Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

261–270 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#261

Earlier quoted context omitted.

You are arguing against a hypothetical situation of your opponent's creation. This is like when Ross tried to beat Chandler at Cups

I go to bed now and dream of a universe in which NullPrefix is Ross and continues to argue endlessly.

[deleted]

Re: Signal on Android: Images sent to wrong contacts

#262

Earlier quoted context omitted.

You are arguing against a hypothetical situation of your opponent's creation. This is like when Ross tried to beat Chandler at Cups

I go to bed now and dream of a universe in which NullPrefix is Ross and continues to argue endlessly.

I'll argue with anyone about anything. For free.

Re: Signal on Android: Images sent to wrong contacts

#263

Earlier quoted context omitted.

Your argument depends on Signal implementing username support, because we do not support unicode in phone numbers.

It is a hypothetical scenario for the purpose of an example. It could have been literally anything, the point is for it to be rare.

Yes, but the fact that scenario is hypothetical doesn't counter my argument that whatever the developer thinks is rare is actually rare.

Re: Signal on Android: Images sent to wrong contacts

#264
post #92
post #24

Earlier quoted context omitted.

It’s not enough for signal to work for tech people. You have to be able to convince your family and friends to use it, it’s a network effects problem. They are adding features so that ordinary people can have private communications

ordinary people don't give a flying f** about being able to send someone crypto currency via their messaging app.

Though many of their competing apps support this feature. Facebook, Apple, WeChat, etc.

Re: Signal on Android: Images sent to wrong contacts

#265

Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one. We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-subm…

> This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-submitted logs to try to track it down. Without telemetry, can you actually back up the claim that this issue was extremely rare?

Even with, what telemetry would allow you to determine how many pictures (and presumably content) you sent to whom?

Re: Signal on Android: Images sent to wrong contacts

#267
post #256

Earlier quoted context omitted.

It's fixed in 5.17 and this is the release number I see on the Google playstore. Unfortunately for my ubuntu 18.04 LTS and this is in no way Signal's fault (but maybe the desktop version doesn't have that bug ?): $ apt-cache policy signal-desktop signal-desktop: Installé : 5.10.0 Candidat : 5.10.0 Table de version : *** 5.10.0 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages 100 /var/lib/dpkg…

Would rolling into the beta help here? https://support.signal.org/hc/en-us/articles/360007318471-Si...

I don't think so:

    $ apt-cache policy signal-desktop-beta
    signal-desktop-beta:
      Installé : (aucun)
      Candidat : 5.11.0-beta.1
     Table de version :
         5.11.0-beta.1 500
            500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages

Re: Signal on Android: Images sent to wrong contacts

#268

Earlier quoted context omitted.

Does that alternate universe support phone numbers with unicode characters too?

You are arguing against a hypothetical situation of your opponent's creation. This is like when Ross tried to beat Chandler at Cups

I am curious how different that alternative universe needs to be for my argument to be invalid.

Re: Signal on Android: Images sent to wrong contacts

#269
post #28

Earlier quoted context omitted.

And when third parties can connect, the protocol can't evolve because every change becomes "good to simplement" but it takes an enormous amount of time, resources And influence to change to "mandatory to implement". As always it's a delicate balance between security And ease of use, and Signal has always been up front in favoring the former.

This doesn't have to be the case. Look at how stripe does it with their API which would be a disaster if older versions just stopped working. Versioning is doable even with chat apps.

But Signal isn't just a chat app, it's an app with a very strong focus on security, and you can't have backward compatibility with security. Otherwise you end up with some servers still implementing SSLv3 years after its due date, or GPG with settings that make it insecure by default. You must force everyone in the ecosystem to use the latest version of the API, but even that is not enough: if there's an issue with the client (the issue in the article could happen with a third party) you must find a way to force it to upgrade; if they dont want to it's better to block them, but at this point if you need to choose where to best spend your resources you might as well block everyone else.

Opening the service to other clients widens the potential surface area of attacks. It must be considered with a lot of care.

Re: Signal on Android: Images sent to wrong contacts

#270
post #31
post #28

Earlier quoted context omitted.

And when third parties can connect, the protocol can't evolve because every change becomes "good to simplement" but it takes an enormous amount of time, resources And influence to change to "mandatory to implement". As always it's a delicate balance between security And ease of use, and Signal has always been up front in favoring the former.

That would be the case if they’d standardize the signal protocol. Letting third parties connect has nothing to do with that. Signal can still change their API any time they want.

I replied in another comment, but letting third parties connect widens the surface area of the potential attacks. If that bug happened in a third party, from a security pov you must block them from accessing the service, at which point you need to decide if you want to police every single possible client or focus on one and make it widespread.
Post reply on HN