6 ms·

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assure

by lwhi 5y ago

I appreciate that this was a difficult and rare bug, but for an app that sells itself as 'secure', it feels like this isn't acceptable. How can users be assured that this type of issue won't occur again?

nerbert 5y ago
‘Many forms of secure messaging systems have been tried, and will be tried in this world of sin and woe. No one pretends that Signal is perfect or all-wise. Indeed it has been said that Signal is the worst messaging except for all those other forms that have been developed from time to time…’ Winston S Churchill, 11 November 1947
- geofft 5y ago
  Sure, but there's a small theoretical difference with democracy. You have to live under some system of government. You don't have to use a secure messenger. You can choose to have sensitive conversations in person or not have them at all. I agree that in practice, a lot of people are going to use their phones for relatively sensitive conversations, and in practice, Signal remains the best choice for doing so. But there are a few real threat models where the options aren't Signal vs. SMS / Google Chat / Discord / etc., the options are Signal vs. nothing. For instance, you could be a journalist deciding whether to ask clarifying questions to a government whistleblower via Signal or meet up with them in a park. You could be an activist/demonstrator under a repressive regime deciding whether to coordinate some action this weekend via Signal or hold off on it entirely and tactically preserve your freedom. And so forth. For those people, if (and to be clear this is a big "if," while this issue is one serious piece of evidence it is nonetheless inconclusive) Signal isn't trustworthy, it doesn't matter if Signal is the least-bad of the options. (Also, it's not like Signal is the only e2e messenger around. There's iMessage/FaceTime, for instance. Churchill's claim was that the abstract idea of democracy was good, not that any concrete implementation like the British government was good.)
  - helmholtz 5y ago
    You make some fair points. But even from the eyes of those people, what is the alternative? Is iMessage guaranteed to not have any hidden exploits out there? And on the flip side, what do they lose out on by only having those conversations in person? Well, I'd argue that their world becomes a lot smaller, and there sources are instantly at a higher risk.
    - geofft 5y ago
      If iMessage were sending photos to the wrong people (even with extremely low probability) for over half a year, there would be serious negative publicity to Apple for it, even if they had never implemented end-to-end encryption. Apple also has more software testers and more willingness to use telemetry. So while there are no 100% guarantees, I think the incentives are aligned with iMessage at least as well as they are with Signal. Apple suffered negative publicity from the 2014 iCloud photo leaks, even though those were "just" phishing and not a vulnerability/bug in the strict sense. Tim Cook had to give statements to the media, and in fact Apple stepped up its phishing protection by pushing two-factor authentication and notifying users about additional iCloud logins.
  - godelski 5y ago
    > You can choose to have sensitive conversations in person or not have them at all. I don't think this is fair. Most of the solution to this is "not having them at all." That's not a good solution and still doesn't solve your problem since you can still be listened to. > There's iMessage/FaceTime, for instance. Which also has gotten in trouble recently with Pegasus as there was a 0-click exploit in iMessage. Honestly, that is a far more serious issue than the one here. That being said, I still trust iMessage and that the devs are doing the best that they can. I just recognize that security is difficult and will always be a cat and mouse game. There is no such thing as perfect security.
    - geofft 5y ago
      I think what I'm trying to get at is that incorrectly believing you have access to a secure messenger can be worse than acting as if you don't, if those are your options. The whistleblower might choose not to make contact, but if the alternative is making contact and immediately going to prison (because someone else on your contact list saw a classified screenshot from you and told the authorities), maybe that's better. The activists might choose not to protest, but if the alternative is being caught before they even start their protest (because your group was forwarding a little advertisement image or annotated map around among trusted people, and someone untrusted got it), maybe that's better. Take Reality Winner, for instance (the mechanics of that case were entirely unrelated to secure messengers, but it makes a relevant example overall). The effect on the world of her whistleblowing seems to have been minimal, and the cost to her was significant. Was it worthwhile? If she had been told the risks of the government identifying her were higher and decided not to leak anything, wouldn't that have been a better outcome? I'm not saying there's perfect security. Vulnerable users absolutely need to be making risk assessments and deciding what they're comfortable with, and we should be clear nothing is risk-free. I'm just saying my sense of Signal's risk, in absolute terms, is higher than it was before I learned about this, and that matters to vulnerable users, not just the fact that it probably remains the lowest-risk messenger of the various options. I agree with you overall, and the Pegasus exploit does reflect badly on Apple (and probably should reflect more badly on them than seems to be happening).
osobo 5y ago
How much did you pay for it again?
okdjnfweonfe 5y ago
Probably by installing some hardened memory on your phone to prevent cosmic bitflips or the such. Unless you are going to go to NASA lengths of hardware reliability, you can't really hope much for the software that has to deal with the issues of... how many different android phones are there?
- geofft 5y ago
  The available evidence indicates that this was due to a logic error, not to cosmic rays and/or Android ecosystem diversity.
tablespoon 5y ago
> How can users be assured that this type of issue won't occur again? By not using software. And I mean software in general, not this software in particular. You're basically asking for assurance that they won't have any more bugs, but no one can actually provide such an assurance in the real world.
