Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal on Android: Images sent to wrong contacts

github.com

Post reply on HN
Print view View original

71–80 of 403 posts

Re: Signal on Android: Images sent to wrong contacts

#71

Post by colesantiago »

detaro wrote: post #59
colesantiago wrote: post #23

Earlier quoted context omitted.

And yet there are serious bugs like this that slip through the net, a simple benchmark of any chat app should not be showing other people's messages like what Signal is doing. I would expect that an app that has repetitive audits would have resulted in this bug being fixed already.

At least the main audits are clearly described as auditing internal components, so it's not surprising app-level errors aren't covered by them.

Which this bug was left open for months while users were experiencing this privacy issue.

How can I recommend a chat app that does this and claim they are a privacy based app? and also does not respond to urgent bugs in this manner?

Re: Signal on Android: Images sent to wrong contacts

#72

Post by tgsovlerkhgsel »

jerkstate wrote: post #11

Signal has been adding lots of silly social media like features lately, not surprising that they are messing up the core value prop. I’m shopping for a new encrypted messenger. They used to say every program expands in scope until it can read email, now every app expands until you can add Snapchat filters to your selfies.

The only possible competitor (from a network effect perspective) is Matrix/Element.

The UX is completely unpolished and at least 5 years behind Signal.

Re: Signal on Android: Images sent to wrong contacts

#74

Post by woxko »

godelski wrote: post #61
MrAwesome wrote: post #39

Several years ago, when I worked at FB, I ran into a similar bug on an early internal version of a Messenger rewrite. Sent pictures to one chat, showed up in another. My bug report on it kicked off an absolute maelstrom of dev activity and investigation. High level engineers showed up in the comments. Lots of immediate followup. The severity was clearly understood and resolving it was clearly prioritized. I exclusive…

I don't think Signal has many devs[0] and if you look at the contributors[1] you can see that Grayson is pretty much the only dev for the Android app. So seeing a second dev get involved is probably them freaking out. [0] Personally I believe this is a big bump in the road for Signal and is why a lot of people are frustrated. About promises about things like usernames (it is no longer early 2021), channels, and every…

Bug report is eight months old now. I don't think they're freaking out much.

Re: Signal on Android: Images sent to wrong contacts

#75

Post by dmix »

hn8788 wrote: post #56
mdoms wrote: post #47

Earlier quoted context omitted.

Why on Earth are people downvoting you? This is an absolute dealbreaker for any messaging app, much less one whose raison d'etre is privacy and secure messaging.

Probably because the common mindset here is that anyone can make a mistake, and that the person who did it learned their lesson and will never do it again.

It also sounded like a very difficult bug to track down, even as a top priority. Requiring a combination of certain settings plus a rare database ID intersection.

Combine that with not logging user behaviour heavily for privacies sake makes this a very tough one to replicate.

All of which was addressed in the bug report.

The realities of software development on a large scale with a privacy focus are sometimes hard to grasp. Although I do admit 7 months for a production release is quite a long time, even factoring in the pandemic and mobile app Play Store release cycles.

Re: Signal on Android: Images sent to wrong contacts

#76

Post by [deleted] »

sschueller wrote: post #62
MacD83 wrote: post #34

I'm rooting for Delta Chat [1] which puts a nice chat UI on top of email. It is such a brilliant and simple solution. It is decentralized unlike Signal which recently had big reliability problems when new users flooded in. [1] https://delta.chat

Isn't this going to pollute my mail server with thousands of individual chat "emails" instead of a few large emails?

[deleted]

Re: Signal on Android: Images sent to wrong contacts

#77

Post by detaro »

colesantiago wrote: post #71
detaro wrote: post #59

Earlier quoted context omitted.

At least the main audits are clearly described as auditing internal components, so it's not surprising app-level errors aren't covered by them.

Which this bug was left open for months while users were experiencing this privacy issue. How can I recommend a chat app that does this and claim they are a privacy based app? and also does not respond to urgent bugs in this manner?

I'm not saying you should recommend Signal, just pointing out that "there are audits, why does it have such bugs" doesn't tell the entire story.

Re: Signal on Android: Images sent to wrong contacts

#78

Post by greysonp »

Hi there, Signal-Android developer here. I updated the issue to reflect this, but this bug has been fixed. I was tracking it on a separate issue, and had forgotten to close this one.

We do, in fact, take issues like this very seriously. This bug was extraordinarily rare, and because we have no metrics/remote log collection, there was an initial period where we had to spend time adding logging and collecting user-submitted logs to try to track it down. As soon as we were able to pick up a scent, it was all we worked on, and we were able to get a fix out very quickly.

Re: Signal on Android: Images sent to wrong contacts

#79

Post by saurik »

dmix wrote: post #75
hn8788 wrote: post #56

Earlier quoted context omitted.

Probably because the common mindset here is that anyone can make a mistake, and that the person who did it learned their lesson and will never do it again.

It also sounded like a very difficult bug to track down, even as a top priority. Requiring a combination of certain settings plus a rare database ID intersection. Combine that with not logging user behaviour heavily for privacies sake makes this a very tough one to replicate. All of which was addressed in the bug report. The realities of software development on a large scale with a privacy focus are sometimes hard to…

So, did they disclose the issue? Were people using Signal warned somewhere that this was a known issue that they were hunting down? (I am guessing not as no one here has been like "oh yeah: everyone using Signal knew to be careful with this feature".) It being a difficult bug to fix doesn't mean that's your only recourse for something this serious.

Re: Signal on Android: Images sent to wrong contacts

#80

Post by colesantiago »

egberts1 wrote: post #66
colesantiago wrote: post #18

Signal is becoming a joke that we should reconsider using, and now has dangerous bugs that is at the edge of compromising people's privacy. Has this app/service really been audited properly? We now need to consider serious alternatives that we should get behind like Element [0] or Session [1] but I am open to user friendly alternatives other than Signal (at worst even Quill [2] or Delta Chat [3]). [0] https://element…

Quill? Why would we want to use Quill that needs all of our private data? Have you not seen over at Apple App Store what they’re sucking off of your phone from your Quill app?

Which is why I said at worst. Please read.

Could you recommend a better chat app that is user friendly enough for regular people to use that is not Signal or WhatsApp and is cross platform?

Quill are at least working on E2E, not introducing a cryptocurrency like Signal and don't require your phone number.

Post reply on HN