10 ms·

Moxie - and the Signal team - seems to have a real issue taking feedback from outside experts. See the way he has been completely dismissive of the IME vulnerab

by edent 6y ago

Moxie - and the Signal team - seems to have a real issue taking feedback from outside experts. See the way he has been completely dismissive of the IME vulnerability highlighted by Naomi Wu and others. I remember back when it was TextSecure - I tried to raise some usability and security issues. First I was ignored, then dismissed, then - a few years later - they implemented some of the changes. I still use Signal. But the way the project is run is, dare I say, arrogant and dismissive.

nexthash 6y ago
Maybe, but I think that the way these researchers reacted when their criticism wasn't heard doesn't benefit anybody. By ratcheting up the tension and participating in an internet catfight against the Signal team, a net loss occurs for the anti-censorship community. If the Signal team does indeed have a real problem with taking feedback and criticism, a better approach might've been to gather support and enter into long-term negotiation over Signal's future relationship with the community. This would make its development a lot smoother and prevent anger and bruised egos from building in the future.
- pm90 6y ago
  The owners and maintainers of the product get to decide on how to handle issues like this one. But I’m not convinced that an “internet catfight” is a good enough reason for shutting down the conversation completely as it was done. I am aware that it’s totally unfair that signal owners should have to deal with this kind of behavior and not take strong measure like they did... I don’t really know what a good resolution would have been. But it’s also a fact that if a system is broken in some way then that hard truth remains true even if it’s wrapped in layers of shit. The ultimate losers will be the users.
  - jrochkind1 6y ago
    > You were blocked because you know that we don't use GH for discussion, but came here anyway and started opening fake PRs so that you could post and harass other people on GH. > …If you want to discuss anything about circumvention or any other aspects of Signal in a way that is respectful to the rest of the community, please join in on the forums. https://github.com/signalapp/Signal-TLS-Proxy/pull/15#issuecomment-774982590 https://github.com/signalapp/Signal-TLS-Proxy/pull/15#issuec... That does not to me seem like "shutting down the conversation completely". (As if there is even a way to do that on the internet if you were to try!)
    - pm90 6y ago
      Like I said, it’s totally upto the project owners to decide how they want to interface with the community. But the concrete result of that decision was just to move the discussion to a GitHub issue on another repo.
    - modzu 6y ago
      he was banned on the forums too
      - Dumbdo 6y ago
        Do you have a source for that?
        modzu 6y ago
        #4 on the timeline: https://github.com/net4people/bbs/issues/63 https://github.com/net4people/bbs/issues/63
      - FDSGSG 6y ago
        He wasn't. Why lie about this? https://community.signalusers.org/u/DuckSoft/summary https://community.signalusers.org/u/DuckSoft/summary
        modzu 6y ago
        im just quoting the parent article. can yall read it before commenting and making accusations?
        FDSGSG 6y ago
        The timeline is incorrect.
- shadowgovt 6y ago
  At this point, a clear demonstration of how Signal's current design fails to keep users safe forwarded to the New York Times, WaPo, and Fox News would be a lot more valuable than shitposting via the Github PR system.
  - throwitaway1235 6y ago
    The New York Times published an article just a week ago claiming Signal was "problematic" for affording anonymity. I would assume WaPo feels the same way. No benefit in forwarding to either institution.
FDSGSG 6y ago
What should Signal do about "the IME vulnerability"? They can't possibly defend against compromised phones. Why call it "the IME vulnerability" anyway? This isn't about a vulnerability, we're discussing compromised phones. "IME vulnerability" seems designed to make this sound like a Signal issue, which it isn't.
- edent 6y ago
  There are two practical options. 1. Bundle an Open source IME to be used when in incognito mode. 2. Warn users when they switch to incognito that their IME may still be recording the words they type. This isn't just about compromised phones. A 3rd party keyboard doesn't have to respect the incognito flag.
  - maqp 6y ago
    "Important: Keyboards and IME’s can ignore Android’s Incognito Keyboard flag. This Android system flag is a best effort, not a guarantee. It’s important to use a keyboard or IME that you trust. Signal cannot detect or prevent malware on your device." https://support.signal.org/hc/en-us/articles/360055276112-Incognito-Keyboard https://support.signal.org/hc/en-us/articles/360055276112-In... Sure, the app should say that too, not sure if it does. Also, the small team of developers can only fix so many things at a time. There's ~50M more users today than a month ago, there's bound to be more work wrt. maintenance which will slow down implementing new features.
    - edent 6y ago
      That was only added 19 days ago - after months of people (politely) asking for it to be acknowledged as a serious concern. https://github.com/signalapp/Signal-Android/commit/0a29ffcf4c522467745017797f6beff626a3d842#diff-5e01f7d37a66e4ca03deefc205d8e7008661cdd0284a05aaba1858e6b7bf9103 https://github.com/signalapp/Signal-Android/commit/0a29ffcf4...
      - jsiepkes 6y ago
        Shouldn't Signal then also warn or refuse to work on Android versions with known vulnerabilities? Or if there are apps installed on the device with the accessibility permission? Where would you say the line should be drawn?
abc-xyz 6y ago
