6 ms·

> [..] his Signal randomly sending images to me that he didn't intend to, even without initiating the addition of any attachments on the GUI... he even sees one

> [..] his Signal randomly sending images to me that he didn't intend to, even without initiating the addition of any attachments on the GUI... he even sees one of my messages displayed on his side with a random image attached to it, as if i have sent that image to him, even though that image is not even present on my phone. https://github.com/signalapp/Signal-Android/issues/10247#issuecomment-879377861 https://github.com/signalapp/Signal-Android/issues/10247#iss... Yikes. > [..] I've also recently had a probably unrelated issue where my mic was still audible to the other party after I hung up the call. https://github.com/signalapp/Signal-Android/issues/10247#issuecomment-879466491 https://github.com/signalapp/Signal-Android/issues/10247#iss... Double yikes.

rvz 5y ago
> I've also recently had a probably unrelated issue where my mic was still audible to the other party after I hung up the call. That one there is a cataclysmic security land mine. Absolutely unacceptable. That was the last straw after [0]. I don't think I can recommend Signal at this time. To Downvoters: So these bugs are all fine then? They are not security issues then? Not only having images being sent to the wrong contacts but also having the microphone still on after ending the call and being audible to the other party? That's fine right? If this happened on any other messaging app, I would expect a massive outcry and urgency to fix these critical issues. [0] https://news.ycombinator.com/item?id=27951076 https://news.ycombinator.com/item?id=27951076
- ubercow13 5y ago
  Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition. Which type of privacy breach is more likely to have tangible and direct negative effects on an average user's life - a nation state storing their communications in a database, Facebook graphing their contacts and using them for friend recommendations, or their friends/family/boss/acquaintances being sent random private photos from their phone and audio of private conversations they have in their home, without them knowing? One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands.
  - dmosley 5y ago
    I agree these bugs that Signal has are serious. With hat said, your examples aren't that great for counters. "a nation state storing their communications in a database" - The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison. "Facebook graphing their contacts and using them for friend recommendations" - but, it's not just for friend recommendations and possibly more importantly, it's not just their users, is it? Not to mention it's ignoring the purposeful opinion-biasing they have openly taken part in to manufacture consent for any number of issues. While these bugs are bad and should be prioritized for fix, they are seemingly random. Sure they can possibly be exploited (possible, haven't seen proof of concept for purposeful exploitation), but random bugging vs clear and present danger on current and historical precedents of governments and technocratic oligarchs? Me thinks your trust may be a bit misplaced or you're just being obtuse for sake of obtuseness.
    - deleted 5y ago
      [deleted]
    - markovbot 5y ago
      >The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison. wasn't that kind of the point?
  - maqp 5y ago
    >Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition. Absolutely agree. However, you should always look at the bigger picture a) How was the issue handled? What was the priority? Did they try to downplay it? Was the type of vulnerability patched altogether? b) If a) merits for change, what's the alternative that has better overall security, UX, existing userbase, and track record. Personally, I'd rather take a product with good public incident handling track record, than one without anything on public record. >One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands. Categorical label of "wrong hands" is unnecessarily ominous. Company with access to your private data can lead to that data being sold, or stolen by nation states / organized crime. You sending nudes / sensitive documents to your friend on Signal is less dangerous, although it can be much more embarrassing. Your peer probably isn't going to sell it to the highest bidder (or was it the case the recipient could be any Signal user? IIUC that was not the case)
