Live data from Hacker News

Another flaw in Signal desktop app leaks chats in plaintext

thehackernews.com

211–220 of 232 posts

Re: Another flaw in Signal desktop app leaks chats in plaintext

#211
post #200

Earlier quoted context omitted.

I mean, in C++ "=" could be called "dangerouslySetAribtraryMemoryLocation" and it would be just as accurate. In native code, even trivial operations like concatenating two strings or setting a variable can cause arbitrary code to execute.

Care to give an example?

Assuming OP was talking about overloading the '=' operator:

  struct A {
    int *p = nullptr;
  
    A& operator=(int i) {
      *p = i;
      return *this;
    }
  };

  int main(void)
  {
    A a;
    a = 1;  /* boom! */
    return 0;
  }

Re: Another flaw in Signal desktop app leaks chats in plaintext

#212
post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

Yeah, I definitely don't like hearing that, because phones can fuck right off. That's not my computer, that's someone else's computer that they're letting me use.

I'm not going to get a smartphone just to use Signal. I'll use my spare laptop instead, that I already have, and just run Signal on it. It's not going to get compromised by Boogeymen From The Scary Browser Tab because I won't be running a browser on there.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#213
post #21

Earlier quoted context omitted.

By "almost nobody", you mean everyone who used Apple Mail/GPGTools and Thunderbird/Enigma, meaning, the vast majority of everybody who used PGP?

Enigmail 2 was not affected.

I'm not sure what you're trying to say here, but Enigmail 2 was released a few months after the researchers disclosed the vulnerability to the project[1], so it would've been a rather sad state of affairs if the release hadn't included a fix. That's not to say that everything's fine now for users of Thunderbird and Enigmail[2].

[1]: https://sourceforge.net/p/enigmail/bugs/721/

[2]: https://twitter.com/hanno/status/997138771194859521

Re: Another flaw in Signal desktop app leaks chats in plaintext

#214

Earlier quoted context omitted.

This may or may not be true, but in a lot of cases where you need encryption, you also need not to have a GPS tracker on you while you're using it. You have (at least slightly) more chance of being anonymous with a dedicated laptop computer than you have with any smartphone.

Ignoring the recent LocationSmart revelations, if you disable location access you should basically have the same level of geospatial anonymity.

All somebody needs to find your location is a list of SSIDs and MAC addresses within range of you.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#215
post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

Yeah, I definitely don't like hearing that, because phones can fuck right off. That's not my computer, that's someone else's computer that they're letting me use. I'm not going to get a smartphone just to use Signal. I'll use my spare laptop instead, that I already have, and just run Signal on it. It's not going to get compromised by Boogeymen From The Scary Browser Tab because I won't be running a browser on there.

I think that is a fine plan for the "people who have spare laptops they use to run single programs" people.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#216

Earlier quoted context omitted.

"It is a little weird to me that people on message boards assume they've outguessed the hardware security teams at both Apple and Google on one of the most obvious attack vectors for their phone designs; both companies spend huge amounts of money on this stuff." For what it's worth, that isn't the assumption people are making. The easy assumption to make is that the security teams were unable to convince product owne…

No, it's because end-users don't adopt 2FA via TOTP and, to a first approximation, nobody uses U2F. It's not a corner security teams are cutting. Microsoft's security team makes the same decisions.

Microsoft doesn’t have “a” security team. They have dozens of security-ish teams. And I can assure you that none of them made that decision. The product teams did. And security people there disagree with it. You likely think security teams at BigCorp have more teeth than they do. With a few exceptions, Microsoft is known for hiring well qualified security people and then giving them no authority to do much until something is already on fire.

Search for a tweet by Kostya expressing surprise and delight at the fact that they actually fixed an internal find a couple years ago. Or grab a beer with the nearest ex-microsoft security person and have them tell you stories about servicing internally discovered vulns.

You’re right that the security team aren’t cutting corners. Because that isn’t how things work.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#217

Earlier quoted context omitted.

I think escaping quotes only matters for attributes (which can use ' or "). Example: Exploit: foo.jpg" onload="alert('pwned')

Heh, found the exact bug on a live bbcode parser some 5 years ago.

It was probably written using regexps? One should make full syntax analysis instead of writing regexp hacks.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#218

Earlier quoted context omitted.

Doesn't that answer assume some or all of the following? a) Apple does a better job reviewing apps than Debian maintainers do. b) iPhone app code is better quality than Debian packages. c) iOS sandboxing is better than Linux. Default configuration may mean c) is true. However not if you use wayland, apparmor, seccomp, namespaces etc. What do you think about a) and b)?

The beep local root suggests the Debian review system has room to improve. It's a pretty deep barrel. You're sure there's no crud at the bottom?

Hi Ted,

Oh wow, is there ever crud at the bottom.

Yesterday I apt-get install'd probably 5 such cruds just to record a small rectangle on my desktop. TBH I did this after apt-get install'ing 3 other animated-gif related cruds to do simple motion animation, then just gave up and used the half-baked Web Animations API in devtools of Firefox because it was easier and better documented than anything else I could find.

That's 8 total cruds written by who-knows, maintained by whoever, audited probably-never by no-one. Also, they pulled in various dependencies I didn't pay the faintest attention to.

How many of those 8 apps would you estimate sent my email contacts to a third party upon instantiation?

How many of those 8 apps would you estimate gathered various pieces of data to fingerprint my device? How many keep gathering data from every sensor source they can poll every time I run and use the app?

How many of those 8 apps would you estimate even touched the network at all?

Now let's suppose I download 8 cruds on iOS just as mindlessly as I did here. Do you think the answers to those questions will be different?

Re: Another flaw in Signal desktop app leaks chats in plaintext

#219
post #203
post #24

Honestly, and none of you are going to like hearing this, and the Signal people aren't going to appreciate me saying it: if you're serious about messaging securely, don't use Signal Desktop; don't use desktop secure messengers at all. Desktop applications are incredibly risky, far more so than iOS mobile apps are.

This is easily proven false by simply looking at professionals which either by necessity or regulation require a strict secure environment. How common is it that the military use iphone apps for classified information or to interface with military equipment. Do operators in powerplants or other sensitive infrastructure use iphone apps as interface to their systems. When security is a primary objective then having it…

If your standard for operational security is the military, I have very bad news for you. Or good news, if your opsec goal is "be way better than the US Military" (that news is: you are already way better than the US Military).

The military obtains what security it has by attempting complete segregation and isolation; because it's the USG, the world's largest IT department, there are "public" and "private" networks, both clones of each other, both running the same insecure software. Both public and "secure" networks have been owned up comprehensively by malware in the past.

To get a sense of how bad the situation is, go look at the Common Criterial EAL vendor list, note which vendors have obtained EAL4 certification, and then compare to the security track records of those versions. That'll give you the spirit of the situation without requiring to you actually endure an EAL validation, which is something I have had the misfortune of participating in.

Re: Another flaw in Signal desktop app leaks chats in plaintext

#220

Earlier quoted context omitted.

The beep local root suggests the Debian review system has room to improve. It's a pretty deep barrel. You're sure there's no crud at the bottom?

Hi Ted, Oh wow, is there ever crud at the bottom. Yesterday I apt-get install'd probably 5 such cruds just to record a small rectangle on my desktop. TBH I did this after apt-get install'ing 3 other animated-gif related cruds to do simple motion animation, then just gave up and used the half-baked Web Animations API in devtools of Firefox because it was easier and better documented than anything else I could find. Th…

You should try to think of some specific problems that can arise in each environment instead of conducting some sort of weird Socratic dialogue about imaginary apps and a seemingly made-up iOS.
Post reply on HN