Naomi Wu is a security expert? Also, looking through her Twitter she seem to be supportive of the destruction of Hong Kong and defensive of Xinjiang's Concentration Camps: > Well, you could before you started advocating for the overthrow of your government in the hope that white people would come save you. Guess that wasn't the best idea ever then? (https://twitter.com/realsexycyborg/status/1339728311300182017 https://twitter.com/realsexycyborg/status/133972831130018201...) > What they say matters. When they characterized all Uyghur labor as "slave labor" it was an economic disaster for them- no Chinese factory engaged in export will take a chance on hiring Uyghur labor now. They casually destroyed the economic future of an ethnic group for clicks. (https://twitter.com/RealSexyCyborg/status/1358218878837350401 https://twitter.com/RealSexyCyborg/status/135821887883735040...) I'm all for supporting and promoting women in STEM, but perhaps we stick to promoting those that aren't morally bankrupt?
- Daho0n 6y ago
  Why does her view on something completely unrelated matter to the facts? Why are you even comping through her Twitter history? This is clearly a personal attack "just because". Disgusting.
  - abc-xyz 6y ago
    > Why does her view on something completely unrelated matter to the facts? Because she's not the one that discovered it or originally pushed the message, but certain people are likely choosing to promote her tweets to voice support for women in STEM (even though her field is completely unrelated). > Why are you even comping through her Twitter history? Her statements on Hong Kong and Xinjiang were so shocking that I saw them numerous times on the subreddits I follow.. took about 10 seconds to find the original ones by searching for "white people save you" and "uyghur" on her twitter. > This is clearly a personal attack "just because". Disgusting. Yeah, fuck me for supporting democracy in Hong Kong and opposing concentration camps in Xinjiang.
    - dang 6y ago
      We've banned this account for using HN primarily for political and nationalistic battle and ignoring our many requests to stop. This is standard HN policy. Regardless of which sides you're battling for or against, it nukes this site for the curious conversation it's supposed to exist for. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
deleted 6y ago
[deleted]
autoexec 6y ago
This is exactly why I moved away from signal. A combination of ignoring user's concerns and confusing/inaccurate communication about the security and the privacy of their users. That's absolutely not what you want to have for a service people depend on for privacy. If you're promoting your service to people who risk their lives and freedom by using it you need to make it 100% clear to them what their risks are. Today I still run into people who have no idea that Signal is storing their profile information and their contacts on signal's servers, and that opting out of setting a pin will not prevent that, and Signal still haven't updated their privacy policy to reflect it either (it still states "Signal is designed to never collect or store any sensitive information.")
- codethief 6y ago
  > Signal still haven't updated their privacy policy to reflect it either (it still states "Signal is designed to never collect or store any sensitive information.") They don't need to update their privacy policy because they never have access to the profil information. Technically, the encrypted profile information and your messages (when they are in transit to your contacts) are being stored on their servers in the exact same way. The only difference is that messages are deleted afterwards whereas your profile is stored permanently until you decide to change it. That doesn't make the profile information any less secure, though. Yes, maybe in 20 years someone will be able to break AES-256 (or whatever symmetric encryption algorithm they use) and then the stored cyphertext version of your profile information might be valuable. Personally, I doubt it. But even if I turn out to be wrong: The possible attack vector against your profile information is the same as for messages: After all, tomorrow Signal could get convinced by an intelligence agency to permanently store all your encrypted messages from now on and then the exact same risks of AES-256 getting broken would apply. Conclusion: When Signal says they're not collecting any sensitive information, they mean that they themselves don't have access to any such information because it gets encrypted. This is the promise of end-to-end encryption. They're not promising anything beyond that. In particular, they can't promise that the encryption will never get broken. No one knows. And no one in their right mind would promise anything like that. But at least they do everything to mitigate that risk by openly publishing all their cryptography algorithms for peer review and actively participating in scientific research surrounding that topic. > I still run into people who have no idea that Signal is storing their profile information and their contacts on signal's servers The precise meaning of the phrase "Signal is storing their profile information on [their] servers" vs. what the average person will actually understand here, are two entirely different things here: Most people will think that Signal stores that profile information in cleartext on their servers – because that is the current status quo with almost all popular online platforms – when in reality this is not the case. Normally, I would be saying at this point: Please stop spreading FUD. But I do agree with your statement that > If you're promoting your service to people who risk their lives and freedom by using it you need to make it 100% clear to them what their risks are. Signal could indeed do a better job here. In view of the above, however, I'm having the feeling the risks weren't really clear to you, either? (No offense)
mayneack 6y ago
I've submitted 10+ signal bug reports (none security related) going back to the TextSecure days. I've never had any rude or dismissive responses from the team, but have had my issues hijacked by other people with the issue being overly demanding or rude.

