3 ms·

Signal totally lost my confidence with the Chinese IME debacle. They were told repeatedly for a year that Chinese Signal users were vulnerable and needed a warn

Signal totally lost my confidence with the Chinese IME debacle. They were told repeatedly for a year that Chinese Signal users were vulnerable and needed a warning in the app. They intentionally ignored the problem because the wrong type of person was reporting it. Then once enough white men repeated the complaint, they put the warning in. Prejudice is a security vulnerability if it makes you ignore vulnerability reports. Signal have demonstrated that they have this security vulnerability and as far as I can see they haven’t taken any steps to close it.

vinay_ys 3y ago
Interesting. Totally missed this news. Could you edit/post some links to this coverage?
- JimDabell 3y ago
  A summary, because it’s a bit spread out over a few places: - It’s extremely common for Chinese people to use third-party keyboards. - If they do this, all security Signal provides is undermined. - Signal tells people it’s a secure way of communicating. People in China believe this and use Signal without realising they aren’t secure. - It’s fair to expect Signal – an organisation founded and run by Americans – to not be aware that Chinese people use their phones in a very different way to westerners. - A Chinese woman has been telling them about this problem for years and asking for a warning to be put into Signal so that Chinese users are aware they can’t use Signal securely in this way. - Signal conspicuously ignored her for a very long time. Things like Moxie blocking her on Twitter, misrepresenting the request as a “boiling the ocean” type request, saying she was just attention-seeking, saying that people should decompile keyboards to prove they are transmitting keystrokes, etc. Have you ever heard a security professional say that they need evidence that something is being actively exploited before they will do anything about it? - Finally after a year of this, he replied to a man on Twitter saying “Totally, if this is the thing people want, that's np.” – as if this hasn’t been brought up over and over again by her to the point of him blocking her because she was annoying him too much. - At this point people point out that this is what she has been asking for for years. So he apologises. To the men he’s talking to, not her. - And just recently, it turns out insecure keyboard leaking is something that has been affecting hundreds of millions of Chinese users. So it was absolutely a real problem that Chinese Signal users needed to be aware of, and it was a major security fuckup that Signal delayed warning people for over a year. Unsurprisingly, she’s less than polite when talking about Signal. And she’s a provocative person in general. But the fact remains that she was telling Signal about a real problem for a long time, and they were conspicuously ignoring it when it came from her but finally acted on the problem when she got a few white men to repeat the complaint for her. I get that she rubs some people up the wrong way, but if you’re a person from the west being told by a Chinese person that there’s something particular to their demographic that is wrecking your security, you should pay attention, not do everything you can to avoid them. I don’t trust software to be secure if they disregard security issues because they don’t like who is reporting them, and nobody else should either. Here are some links: https://www.technologyreview.com/2023/08/21/1078207/sogou-keyboard-app-security-loophole/ https://www.technologyreview.com/2023/08/21/1078207/sogou-ke... https://twitter.com/RealSexyCyborg/status/1197695344575799296 https://twitter.com/RealSexyCyborg/status/119769534457579929... https://twitter.com/RealSexyCyborg/status/1351006604565557249 https://twitter.com/RealSexyCyborg/status/135100660456555724... https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272/127 https://community.signalusers.org/t/signal-should-warn-users... https://twitter.com/moxie/status/1351205613645258756 https://twitter.com/moxie/status/1351205613645258756
  - vinay_ys 3y ago
    Ah the custom keyboard leak vector. I remember this controversy now.
  - GoblinSlayer 3y ago
    It doesn't sound like a Signal's problem. When the user compromises the system, the whole system is compromised, not just Signal, and there are many ways to do it, not only keyboard, any spyware would do. IME is a system component, so it's the system vendor's problem that they neither provide nor recommend an IME.
    - JimDabell 3y ago
      > It doesn't sound like a Signal's problem It is. This was discussed at length in the Signal users community link I provided. I’m not going to repeat everything that was said over there. Do you have anything new to add that wasn’t covered there?
      - GoblinSlayer 3y ago
        Mere existence of discussion doesn't mean much, you can't talk facts away.
KennyBlanken 3y ago
I can't tell if you're genuinely ignorant or purposefully misrepresenting nearly everything about the issue. It's not a "security vulnerability" in Signal that the user can install a third party keyboard app that spies on them, even after the OS warns them against that risk, nor is it Signal's fault that keyboard apps are not required to respect the private-mode call/flag an app can use. The only solution to close this hole would be for Signal to implement its own virtual keyboard, which would be a massive undertaking. > They were told repeatedly for a year that Chinese Signal users were vulnerable and needed a warning in the app. They intentionally ignored the problem because the wrong type of person was reporting it. Stop racebaiting - race had nothing to do with it. Naomi Wu threw a profanity-laden, insult-filled temper tantrum because she was apparently the last person on the planet to get the "third party keyboards are insecure" memo, accused Signal of misleading marketing because she wildly misinterpreted it saying it guarantees users privacy, and was outraged the Signal app does not warn people using a non-stock keyboard that their privacy might be violated. She demanded they add a warning. Signal said "not our responsibility to warn users about stuff they've installed" which is a reasonable take, especially since Android OS warns about security risks upon installation of a third party keyboard. Signal is not a vulnerability-scanning tool, it's a messaging app. Moxinspike said he felt Naomi was making a huge scene about it to stir up shit on social media for attention, and I think he's right. Scroll through her twitter feed and you'll see she's like a Singapore version of Briana Wu; just one outrage-bait post after another...and lashing out at other developers, like the first page of her twitter feed; here's her abusively lashing out at the entire Mastodon dev community in a cryptic-passive-aggressive way: https://twitter.com/RealSexyCyborg/status/1589534173928501248 https://twitter.com/RealSexyCyborg/status/158953417392850124... The tweet making fun of the "struggles of e-thots" was particularly rich, too.
- JimDabell 3y ago
  > I can't tell if you're genuinely ignorant or purposefully misrepresenting nearly everything about the issue. Do you want to try this reply again?

vinay_ys 3y ago

Interesting. Totally missed this news. Could you edit/post some links to this coverage?

