10 ms·

I remember a few days ago there was a post on hackernews to stop being mean to the people that worked at signal. The Twitter user linked in that article is rail

I remember a few days ago there was a post on hackernews to stop being mean to the people that worked at signal. The Twitter user linked in that article is railing into signal devs and she calls them assholes that don’t care about what happens outside of western society. https://twitter.com/RealSexyCyborg/status/1197695376200880128?s=20 https://twitter.com/RealSexyCyborg/status/119769537620088012...

danbolt 6y ago
The thread there is really interesting. Apparently the "OEM" IMEs aren't the ideal standard for Chinese input, so people tend to use a proprietary one like Sogou's. [1] [1] https://en.wikipedia.org/wiki/Sogou https://en.wikipedia.org/wiki/Sogou
- solarkraft 6y ago
  The OEM IMEs are also proprietary, which makes me question everyone's points.
cutitout 6y ago
> calls them assholes that don’t care about what happens outside of western society That's hardly her main point: > For Chinese who are used to a specific IME- like Sogou, trying to type on something else is a tiny bit like a QWERTY user suddenly faced with Dvorak- we can make it work, but it's slow enough day to day that 50/50 they just install Sogou because what's the big deal right? > The Signal "fix" is "Incognito Mode" aka for the app to say "Pretty please don't read everything I type" to the virtual keyboard and count on Google/random app makers to listen to the flag, and not be under court order to do otherwise. > Needless to say, Sogou/Baidu dos not respect the IME_FLAG_NO_PERSONALIZED_LEARNING flag. So basically all hardware here is self-compromised 5 minutes out of the box. > so unless journalists tell them otherwise, which they have not been doing- users will install Sogou. This is important.
- durkie 6y ago
  I understand Naomi's point here, but I'm unclear how it relates to Signal. Isn't this an issue with 3rd party keyboards in any app?
  - cutitout 6y ago
    If it's an issue in any app that can lead to privacy leaks, it's a showstopper issue for something like Signal. It being an issue with any app is even more reason to tell people about it, not less.
- matsemann 6y ago
  But if a person has something important to say, calling people that don't know about the issue assholes is not a great way to go about it. I know there is a western, and especially US/English, bias in tech. But it's not like everyone tries to annoy others, it's more an issue of ignorance. Btw I agree that when Signal says your messages are secure, it should probably do something to warn about ways things still may leak.
  - cutitout 6y ago
    > But if a person has something important to say, calling people that don't know about the issue assholes is not a great way to go about it. I don't mind it at all. If someone uses "being called asshole" as a reason to not even inform anyone, they would have found another excuse. Some people simply register it as strong language and otherwise focus on the content. At any rate, it's very easy to judge what someone says in frustration when you yourself don't even suffer from the situation and/or don't care about those who do. > But it's not like everyone tries to annoy other, it's more an issue of ignorance. So she shed light on that, and instead of talking about the important bit, people think it's super important to teach a random person to not be rude, ever? That's what we're focusing on?
    - matsemann 6y ago
      > That's what we're focusing on? That's my point. By presenting the issue the way she did, people moved the conversation away from the issue and instead ended up in a meta-discussion about the discourse. If her points were laid out in a nicer manner, she would be closer to actually achieving her goal.
solarkraft 6y ago
Naomi analyzes the technical side very well, but somehow face plants on the conclusion. Insecure IMEs exist everywhere and affect every app. Not just Signal, not just in China. This is the operating system's job to tackle, not Signal's. And oh wonder: Android displays a scary reminder when you install an IME (of course they could and should disallow network access for IMEs as well). Signal should show a reminder to help people be secure, but framing this as some kind of obligation towards the people of China is weird.
- philsnow 6y ago
  > This is the operating system's job to tackle, not Signal's. And oh wonder: Android displays a scary reminder when you install an IME (of course they could and should disallow network access for IMEs as well). (ios makes the third-party keyboard ask the user for "full access" in order to hit the internet.)
- TaylorAlexander 6y ago
  I think Naomi wants at least a clear recognition of the issue from signal. All of us on HN can say “well yeah that’s obvious” but signal keeps telling everyone their app is “secure” without caveats that your keyboard could be leaking everything you type, making the system not secure. Saying “well that’s not my department” isn’t acceptable when people are being put at real risk here. EDIT: The specific request in TFA is to detect users using a third party IME and give them a security warning. Seems pretty reasonable.
higerordermap 6y ago
It doesn't matter. You can compromise most of the phones (at least non rooted) if you or your people make the OS and thus also the OS level libraries that handle Text input from the IME, or even touchscreen information would be enough in most cases (unless everyone uses the randomized keyboard layout, and guard against "known plaintext" type attacks)

danbolt 6y ago

The thread there is really interesting. Apparently the "OEM" IMEs aren't the ideal standard for Chinese input, so people tend to use a proprietary one like Sogou's. [1] [1] https://en.wikipedia.org/wiki/Sogou https://en.wikipedia.org/wiki/Sogou

solarkraft 6y ago
The OEM IMEs are also proprietary, which makes me question everyone's points.