- mdoms 5y ago
  Why on Earth are people downvoting you? This is an absolute dealbreaker for any messaging app, much less one whose raison d'etre is privacy and secure messaging.
  - hn8788 5y ago
    Probably because the common mindset here is that anyone can make a mistake, and that the person who did it learned their lesson and will never do it again.
    - saurik 5y ago
      And to verify, the "mistake" is seeming to not actually care that this was a serious bug for 7 months (cough while they launched MobileCoin)? That is an attitude issue--and one endemic to Signal (which, most charitably, simply doesn't have the resources to sufficiently care sometimes)--not a "mistake" I expect to be easily rectified. (And as I mention on a nearby post: you don't have to fix it to widely disclose it; like, you don't work in the dark to fix an issue like this for seven months as, even if it were your "top priority": you quickly time box it and then disclose the issue so people can mitigate their exposure or help better crowdsource finding the information you need to fix the issue.)
    - dmix 5y ago
      It also sounded like a very difficult bug to track down, even as a top priority. Requiring a combination of certain settings plus a rare database ID intersection. Combine that with not logging user behaviour heavily for privacies sake makes this a very tough one to replicate. All of which was addressed in the bug report. The realities of software development on a large scale with a privacy focus are sometimes hard to grasp. Although I do admit 7 months for a production release is quite a long time, even factoring in the pandemic and mobile app Play Store release cycles.
      - saurik 5y ago
        So, did they disclose the issue? Were people using Signal warned somewhere that this was a known issue that they were hunting down? (I am guessing not as no one here has been like "oh yeah: everyone using Signal knew to be careful with this feature".) It being a difficult bug to fix doesn't mean that's your only recourse for something this serious.
- qwertox 5y ago
  Laurens Cerulus @laurenscerulus Feb 20, 2020 News: The EU Commission told its staff to start using @signalapp to chat to friends and contacts. The move is part of an effort to fix the holes in EU cybersecurity. Story (for Pros for now) https://twitter.com/bendrath/status/1230455295018766337 https://twitter.com/bendrath/status/1230455295018766337
bakoo 5y ago
The first issue was fixed and just closed, and seems like it was very difficult to track down.
- FabHK 5y ago
  It was closed 4 minutes ago; when was it fixed? ETA: Ah, 4 days ago (more than half a year after it was opened).
- johnchristopher 5y ago
  It's fixed in 5.17 and this is the release number I see on the Google playstore. Unfortunately for my ubuntu 18.04 LTS and this is in no way Signal's fault (but maybe the desktop version doesn't have that bug ?): $ apt-cache policy signal-desktop signal-desktop: Installé : 5.10.0 Candidat : 5.10.0 Table de version : *** 5.10.0 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages 100 /var/lib/dpkg/status 5.9.0 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages 5.8.0 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages
  - maqp 5y ago
    Would rolling into the beta help here? https://support.signal.org/hc/en-us/articles/360007318471-Signal-Beta https://support.signal.org/hc/en-us/articles/360007318471-Si...
    - johnchristopher 5y ago
      I don't think so: $ apt-cache policy signal-desktop-beta signal-desktop-beta: Installé : (aucun) Candidat : 5.11.0-beta.1 Table de version : 5.11.0-beta.1 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages
maltalex 5y ago
> webworxshop opened this issue on 4 Dec 2020 Triple yikes. Though it looks like the issue was finally closed minutes ago: > Hi there, sorry, this issue was fixed in 5.17 (which hit 100% production on 7/21). There was another issue tracking this and it looks like I forgot to close this one. Still, that's a lot of time for such a bug to exist!
crossroadsguy 5y ago
Stopped doing calls on Signal after my Android contacts started telling me that they see active calls minutes after I successfully hung up from my side (iOS). Not to mention the countless UX bugs. I’m back on WhatsApp and not telling anyone anymore to move to Signal or any app whatsoever. I’m done.