- lwhi 5y ago
  I disagree. If that really is the choice, they should drop the secure moniker without further debate. -- If you produce a product that claims to be secure, the onus is on you to back up those claims. Off the top my my head there are many ways to implement measures that can help to encourage security going forward. One of the benefits of coding in the open, and ascribing to opens standards and protocols is transparency and the ability for all to interrogate the code. Can that work? It's obviously partly also down to the culture of the product team. As another poster in this thread has highlighted, the commit messages are terse and not as helpful as they could be. Perhaps more openness re. intention would help. Also, why are we finding out about this bug over 7 months after it was reported? Transparency regarding vulnerabilities needs to be at the forefront of the products communications if the team really are serious about security. In terms of isolating bugs; what kind of testing is in place. TDD, functional testing, beta testing? There are so many avenues which _could_ be discussed in relation to my initial question. Your response, is unfortunately not providing anything helpful.
  - asdfasgasdgasdg 5y ago
    > One of the benefits of coding in the open, and ascribing to opens standards and protocols is transparency and the ability for all to interrogate the code. They already do all of those things. https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
    - hellcow 5y ago
      In word but not in spirit. They stopped updating their repo for an entire year while integrating a crypto shitcoin in secret. These actions betray trust, and trust is Signal's entire reason for being.
renewiltord 5y ago
The answer is that you can’t be assured. Act as you will with that info.
goodpoint 5y ago
> How can users be assured that this type of issue won't occur again? By writing code defensively. Despite the other comments, it's possible. The key is to be redundant: for example, off-by-one errors are very common when accessing an set of indexed items by number. Yet you can split the set (e.g. an array) in multiple ones to make it more unlikely that you pick the wrong item (e.g. picture vs users). You can also "tag" the outgoing image with some attributes, e.g. the recipient and a sent/not-sent flag. You can cross-check and stop if something is inconsistent. Many other things are possible e.g. to protect from RAM bit flips. It's not a matter of language or tooling, it's a matter of mindset.
- eganist 5y ago
  > By writing code defensively. Despite the other comments, it's possible. I'm going to tack onto this and suggest that signal drastically slow down the pace of feature development. They don't have the same profit motivations other companies have. The messaging market, at least in its current state, is largely known. These both give Signal an advantage in that they can slow down and harden the product while baking security into their DevOps practices as a first class citizen. Tl;dr: signal needs to slow down.
asdfasgasdgasdg 5y ago
What does it mean for it to "not be acceptable?" Accepting or not accepting the bug is not an option on the table. It happened. The options you have open to you are to use or not use the freely provided software, or donate or not donate to the foundation providing it. Users cannot be assured that future bugs will not occur. That is an assurance that is not available with most consumer software, and certainly not with software delivered for free by a not-for-profit.
- stathibus 5y ago
  Yes, Signal is a messaging app whose whole reason for existing is privacy, but it does not actually guarantee any privacy features; it just tries its best. Despite this "who cares if it works" premise, they have raised tens of millions of dollars. I dream of a world where commercial software is held to the same standards as even the lowest quality commercial hardware.
  - asdfasgasdgasdg 5y ago
    Concretely, what would you like to see done? Should the foundation be hit with a fine or a lawsuit for this bug? Would that improve the overall security stance of the public at large?
    - stathibus 5y ago
      I would like to see the foundation put their enormous investment into making a product that works correctly. If that's too much to ask, then they really ought to be more public and forthcoming about the fact that Signal is not actually private or secure.
- lwhi 5y ago
  If you are unclear, perhaps it would be useful to ask yourself what you would personally need from a product to consider it 'secure'.
hnarn 5y ago
Users are not entitled to a guarantee that this will never happen again, because Signal is free and open source software provided free of charge and without warranty. The Android app is GPL licensed. The license clearly states: > For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. If you feel let down by open source software, you have many options available to you to make that software more reliable.
- ghoward 5y ago
  Moxie Marlinspike is famously belligerent against Signal forks, so no, the license does not really help here.
  - sneak 5y ago
    It does. You are allowed to fork or reimplement the Signal client, and even distribute it, with the official Signal servers configured, so long as you do not infringe the Signal trademark. They don't like forks using their servers, but it's the users who connect to their servers, not the fork publisher. Those users are permitted to connect via the TOS, which is independent from the GPL.
    - lwhi 5y ago
      They also refuse to open source their server software. This is the problem in my mind. Open source in words, but not spirit.
      - h_anna_h 5y ago
        This is false https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
        lwhi 5y ago
        So are you telling me I can run my signal server and use it to communicate with others on the signal network?
chithanh 5y ago
> How can users be assured that this type of issue won't occur again? Actually, this very type of issue (sending messages to wrong recipients due to stale/invalid database entries) has occured previously. https://github.com/signalapp/Signal-Android/issues/7909 https://github.com/signalapp/Signal-Android/issues/7909
rattray 5y ago
They could choose to use a less transparent company's software, so that they never become aware of rare issues like this in the first place?

