This is a good reminder that no matter how security and privacy-focused a project is, we still don't know how to reliably develop software without bugs - and all it takes is one bug to negate all of those security and privacy features.
Signal on Android: Images sent to wrong contacts
171–180 of 403 posts
Re: Signal on Android: Images sent to wrong contacts
#172Earlier quoted context omitted.
>for the sake of argument that a hypothetical bug requires you to have more than ten contacts of the exact same name and these also need to share the same country and area code This is only rare if you have a small social circle. My circle has multiple first name-collisions of at least 5 participants, but my circle is not very big and the area code is also quite small. Some countries do not use area codes for mobile…
Well he just wanted to make an example. One could also construct an example, where the bug only occurs for people with a rare sequence of unicode symbols (e.g. U+2600 U+2601 U+2602) in their username and have a specific date (e.g. 05.04.1920) as their birthday.
Your argument depends on Signal implementing username support, because we do not support unicode in phone numbers.
Re: Signal on Android: Images sent to wrong contacts
#173Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
> we were able to get a fix out very quickly. Is 6 months really what Signal considers quick for a bug that leaks private data?
Selective quoting?
"As soon as we were able to pick up a scent, it was all we worked on, and we were able to get a fix out very quickly."
Re: Signal on Android: Images sent to wrong contacts
#174Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…
> we were able to get a fix out very quickly. I'm not sure if 8 months can be categorized as fast... The issue was posted on Dec 4, 2020, and the fix (5.17) was released on July 21. Also, sounds like quite a big issue considering that Signal is all about privacy...
Selective quoting?
"As soon as we were able to pick up a scent, it was all we worked on, and we were able to get a fix out very quickly."
Re: Signal on Android: Images sent to wrong contacts
#175Do users se wrongly sent images in outbox/sent?
Did the transfer always happened immediately or with a delay?
Did the transfer or chat always had to have a gif sent?
Re: Signal on Android: Images sent to wrong contacts
#176Earlier quoted context omitted.
True, but the issue was fixed in 5.17, which was released only 10 days ago [1]. For an issue opened December last year, that's still quite a lot of time before a fix could be found. [1] https://github.com/signalapp/Signal-Android/commit/a47448b6c...
Try fixing a rare bug quicker without constant user metrics.
Yes, indeed.
This kind of bug is an argument for having metrics.
Re: Signal on Android: Images sent to wrong contacts
#177Earlier quoted context omitted.
No PR with name that would suggest the fix in the client https://github.com/signalapp/Signal-Android/pulls?q=is%3Apr+... and no PR from OP in the opensource part of the server https://github.com/signalapp/Signal-Server/pulls?q=is%3Apr+i...
*edit, I think this issue was specific to the Android client, the desktop client has a totally different sqlite schema. The child comment to your comment is deleted, but I think autoincrement IDs shouldn't be used under an ambient authority context. It would make more sense to have IDs based on an LSF or Feistel sequence, perhaps split into a master ID and a conversation sequence. Autoincrement on this field makes it…
The good thing about autoincrementing unsigned 64-bit integers is that 1) it's insanely fast, 2) SQLite is doing it automatically, 3) seriously, why don't they have it on all tables yet? SQLite guarantees no collisions within a table.
Doing homegrown ID generation is how such bugs are being introduced in the first place. Your application level trigger got bypassed, oops. Your check was experimentally disabled and left like that for a year until people started noticing, oops.
If you make an SQLite-backed application and it has a bug like this, I can safely bet $500 it's not going to be SQLite that has the bug.
Just don't expose the numeric IDs in links, and generate your UUIDs in tables where you need to point to rows in an outside-accessible link. This is database 101, for crying out loud.
Re: Signal on Android: Images sent to wrong contacts
#178Earlier quoted context omitted.
Well he just wanted to make an example. One could also construct an example, where the bug only occurs for people with a rare sequence of unicode symbols (e.g. U+2600 U+2601 U+2602) in their username and have a specific date (e.g. 05.04.1920) as their birthday.
Your argument depends on Signal implementing username support, because we do not support unicode in phone numbers.
My argument depends on an alternate universe in which signal supports it, everything else being equal, because why not.
Re: Signal on Android: Images sent to wrong contacts
#179Earlier quoted context omitted.
Sure, but there's a small theoretical difference with democracy. You have to live under some system of government. You don't have to use a secure messenger. You can choose to have sensitive conversations in person or not have them at all. I agree that in practice, a lot of people are going to use their phones for relatively sensitive conversations, and in practice, Signal remains the best choice for doing so. But the…
You make some fair points. But even from the eyes of those people, what is the alternative? Is iMessage guaranteed to not have any hidden exploits out there? And on the flip side, what do they lose out on by only having those conversations in person? Well, I'd argue that their world becomes a lot smaller, and there sources are instantly at a higher risk.
If iMessage were sending photos to the wrong people (even with extremely low probability) for over half a year, there would be serious negative publicity to Apple for it, even if they had never implemented end-to-end encryption. Apple also has more software testers and more willingness to use telemetry. So while there are no 100% guarantees, I think the incentives are aligned with iMessage at least as well as they are with Signal.
Apple suffered negative publicity from the 2014 iCloud photo leaks, even though those were "just" phishing and not a vulnerability/bug in the strict sense. Tim Cook had to give statements to the media, and in fact Apple stepped up its phishing protection by pushing two-factor authentication and notifying users about additional iCloud logins.
Re: Signal on Android: Images sent to wrong contacts
#180Several years ago, when I worked at FB, I ran into a similar bug on an early internal version of a Messenger rewrite. Sent pictures to one chat, showed up in another. My bug report on it kicked off an absolute maelstrom of dev activity and investigation. High level engineers showed up in the comments. Lots of immediate followup. The severity was clearly understood and resolving it was clearly prioritized. I exclusive…
They've just posted an update saying that the issue was fixed on July 21. It's certainly good that it's fixed... But that's still over 7 months before it was fixed, including a 2 month period where people were still bumping the issue asking for help with no response from maintainers (afterwards, the issue went quiet until ~2 weeks ago). And there was at least one other issue on the same problem a few months later tha…
It was fixed a long time and only closed recently, see the message from the dev.