rvz 5y ago

> I've also recently had a probably unrelated issue where my mic was still audible to the other party after I hung up the call. That one there is a cataclysmic security land mine. Absolutely unacceptable. That was the last straw after [0]. I don't think I can recommend Signal at this time. To Downvoters: So these bugs are all fine then? They are not security issues then? Not only having images being sent to the wrong contacts but also having the microphone still on after ending the call and being audible to the other party? That's fine right? If this happened on any other messaging app, I would expect a massive outcry and urgency to fix these critical issues. [0] https://news.ycombinator.com/item?id=27951076 https://news.ycombinator.com/item?id=27951076

ubercow13 5y ago
Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition. Which type of privacy breach is more likely to have tangible and direct negative effects on an average user's life - a nation state storing their communications in a database, Facebook graphing their contacts and using them for friend recommendations, or their friends/family/boss/acquaintances being sent random private photos from their phone and audio of private conversations they have in their home, without them knowing? One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands.
- dmosley 5y ago
  I agree these bugs that Signal has are serious. With hat said, your examples aren't that great for counters. "a nation state storing their communications in a database" - The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison. "Facebook graphing their contacts and using them for friend recommendations" - but, it's not just for friend recommendations and possibly more importantly, it's not just their users, is it? Not to mention it's ignoring the purposeful opinion-biasing they have openly taken part in to manufacture consent for any number of issues. While these bugs are bad and should be prioritized for fix, they are seemingly random. Sure they can possibly be exploited (possible, haven't seen proof of concept for purposeful exploitation), but random bugging vs clear and present danger on current and historical precedents of governments and technocratic oligarchs? Me thinks your trust may be a bit misplaced or you're just being obtuse for sake of obtuseness.
  - deleted 5y ago
    [deleted]
  - markovbot 5y ago
    >The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison. wasn't that kind of the point?
- maqp 5y ago
  >Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition. Absolutely agree. However, you should always look at the bigger picture a) How was the issue handled? What was the priority? Did they try to downplay it? Was the type of vulnerability patched altogether? b) If a) merits for change, what's the alternative that has better overall security, UX, existing userbase, and track record. Personally, I'd rather take a product with good public incident handling track record, than one without anything on public record. >One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands. Categorical label of "wrong hands" is unnecessarily ominous. Company with access to your private data can lead to that data being sold, or stolen by nation states / organized crime. You sending nudes / sensitive documents to your friend on Signal is less dangerous, although it can be much more embarrassing. Your peer probably isn't going to sell it to the highest bidder (or was it the case the recipient could be any Signal user? IIUC that was not the case)
mdoms 5y ago
Why on Earth are people downvoting you? This is an absolute dealbreaker for any messaging app, much less one whose raison d'etre is privacy and secure messaging.
- hn8788 5y ago
  Probably because the common mindset here is that anyone can make a mistake, and that the person who did it learned their lesson and will never do it again.
  - saurik 5y ago
    And to verify, the "mistake" is seeming to not actually care that this was a serious bug for 7 months (cough while they launched MobileCoin)? That is an attitude issue--and one endemic to Signal (which, most charitably, simply doesn't have the resources to sufficiently care sometimes)--not a "mistake" I expect to be easily rectified. (And as I mention on a nearby post: you don't have to fix it to widely disclose it; like, you don't work in the dark to fix an issue like this for seven months as, even if it were your "top priority": you quickly time box it and then disclose the issue so people can mitigate their exposure or help better crowdsource finding the information you need to fix the issue.)
  - dmix 5y ago
    It also sounded like a very difficult bug to track down, even as a top priority. Requiring a combination of certain settings plus a rare database ID intersection. Combine that with not logging user behaviour heavily for privacies sake makes this a very tough one to replicate. All of which was addressed in the bug report. The realities of software development on a large scale with a privacy focus are sometimes hard to grasp. Although I do admit 7 months for a production release is quite a long time, even factoring in the pandemic and mobile app Play Store release cycles.
    - saurik 5y ago
      So, did they disclose the issue? Were people using Signal warned somewhere that this was a known issue that they were hunting down? (I am guessing not as no one here has been like "oh yeah: everyone using Signal knew to be careful with this feature".) It being a difficult bug to fix doesn't mean that's your only recourse for something this serious.
qwertox 5y ago
Laurens Cerulus @laurenscerulus Feb 20, 2020 News: The EU Commission told its staff to start using @signalapp to chat to friends and contacts. The move is part of an effort to fix the holes in EU cybersecurity. Story (for Pros for now) https://twitter.com/bendrath/status/1230455295018766337 https://twitter.com/bendrath/status/1230455295018766337

bakoo 5y ago

The first issue was fixed and just closed, and seems like it was very difficult to track down.

FabHK 5y ago
It was closed 4 minutes ago; when was it fixed? ETA: Ah, 4 days ago (more than half a year after it was opened).
johnchristopher 5y ago
It's fixed in 5.17 and this is the release number I see on the Google playstore. Unfortunately for my ubuntu 18.04 LTS and this is in no way Signal's fault (but maybe the desktop version doesn't have that bug ?): $ apt-cache policy signal-desktop signal-desktop: Installé : 5.10.0 Candidat : 5.10.0 Table de version : *** 5.10.0 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages 100 /var/lib/dpkg/status 5.9.0 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages 5.8.0 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages
- maqp 5y ago
  Would rolling into the beta help here? https://support.signal.org/hc/en-us/articles/360007318471-Signal-Beta https://support.signal.org/hc/en-us/articles/360007318471-Si...
  - johnchristopher 5y ago
    I don't think so: $ apt-cache policy signal-desktop-beta signal-desktop-beta: Installé : (aucun) Candidat : 5.11.0-beta.1 Table de version : 5.11.0-beta.1 500 500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages

maltalex 5y ago

> webworxshop opened this issue on 4 Dec 2020 Triple yikes. Though it looks like the issue was finally closed minutes ago: > Hi there, sorry, this issue was fixed in 5.17 (which hit 100% production on 7/21). There was another issue tracking this and it looks like I forgot to close this one. Still, that's a lot of time for such a bug to exist!

crossroadsguy 5y ago

Stopped doing calls on Signal after my Android contacts started telling me that they see active calls minutes after I successfully hung up from my side (iOS). Not to mention the countless UX bugs. I’m back on WhatsApp and not telling anyone anymore to move to Signal or any app whatsoever. I’m done.