by lwhi 5y ago

nerbert 5y ago

‘Many forms of secure messaging systems have been tried, and will be tried in this world of sin and woe. No one pretends that Signal is perfect or all-wise. Indeed it has been said that Signal is the worst messaging except for all those other forms that have been developed from time to time…’ Winston S Churchill, 11 November 1947

geofft 5y ago
Sure, but there's a small theoretical difference with democracy. You have to live under some system of government. You don't have to use a secure messenger. You can choose to have sensitive conversations in person or not have them at all. I agree that in practice, a lot of people are going to use their phones for relatively sensitive conversations, and in practice, Signal remains the best choice for doing so. But there are a few real threat models where the options aren't Signal vs. SMS / Google Chat / Discord / etc., the options are Signal vs. nothing. For instance, you could be a journalist deciding whether to ask clarifying questions to a government whistleblower via Signal or meet up with them in a park. You could be an activist/demonstrator under a repressive regime deciding whether to coordinate some action this weekend via Signal or hold off on it entirely and tactically preserve your freedom. And so forth. For those people, if (and to be clear this is a big "if," while this issue is one serious piece of evidence it is nonetheless inconclusive) Signal isn't trustworthy, it doesn't matter if Signal is the least-bad of the options. (Also, it's not like Signal is the only e2e messenger around. There's iMessage/FaceTime, for instance. Churchill's claim was that the abstract idea of democracy was good, not that any concrete implementation like the British government was good.)
- helmholtz 5y ago
  You make some fair points. But even from the eyes of those people, what is the alternative? Is iMessage guaranteed to not have any hidden exploits out there? And on the flip side, what do they lose out on by only having those conversations in person? Well, I'd argue that their world becomes a lot smaller, and there sources are instantly at a higher risk.
  - geofft 5y ago
    If iMessage were sending photos to the wrong people (even with extremely low probability) for over half a year, there would be serious negative publicity to Apple for it, even if they had never implemented end-to-end encryption. Apple also has more software testers and more willingness to use telemetry. So while there are no 100% guarantees, I think the incentives are aligned with iMessage at least as well as they are with Signal. Apple suffered negative publicity from the 2014 iCloud photo leaks, even though those were "just" phishing and not a vulnerability/bug in the strict sense. Tim Cook had to give statements to the media, and in fact Apple stepped up its phishing protection by pushing two-factor authentication and notifying users about additional iCloud logins.
- godelski 5y ago
  > You can choose to have sensitive conversations in person or not have them at all. I don't think this is fair. Most of the solution to this is "not having them at all." That's not a good solution and still doesn't solve your problem since you can still be listened to. > There's iMessage/FaceTime, for instance. Which also has gotten in trouble recently with Pegasus as there was a 0-click exploit in iMessage. Honestly, that is a far more serious issue than the one here. That being said, I still trust iMessage and that the devs are doing the best that they can. I just recognize that security is difficult and will always be a cat and mouse game. There is no such thing as perfect security.
  - geofft 5y ago