by edent 6y ago

nexthash 6y ago

Maybe, but I think that the way these researchers reacted when their criticism wasn't heard doesn't benefit anybody. By ratcheting up the tension and participating in an internet catfight against the Signal team, a net loss occurs for the anti-censorship community. If the Signal team does indeed have a real problem with taking feedback and criticism, a better approach might've been to gather support and enter into long-term negotiation over Signal's future relationship with the community. This would make its development a lot smoother and prevent anger and bruised egos from building in the future.

pm90 6y ago
The owners and maintainers of the product get to decide on how to handle issues like this one. But I’m not convinced that an “internet catfight” is a good enough reason for shutting down the conversation completely as it was done. I am aware that it’s totally unfair that signal owners should have to deal with this kind of behavior and not take strong measure like they did... I don’t really know what a good resolution would have been. But it’s also a fact that if a system is broken in some way then that hard truth remains true even if it’s wrapped in layers of shit. The ultimate losers will be the users.
- jrochkind1 6y ago
  > You were blocked because you know that we don't use GH for discussion, but came here anyway and started opening fake PRs so that you could post and harass other people on GH. > …If you want to discuss anything about circumvention or any other aspects of Signal in a way that is respectful to the rest of the community, please join in on the forums. https://github.com/signalapp/Signal-TLS-Proxy/pull/15#issuecomment-774982590 https://github.com/signalapp/Signal-TLS-Proxy/pull/15#issuec... That does not to me seem like "shutting down the conversation completely". (As if there is even a way to do that on the internet if you were to try!)
  - pm90 6y ago
    Like I said, it’s totally upto the project owners to decide how they want to interface with the community. But the concrete result of that decision was just to move the discussion to a GitHub issue on another repo.
  - modzu 6y ago
    he was banned on the forums too
    - Dumbdo 6y ago
      Do you have a source for that?
      - modzu 6y ago
        #4 on the timeline: https://github.com/net4people/bbs/issues/63 https://github.com/net4people/bbs/issues/63
    - FDSGSG 6y ago
      He wasn't. Why lie about this? https://community.signalusers.org/u/DuckSoft/summary https://community.signalusers.org/u/DuckSoft/summary
      - modzu 6y ago
        im just quoting the parent article. can yall read it before commenting and making accusations?
        FDSGSG 6y ago
        The timeline is incorrect.
shadowgovt 6y ago
At this point, a clear demonstration of how Signal's current design fails to keep users safe forwarded to the New York Times, WaPo, and Fox News would be a lot more valuable than shitposting via the Github PR system.
- throwitaway1235 6y ago
  The New York Times published an article just a week ago claiming Signal was "problematic" for affording anonymity. I would assume WaPo feels the same way. No benefit in forwarding to either institution.

FDSGSG 6y ago

What should Signal do about "the IME vulnerability"? They can't possibly defend against compromised phones. Why call it "the IME vulnerability" anyway? This isn't about a vulnerability, we're discussing compromised phones. "IME vulnerability" seems designed to make this sound like a Signal issue, which it isn't.

edent 6y ago
There are two practical options. 1. Bundle an Open source IME to be used when in incognito mode. 2. Warn users when they switch to incognito that their IME may still be recording the words they type. This isn't just about compromised phones. A 3rd party keyboard doesn't have to respect the incognito flag.
- maqp 6y ago
  "Important: Keyboards and IME’s can ignore Android’s Incognito Keyboard flag. This Android system flag is a best effort, not a guarantee. It’s important to use a keyboard or IME that you trust. Signal cannot detect or prevent malware on your device." https://support.signal.org/hc/en-us/articles/360055276112-Incognito-Keyboard https://support.signal.org/hc/en-us/articles/360055276112-In... Sure, the app should say that too, not sure if it does. Also, the small team of developers can only fix so many things at a time. There's ~50M more users today than a month ago, there's bound to be more work wrt. maintenance which will slow down implementing new features.
  - edent 6y ago
    That was only added 19 days ago - after months of people (politely) asking for it to be acknowledged as a serious concern. https://github.com/signalapp/Signal-Android/commit/0a29ffcf4c522467745017797f6beff626a3d842#diff-5e01f7d37a66e4ca03deefc205d8e7008661cdd0284a05aaba1858e6b7bf9103 https://github.com/signalapp/Signal-Android/commit/0a29ffcf4...
    - jsiepkes 6y ago
      Shouldn't Signal then also warn or refuse to work on Android versions with known vulnerabilities? Or if there are apps installed on the device with the accessibility permission? Where would you say the line should be drawn?

