3 ms·

Interesting. Totally missed this news. Could you edit/post some links to this coverage?

JimDabell 3y ago
A summary, because it’s a bit spread out over a few places: - It’s extremely common for Chinese people to use third-party keyboards. - If they do this, all security Signal provides is undermined. - Signal tells people it’s a secure way of communicating. People in China believe this and use Signal without realising they aren’t secure. - It’s fair to expect Signal – an organisation founded and run by Americans – to not be aware that Chinese people use their phones in a very different way to westerners. - A Chinese woman has been telling them about this problem for years and asking for a warning to be put into Signal so that Chinese users are aware they can’t use Signal securely in this way. - Signal conspicuously ignored her for a very long time. Things like Moxie blocking her on Twitter, misrepresenting the request as a “boiling the ocean” type request, saying she was just attention-seeking, saying that people should decompile keyboards to prove they are transmitting keystrokes, etc. Have you ever heard a security professional say that they need evidence that something is being actively exploited before they will do anything about it? - Finally after a year of this, he replied to a man on Twitter saying “Totally, if this is the thing people want, that's np.” – as if this hasn’t been brought up over and over again by her to the point of him blocking her because she was annoying him too much. - At this point people point out that this is what she has been asking for for years. So he apologises. To the men he’s talking to, not her. - And just recently, it turns out insecure keyboard leaking is something that has been affecting hundreds of millions of Chinese users. So it was absolutely a real problem that Chinese Signal users needed to be aware of, and it was a major security fuckup that Signal delayed warning people for over a year. Unsurprisingly, she’s less than polite when talking about Signal. And she’s a provocative person in general. But the fact remains that she was telling Signal about a real problem for a long time, and they were conspicuously ignoring it when it came from her but finally acted on the problem when she got a few white men to repeat the complaint for her. I get that she rubs some people up the wrong way, but if you’re a person from the west being told by a Chinese person that there’s something particular to their demographic that is wrecking your security, you should pay attention, not do everything you can to avoid them. I don’t trust software to be secure if they disregard security issues because they don’t like who is reporting them, and nobody else should either. Here are some links: https://www.technologyreview.com/2023/08/21/1078207/sogou-keyboard-app-security-loophole/ https://www.technologyreview.com/2023/08/21/1078207/sogou-ke... https://twitter.com/RealSexyCyborg/status/1197695344575799296 https://twitter.com/RealSexyCyborg/status/119769534457579929... https://twitter.com/RealSexyCyborg/status/1351006604565557249 https://twitter.com/RealSexyCyborg/status/135100660456555724... https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272/127 https://community.signalusers.org/t/signal-should-warn-users... https://twitter.com/moxie/status/1351205613645258756 https://twitter.com/moxie/status/1351205613645258756
- vinay_ys 3y ago
  Ah the custom keyboard leak vector. I remember this controversy now.
- GoblinSlayer 3y ago
  It doesn't sound like a Signal's problem. When the user compromises the system, the whole system is compromised, not just Signal, and there are many ways to do it, not only keyboard, any spyware would do. IME is a system component, so it's the system vendor's problem that they neither provide nor recommend an IME.
  - JimDabell 3y ago
    > It doesn't sound like a Signal's problem It is. This was discussed at length in the Signal users community link I provided. I’m not going to repeat everything that was said over there. Do you have anything new to add that wasn’t covered there?
    - GoblinSlayer 3y ago
      Mere existence of discussion doesn't mean much, you can't talk facts away.

A summary, because it’s a bit spread out over a few places: - It’s extremely common for Chinese people to use third-party keyboards. - If they do this, all security Signal provides is undermined. - Signal tells people it’s a secure way of communicating. People in China believe this and use Signal without realising they aren’t secure. - It’s fair to expect Signal – an organisation founded and run by Americans – to not be aware that Chinese people use their phones in a very different way to westerners. - A Chinese woman has been telling them about this problem for years and asking for a warning to be put into Signal so that Chinese users are aware they can’t use Signal securely in this way. - Signal conspicuously ignored her for a very long time. Things like Moxie blocking her on Twitter, misrepresenting the request as a “boiling the ocean” type request, saying she was just attention-seeking, saying that people should decompile keyboards to prove they are transmitting keystrokes, etc. Have you ever heard a security professional say that they need evidence that something is being actively exploited before they will do anything about it? - Finally after a year of this, he replied to a man on Twitter saying “Totally, if this is the thing people want, that's np.” – as if this hasn’t been brought up over and over again by her to the point of him blocking her because she was annoying him too much. - At this point people point out that this is what she has been asking for for years. So he apologises. To the men he’s talking to, not her. - And just recently, it turns out insecure keyboard leaking is something that has been affecting hundreds of millions of Chinese users. So it was absolutely a real problem that Chinese Signal users needed to be aware of, and it was a major security fuckup that Signal delayed warning people for over a year. Unsurprisingly, she’s less than polite when talking about Signal. And she’s a provocative person in general. But the fact remains that she was telling Signal about a real problem for a long time, and they were conspicuously ignoring it when it came from her but finally acted on the problem when she got a few white men to repeat the complaint for her. I get that she rubs some people up the wrong way, but if you’re a person from the west being told by a Chinese person that there’s something particular to their demographic that is wrecking your security, you should pay attention, not do everything you can to avoid them. I don’t trust software to be secure if they disregard security issues because they don’t like who is reporting them, and nobody else should either. Here are some links: https://www.technologyreview.com/2023/08/21/1078207/sogou-keyboard-app-security-loophole/ https://www.technologyreview.com/2023/08/21/1078207/sogou-ke... https://twitter.com/RealSexyCyborg/status/1197695344575799296 https://twitter.com/RealSexyCyborg/status/119769534457579929... https://twitter.com/RealSexyCyborg/status/1351006604565557249 https://twitter.com/RealSexyCyborg/status/135100660456555724... https://community.signalusers.org/t/signal-should-warn-users-who-are-likely-using-insecure-ime-apps/10272/127 https://community.signalusers.org/t/signal-should-warn-users... https://twitter.com/moxie/status/1351205613645258756 https://twitter.com/moxie/status/1351205613645258756

vinay_ys 3y ago
Ah the custom keyboard leak vector. I remember this controversy now.
GoblinSlayer 3y ago
It doesn't sound like a Signal's problem. When the user compromises the system, the whole system is compromised, not just Signal, and there are many ways to do it, not only keyboard, any spyware would do. IME is a system component, so it's the system vendor's problem that they neither provide nor recommend an IME.
- JimDabell 3y ago
  > It doesn't sound like a Signal's problem It is. This was discussed at length in the Signal users community link I provided. I’m not going to repeat everything that was said over there. Do you have anything new to add that wasn’t covered there?
  - GoblinSlayer 3y ago
    Mere existence of discussion doesn't mean much, you can't talk facts away.