it. :D

I don't know what they mean by "where a database ID was re-used", but I guess it had to do with caching, and cache invalidation is one of the hardest part in computer programming.

Re: Signal on Android: Images sent to wrong contacts

#154
post #87

Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

> How can users be assured that this type of issue won't occur again?

By not using software.

And I mean software in general, not this software in particular. You're basically asking for assurance that they won't have any more bugs, but no one can actually provide such an assurance in the real world.

Re: Signal on Android: Images sent to wrong contacts

#155

While I suppose the protocol is not at fault and it's a UI and client bug it's still a huge problem. Just today I was thinking ”it's been weeks since they moved the GIF button to a different place but there's still the old button at the old place and when you click on it there's a pop-up "wrong, the button is somewhere else now"”. Why even keep the old button in the old place ? And it led me to thinking "what else co…

> Just today I was thinking ”it's been weeks since they moved the GIF button to a different place but there's still the old button at the old place and when you click on it there's a pop-up "wrong, the button is somewhere else now"”. That's actually a UX FEATURE. Google Maps did exactly the same thing when they reorganized and move the toggle between maps/satelite/traffic layers. The answer is pretty straightforward:…

Yep, this was the intent. It's a relatively common pattern. We kept it that way for a few releases so people could see it, and we removed the button in the latest release.

Re: Signal on Android: Images sent to wrong contacts

#156
post #107
post #82

Earlier quoted context omitted.

Can you provide a link to the commit that fixes it? Shouldn't there have been an announcement to inform users what has been leaked and under which circumstances? How can user A send an image to user B that neither of them took? Isn't everything end-2-end encrypted? Then how can unencrypted data from user C end up on the device of user B?

No PR with name that would suggest the fix in the client https://github.com/signalapp/Signal-Android/pulls?q=is%3Apr+... and no PR from OP in the opensource part of the server https://github.com/signalapp/Signal-Server/pulls?q=is%3Apr+i...

*edit, I think this issue was specific to the Android client, the desktop client has a totally different sqlite schema.

The child comment to your comment is deleted, but I think autoincrement IDs shouldn't be used under an ambient authority context.

It would make more sense to have IDs based on an LSF or Feistel sequence, perhaps split into a master ID and a conversation sequence.

Autoincrement on this field makes it easy for off by one errors. Even just moving to guids and maintaining a proper parent child relationship would have prevented this.

Or maybe there should be a database per conversation (set of all parties).

https://github.com/signalapp/Signal-Android/commit/83086a5a2...

https://github.com/signalapp/Signal-Android/commit/b9657208f...

Row IDs shouldn't have so much power.

Re: Signal on Android: Images sent to wrong contacts

#157
post #94
post #87

Earlier quoted context omitted.

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

‘Many forms of secure messaging systems have been tried, and will be tried in this world of sin and woe. No one pretends that Signal is perfect or all-wise. Indeed it has been said that Signal is the worst messaging except for all those other forms that have been developed from time to time…’ Winston S Churchill, 11 November 1947

Sure, but there's a small theoretical difference with democracy. You have to live under some system of government. You don't have to use a secure messenger. You can choose to have sensitive conversations in person or not have them at all.

I agree that in practice, a lot of people are going to use their phones for relatively sensitive conversations, and in practice, Signal remains the best choice for doing so. But there are a few real threat models where the options aren't Signal vs. SMS / Google Chat / Discord / etc., the options are Signal vs. nothing. For instance, you could be a journalist deciding whether to ask clarifying questions to a government whistleblower via Signal or meet up with them in a park. You could be an activist/demonstrator under a repressive regime deciding whether to coordinate some action this weekend via Signal or hold off on it entirely and tactically preserve your freedom. And so forth.

For those people, if (and to be clear this is a big "if," while this issue is one serious piece of evidence it is nonetheless inconclusive) Signal isn't trustworthy, it doesn't matter if Signal is the least-bad of the options.

(Also, it's not like Signal is the only e2e messenger around. There's iMessage/FaceTime, for instance. Churchill's claim was that the abstract idea of democracy was good, not that any concrete implementation like the British government was good.)

Re: Signal on Android: Images sent to wrong contacts

#158

Signal is becoming a joke that we should reconsider using, and now has dangerous bugs that is at the edge of compromising people's privacy. Has this app/service really been audited properly? We now need to consider serious alternatives that we should get behind like Element [0] or Session [1] but I am open to user friendly alternatives other than Signal (at worst even Quill [2] or Delta Chat [3]). [0] https://element…

I‘ve been on Threema ever since I learned that WhatsApp did not even use TLS. It‘s a great chat app and nothing else (which is a feature in my book).

Re: Signal on Android: Images sent to wrong contacts

#159
post #21

Signal is becoming a joke that we should reconsider using, and now has dangerous bugs that is at the edge of compromising people's privacy. Has this app/service really been audited properly? We now need to consider serious alternatives that we should get behind like Element [0] or Session [1] but I am open to user friendly alternatives other than Signal (at worst even Quill [2] or Delta Chat [3]). [0] https://element…

> Has this app/service really been audited properly? Yes, repeatedly: https://community.signalusers.org/t/wiki-overview-of-third-p... Edit: that said, this did make me revisit a question I asked signal via their Careers portal a long while back. Reposted here: https://news.ycombinator.com/item?id=27952315

The protocol has been reviewed plenty of times. The rest of the app has not. At least according to your list.

Re: Signal on Android: Images sent to wrong contacts

#160

Earlier quoted context omitted.

I don't think Signal has many devs[0] and if you look at the contributors[1] you can see that Grayson is pretty much the only dev for the Android app. So seeing a second dev get involved is probably them freaking out. [0] Personally I believe this is a big bump in the road for Signal and is why a lot of people are frustrated. About promises about things like usernames (it is no longer early 2021), channels, and every…

No, Signal does not get to play the limited resources card when they so firmly discourage 3rd parties from working on their project.

Could you explain what Signal is doing to discourage contributions?
Post reply on HN