    I think what I'm trying to get at is that incorrectly believing you have access to a secure messenger can be worse than acting as if you don't, if those are your options. The whistleblower might choose not to make contact, but if the alternative is making contact and immediately going to prison (because someone else on your contact list saw a classified screenshot from you and told the authorities), maybe that's better. The activists might choose not to protest, but if the alternative is being caught before they even start their protest (because your group was forwarding a little advertisement image or annotated map around among trusted people, and someone untrusted got it), maybe that's better. Take Reality Winner, for instance (the mechanics of that case were entirely unrelated to secure messengers, but it makes a relevant example overall). The effect on the world of her whistleblowing seems to have been minimal, and the cost to her was significant. Was it worthwhile? If she had been told the risks of the government identifying her were higher and decided not to leak anything, wouldn't that have been a better outcome? I'm not saying there's perfect security. Vulnerable users absolutely need to be making risk assessments and deciding what they're comfortable with, and we should be clear nothing is risk-free. I'm just saying my sense of Signal's risk, in absolute terms, is higher than it was before I learned about this, and that matters to vulnerable users, not just the fact that it probably remains the lowest-risk messenger of the various options. I agree with you overall, and the Pegasus exploit does reflect badly on Apple (and probably should reflect more badly on them than seems to be happening).

osobo 5y ago

How much did you pay for it again?

okdjnfweonfe 5y ago

Probably by installing some hardened memory on your phone to prevent cosmic bitflips or the such. Unless you are going to go to NASA lengths of hardware reliability, you can't really hope much for the software that has to deal with the issues of... how many different android phones are there?

geofft 5y ago
The available evidence indicates that this was due to a logic error, not to cosmic rays and/or Android ecosystem diversity.

tablespoon 5y ago

> How can users be assured that this type of issue won't occur again? By not using software. And I mean software in general, not this software in particular. You're basically asking for assurance that they won't have any more bugs, but no one can actually provide such an assurance in the real world.

lwhi 5y ago
I disagree. If that really is the choice, they should drop the secure moniker without further debate. -- If you produce a product that claims to be secure, the onus is on you to back up those claims. Off the top my my head there are many ways to implement measures that can help to encourage security going forward. One of the benefits of coding in the open, and ascribing to opens standards and protocols is transparency and the ability for all to interrogate the code. Can that work? It's obviously partly also down to the culture of the product team. As another poster in this thread has highlighted, the commit messages are terse and not as helpful as they could be. Perhaps more openness re. intention would help. Also, why are we finding out about this bug over 7 months after it was reported? Transparency regarding vulnerabilities needs to be at the forefront of the products communications if the team really are serious about security. In terms of isolating bugs; what kind of testing is in place. TDD, functional testing, beta testing? There are so many avenues which _could_ be discussed in relation to my initial question. Your response, is unfortunately not providing anything helpful.
- asdfasgasdgasdg 5y ago
  > One of the benefits of coding in the open, and ascribing to opens standards and protocols is transparency and the ability for all to interrogate the code. They already do all of those things. https://github.com/signalapp/Signal-Android https://github.com/signalapp/Signal-Android
  - hellcow 5y ago
    In word but not in spirit. They stopped updating their repo for an entire year while integrating a crypto shitcoin in secret. These actions betray trust, and trust is Signal's entire reason for being.