cutitout 6y ago

> calls them assholes that don’t care about what happens outside of western society That's hardly her main point: > For Chinese who are used to a specific IME- like Sogou, trying to type on something else is a tiny bit like a QWERTY user suddenly faced with Dvorak- we can make it work, but it's slow enough day to day that 50/50 they just install Sogou because what's the big deal right? > The Signal "fix" is "Incognito Mode" aka for the app to say "Pretty please don't read everything I type" to the virtual keyboard and count on Google/random app makers to listen to the flag, and not be under court order to do otherwise. > Needless to say, Sogou/Baidu dos not respect the IME_FLAG_NO_PERSONALIZED_LEARNING flag. So basically all hardware here is self-compromised 5 minutes out of the box. > so unless journalists tell them otherwise, which they have not been doing- users will install Sogou. This is important.

durkie 6y ago
I understand Naomi's point here, but I'm unclear how it relates to Signal. Isn't this an issue with 3rd party keyboards in any app?
- cutitout 6y ago
  If it's an issue in any app that can lead to privacy leaks, it's a showstopper issue for something like Signal. It being an issue with any app is even more reason to tell people about it, not less.
matsemann 6y ago
But if a person has something important to say, calling people that don't know about the issue assholes is not a great way to go about it. I know there is a western, and especially US/English, bias in tech. But it's not like everyone tries to annoy others, it's more an issue of ignorance. Btw I agree that when Signal says your messages are secure, it should probably do something to warn about ways things still may leak.
- cutitout 6y ago
  > But if a person has something important to say, calling people that don't know about the issue assholes is not a great way to go about it. I don't mind it at all. If someone uses "being called asshole" as a reason to not even inform anyone, they would have found another excuse. Some people simply register it as strong language and otherwise focus on the content. At any rate, it's very easy to judge what someone says in frustration when you yourself don't even suffer from the situation and/or don't care about those who do. > But it's not like everyone tries to annoy other, it's more an issue of ignorance. So she shed light on that, and instead of talking about the important bit, people think it's super important to teach a random person to not be rude, ever? That's what we're focusing on?
  - matsemann 6y ago
    > That's what we're focusing on? That's my point. By presenting the issue the way she did, people moved the conversation away from the issue and instead ended up in a meta-discussion about the discourse. If her points were laid out in a nicer manner, she would be closer to actually achieving her goal.

solarkraft 6y ago

Naomi analyzes the technical side very well, but somehow face plants on the conclusion. Insecure IMEs exist everywhere and affect every app. Not just Signal, not just in China. This is the operating system's job to tackle, not Signal's. And oh wonder: Android displays a scary reminder when you install an IME (of course they could and should disallow network access for IMEs as well). Signal should show a reminder to help people be secure, but framing this as some kind of obligation towards the people of China is weird.

philsnow 6y ago
> This is the operating system's job to tackle, not Signal's. And oh wonder: Android displays a scary reminder when you install an IME (of course they could and should disallow network access for IMEs as well). (ios makes the third-party keyboard ask the user for "full access" in order to hit the internet.)
TaylorAlexander 6y ago
I think Naomi wants at least a clear recognition of the issue from signal. All of us on HN can say “well yeah that’s obvious” but signal keeps telling everyone their app is “secure” without caveats that your keyboard could be leaking everything you type, making the system not secure. Saying “well that’s not my department” isn’t acceptable when people are being put at real risk here. EDIT: The specific request in TFA is to detect users using a third party IME and give them a security warning. Seems pretty reasonable.

higerordermap 6y ago

It doesn't matter. You can compromise most of the phones (at least non rooted) if you or your people make the OS and thus also the OS level libraries that handle Text input from the IME, or even touchscreen information would be enough in most cases (unless everyone uses the randomized keyboard layout, and guard against "known plaintext" type attacks)