JimDabell 3y ago
A summary, because it’s a bit spread out over a few places: - It’s extremely common for Chinese people to use third-party keyboards. - If they do this, all security Signal provides is undermined. - Signal tells people it’s a secure way of communicating. People in China believe this and use Signal without realising they aren’t secure. - It’s fair to expect Signal – an organisation founded and run by Americans – to not be aware that Chinese people use their phones in a very different way to westerners. - A Chinese woman has been telling them about this problem for years and asking for a warning to be put into Signal so that Chinese users are aware they can’t use Signal securely in this way. - Signal conspicuously ignored her for a very long time. Things like Moxie blocking her on Twitter, misrepresenting the request as a “boiling the ocean” type request, saying she was just attention-seeking, saying that people should decompile keyboards to prove they are transmitting keystrokes, etc. Have you ever heard a security professional say that they need evidence that something is being actively exploited before they will do anything about it? - Finally after a year of this, he replied to a man on Twitter saying “Totally, if this is the thing people want, that's np.” – as if this hasn’t been brought up over and over again by her to the point of him blocking her because she was annoying him too much. - At this point people point out that this is what she has been asking for for years. So he apologises. To the men he’s talking to, not her. - And just recently, it turns out insecure keyboard leaking is something that has been affecting hundreds of millions of Chinese users. So it was absolutely a real problem that Chinese Signal users needed to be aware of, and it was a major security fuckup that Signal delayed warning people for over a year. Unsurprisingly, she’s less than polite when talking about Signal. And she’s a provocative person in general. But the fact remains that she was telling Signal about a real problem for a long time, and they were conspicuously ignoring it when it came from her but finally acted on the problem when she got a few white men to repeat the complaint for her. I get that she rubs some people up the wrong way, but if you’re a person from the west being told by a Chinese person that there’s something particular to their demographic that is wrecking your security, you should pay attention, not do everything you can to avoid them. I don’t trust software to be secure if they disregard security issues because they don’t like who is reporting them, and nobody else should either. Here are some links: https://www.technologyreview.com/2023/08/21/1078207/sogou-keyboard-app-security-loophole/ https://www.technologyreview.com/2023/08/21/1078207/sogou-ke... https://twitter.com/RealSexyCyborg/status/1197695344575799296 https://twitter.com/RealSexyCyborg/status/119769534457579929... https://twitter.com/RealSexyCyborg/status/1351006604565557249 https://twitter.com/RealSexyCyborg/status/135100660456555724... https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272/127 https://community.signalusers.org/t/signal-should-warn-users... https://twitter.com/moxie/status/1351205613645258756 https://twitter.com/moxie/status/1351205613645258756
- vinay_ys 3y ago
  Ah the custom keyboard leak vector. I remember this controversy now.
- GoblinSlayer 3y ago
  It doesn't sound like a Signal's problem. When the user compromises the system, the whole system is compromised, not just Signal, and there are many ways to do it, not only keyboard, any spyware would do. IME is a system component, so it's the system vendor's problem that they neither provide nor recommend an IME.
  - JimDabell 3y ago
    > It doesn't sound like a Signal's problem It is. This was discussed at length in the Signal users community link I provided. I’m not going to repeat everything that was said over there. Do you have anything new to add that wasn’t covered there?
    - GoblinSlayer 3y ago
      Mere existence of discussion doesn't mean much, you can't talk facts away.

KennyBlanken 3y ago

I can't tell if you're genuinely ignorant or purposefully misrepresenting nearly everything about the issue. It's not a "security vulnerability" in Signal that the user can install a third party keyboard app that spies on them, even after the OS warns them against that risk, nor is it Signal's fault that keyboard apps are not required to respect the private-mode call/flag an app can use. The only solution to close this hole would be for Signal to implement its own virtual keyboard, which would be a massive undertaking. > They were told repeatedly for a year that Chinese Signal users were vulnerable and needed a warning in the app. They intentionally ignored the problem because the wrong type of person was reporting it. Stop racebaiting - race had nothing to do with it. Naomi Wu threw a profanity-laden, insult-filled temper tantrum because she was apparently the last person on the planet to get the "third party keyboards are insecure" memo, accused Signal of misleading marketing because she wildly misinterpreted it saying it guarantees users privacy, and was outraged the Signal app does not warn people using a non-stock keyboard that their privacy might be violated. She demanded they add a warning. Signal said "not our responsibility to warn users about stuff they've installed" which is a reasonable take, especially since Android OS warns about security risks upon installation of a third party keyboard. Signal is not a vulnerability-scanning tool, it's a messaging app. Moxinspike said he felt Naomi was making a huge scene about it to stir up shit on social media for attention, and I think he's right. Scroll through her twitter feed and you'll see she's like a Singapore version of Briana Wu; just one outrage-bait post after another...and lashing out at other developers, like the first page of her twitter feed; here's her abusively lashing out at the entire Mastodon dev community in a cryptic-passive-aggressive way: https://twitter.com/RealSexyCyborg/status/1589534173928501248 https://twitter.com/RealSexyCyborg/status/158953417392850124... The tweet making fun of the "struggles of e-thots" was particularly rich, too.

JimDabell 3y ago
> I can't tell if you're genuinely ignorant or purposefully misrepresenting nearly everything about the issue. Do you want to try this reply again?