abc-xyz 6y ago

Naomi Wu is a security expert? Also, looking through her Twitter she seem to be supportive of the destruction of Hong Kong and defensive of Xinjiang's Concentration Camps: > Well, you could before you started advocating for the overthrow of your government in the hope that white people would come save you. Guess that wasn't the best idea ever then? (https://twitter.com/realsexycyborg/status/1339728311300182017 https://twitter.com/realsexycyborg/status/133972831130018201...) > What they say matters. When they characterized all Uyghur labor as "slave labor" it was an economic disaster for them- no Chinese factory engaged in export will take a chance on hiring Uyghur labor now. They casually destroyed the economic future of an ethnic group for clicks. (https://twitter.com/RealSexyCyborg/status/1358218878837350401 https://twitter.com/RealSexyCyborg/status/135821887883735040...) I'm all for supporting and promoting women in STEM, but perhaps we stick to promoting those that aren't morally bankrupt?

Daho0n 6y ago
Why does her view on something completely unrelated matter to the facts? Why are you even comping through her Twitter history? This is clearly a personal attack "just because". Disgusting.
- abc-xyz 6y ago
  > Why does her view on something completely unrelated matter to the facts? Because she's not the one that discovered it or originally pushed the message, but certain people are likely choosing to promote her tweets to voice support for women in STEM (even though her field is completely unrelated). > Why are you even comping through her Twitter history? Her statements on Hong Kong and Xinjiang were so shocking that I saw them numerous times on the subreddits I follow.. took about 10 seconds to find the original ones by searching for "white people save you" and "uyghur" on her twitter. > This is clearly a personal attack "just because". Disgusting. Yeah, fuck me for supporting democracy in Hong Kong and opposing concentration camps in Xinjiang.
  - dang 6y ago
    We've banned this account for using HN primarily for political and nationalistic battle and ignoring our many requests to stop. This is standard HN policy. Regardless of which sides you're battling for or against, it nukes this site for the curious conversation it's supposed to exist for. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

deleted 6y ago

[deleted]

autoexec 6y ago

This is exactly why I moved away from signal. A combination of ignoring user's concerns and confusing/inaccurate communication about the security and the privacy of their users. That's absolutely not what you want to have for a service people depend on for privacy. If you're promoting your service to people who risk their lives and freedom by using it you need to make it 100% clear to them what their risks are. Today I still run into people who have no idea that Signal is storing their profile information and their contacts on signal's servers, and that opting out of setting a pin will not prevent that, and Signal still haven't updated their privacy policy to reflect it either (it still states "Signal is designed to never collect or store any sensitive information.")

codethief 6y ago
> Signal still haven't updated their privacy policy to reflect it either (it still states "Signal is designed to never collect or store any sensitive information.") They don't need to update their privacy policy because they never have access to the profil information. Technically, the encrypted profile information and your messages (when they are in transit to your contacts) are being stored on their servers in the exact same way. The only difference is that messages are deleted afterwards whereas your profile is stored permanently until you decide to change it. That doesn't make the profile information any less secure, though. Yes, maybe in 20 years someone will be able to break AES-256 (or whatever symmetric encryption algorithm they use) and then the stored cyphertext version of your profile information might be valuable. Personally, I doubt it. But even if I turn out to be wrong: The possible attack vector against your profile information is the same as for messages: After all, tomorrow Signal could get convinced by an intelligence agency to permanently store all your encrypted messages from now on and then the exact same risks of AES-256 getting broken would apply. Conclusion: When Signal says they're not collecting any sensitive information, they mean that they themselves don't have access to any such information because it gets encrypted. This is the promise of end-to-end encryption. They're not promising anything beyond that. In particular, they can't promise that the encryption will never get broken. No one knows. And no one in their right mind would promise anything like that. But at least they do everything to mitigate that risk by openly publishing all their cryptography algorithms for peer review and actively participating in scientific research surrounding that topic. > I still run into people who have no idea that Signal is storing their profile information and their contacts on signal's servers The precise meaning of the phrase "Signal is storing their profile information on [their] servers" vs. what the average person will actually understand here, are two entirely different things here: Most people will think that Signal stores that profile information in cleartext on their servers – because that is the current status quo with almost all popular online platforms – when in reality this is not the case. Normally, I would be saying at this point: Please stop spreading FUD. But I do agree with your statement that > If you're promoting your service to people who risk their lives and freedom by using it you need to make it 100% clear to them what their risks are. Signal could indeed do a better job here. In view of the above, however, I'm having the feeling the risks weren't really clear to you, either? (No offense)

mayneack 6y ago

I've submitted 10+ signal bug reports (none security related) going back to the TextSecure days. I've never had any rude or dismissive responses from the team, but have had my issues hijacked by other people with the issue being overly demanding or rude.