renewiltord 5y ago

The answer is that you can’t be assured. Act as you will with that info.

goodpoint 5y ago

> How can users be assured that this type of issue won't occur again? By writing code defensively. Despite the other comments, it's possible. The key is to be redundant: for example, off-by-one errors are very common when accessing an set of indexed items by number. Yet you can split the set (e.g. an array) in multiple ones to make it more unlikely that you pick the wrong item (e.g. picture vs users). You can also "tag" the outgoing image with some attributes, e.g. the recipient and a sent/not-sent flag. You can cross-check and stop if something is inconsistent. Many other things are possible e.g. to protect from RAM bit flips. It's not a matter of language or tooling, it's a matter of mindset.

eganist 5y ago
> By writing code defensively. Despite the other comments, it's possible. I'm going to tack onto this and suggest that signal drastically slow down the pace of feature development. They don't have the same profit motivations other companies have. The messaging market, at least in its current state, is largely known. These both give Signal an advantage in that they can slow down and harden the product while baking security into their DevOps practices as a first class citizen. Tl;dr: signal needs to slow down.

asdfasgasdgasdg 5y ago

What does it mean for it to "not be acceptable?" Accepting or not accepting the bug is not an option on the table. It happened. The options you have open to you are to use or not use the freely provided software, or donate or not donate to the foundation providing it. Users cannot be assured that future bugs will not occur. That is an assurance that is not available with most consumer software, and certainly not with software delivered for free by a not-for-profit.

stathibus 5y ago
Yes, Signal is a messaging app whose whole reason for existing is privacy, but it does not actually guarantee any privacy features; it just tries its best. Despite this "who cares if it works" premise, they have raised tens of millions of dollars. I dream of a world where commercial software is held to the same standards as even the lowest quality commercial hardware.
- asdfasgasdgasdg 5y ago
  Concretely, what would you like to see done? Should the foundation be hit with a fine or a lawsuit for this bug? Would that improve the overall security stance of the public at large?
  - stathibus 5y ago
    I would like to see the foundation put their enormous investment into making a product that works correctly. If that's too much to ask, then they really ought to be more public and forthcoming about the fact that Signal is not actually private or secure.
lwhi 5y ago
If you are unclear, perhaps it would be useful to ask yourself what you would personally need from a product to consider it 'secure'.

hnarn 5y ago

Users are not entitled to a guarantee that this will never happen again, because Signal is free and open source software provided free of charge and without warranty. The Android app is GPL licensed. The license clearly states: > For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. If you feel let down by open source software, you have many options available to you to make that software more reliable.

ghoward 5y ago
Moxie Marlinspike is famously belligerent against Signal forks, so no, the license does not really help here.
- sneak 5y ago
  It does. You are allowed to fork or reimplement the Signal client, and even distribute it, with the official Signal servers configured, so long as you do not infringe the Signal trademark. They don't like forks using their servers, but it's the users who connect to their servers, not the fork publisher. Those users are permitted to connect via the TOS, which is independent from the GPL.
  - lwhi 5y ago
    They also refuse to open source their server software. This is the problem in my mind. Open source in words, but not spirit.
    - h_anna_h 5y ago
      This is false https://github.com/signalapp/Signal-Server https://github.com/signalapp/Signal-Server
      - lwhi 5y ago
        So are you telling me I can run my signal server and use it to communicate with others on the signal network?

chithanh 5y ago

> How can users be assured that this type of issue won't occur again? Actually, this very type of issue (sending messages to wrong recipients due to stale/invalid database entries) has occured previously. https://github.com/signalapp/Signal-Android/issues/7909 https://github.com/signalapp/Signal-Android/issues/7909

rattray 5y ago

They could choose to use a less transparent company's software, so that they never become aware of rare issues like this in the first place?