4 ms·

Ah yes, I'd forgotten about that - https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144 https://medium.com/@fs0c131

by Zenst 7y ago

Ah yes, I'd forgotten about that - https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144 https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-...

maxmouchet 7y ago
To be fair, the vulnerability was fixed quickly. And in the end it improved the security of Matrix and the governement application. I prefer this to a closed-source application developed internally, without communication on security vulnerabilities.
- Zenst 7y ago
  Yes, does cover that in the link and from my perspective - ruddy good response time upon that and well handled. I can think of many comparable situations in other countries (some EU ones as well) in which the person finding the issue would of very easily been locked up.
  - Arathorn 7y ago
    To be clear, the vulnerability was with the specific server configuration for the French Matrix deployment (authing people based on email domain), and not a flaw in Matrix itself. We're not aware of anyone else running in that config. https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2 https://matrix.org/blog/2019/04/18/security-update-sydent-1-... had the details. The actual bug was thanks to a long-standing bug in python's standard email.utils library, which finally got fixed: https://bugs.python.org/issue34155 https://bugs.python.org/issue34155, combined with insufficiently-defensive coding and testing on my side. (I wrote the auth code in question).
faeyanpiraat 7y ago
Interesting read. Nice trick with bypassing email domain restriction.
grive 7y ago
This is a good story, but the title seems needlessly clickbait. The flaw was fixed rather quickly, the process for communicating the issue did not seem to be a hassle. It does not really say that the app is "super not secure". Just that people make mistakes, and it's not even shameful the way they reacted to it.

by Zenst 7y ago

Ah yes, I'd forgotten about that - https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144 https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-...

maxmouchet 7y ago

To be fair, the vulnerability was fixed quickly. And in the end it improved the security of Matrix and the governement application. I prefer this to a closed-source application developed internally, without communication on security vulnerabilities.

Zenst 7y ago
Yes, does cover that in the link and from my perspective - ruddy good response time upon that and well handled. I can think of many comparable situations in other countries (some EU ones as well) in which the person finding the issue would of very easily been locked up.
- Arathorn 7y ago
  To be clear, the vulnerability was with the specific server configuration for the French Matrix deployment (authing people based on email domain), and not a flaw in Matrix itself. We're not aware of anyone else running in that config. https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2 https://matrix.org/blog/2019/04/18/security-update-sydent-1-... had the details. The actual bug was thanks to a long-standing bug in python's standard email.utils library, which finally got fixed: https://bugs.python.org/issue34155 https://bugs.python.org/issue34155, combined with insufficiently-defensive coding and testing on my side. (I wrote the auth code in question).

faeyanpiraat 7y ago

Interesting read. Nice trick with bypassing email domain restriction.

grive 7y ago

This is a good story, but the title seems needlessly clickbait. The flaw was fixed rather quickly, the process for communicating the issue did not seem to be a hassle. It does not really say that the app is "super not secure". Just that people make mistakes, and it's not even shameful the way they reacted to it.