3 ms·
This honestly doesn't surprise me all that much. More than 10 years ago I had to dive into Chrome's WebRTC stack for interop and reverse-engineering purposes (
by kelnos 2y ago
This honestly doesn't surprise me all that much. More than 10 years ago I had to dive into Chrome's WebRTC stack for interop and reverse-engineering purposes (at the time, the WebRTC specs were changing all the time, and were poorly documented). The code was massive; it turns out it's a fairly complicated protocol, and dealing with audio and video and handling sessions (even without including a signaling protocol) requires a lot of code (not to mention the use of the then-obscure DTLS security protocol on top of UDP). And that was 12 years ago; I'm sure WebRTC's surface area has only increased since then.
I assume Signal uses a different implementation, but I'm sadly not surprised there are security issues lurking inside it.
This bit at the beginning made me chuckle, though:
> It’s another average Friday morning and my iPhone shows 705 unread Signal messages
I feel like I'm doing communications wrong... if I wake up and find 20 unread messages across all my chat apps, that's on the high side for me.
- upon_drumhead 2y agoMy personal phone is lucky to get more than 5 a day. My work phone gets hundreds a day, due to automation and slack ops. Regardless, I think a handful of high quality meaningful messages is well worth hundreds of low value ones.
- cwillu 2y agoTo be clear, they are not demonstrating issues in the code, they are providing a walkthrough of how one _could_ exploit an issue if one existed and the mitigations weren't in place, as an concrete introduction to how this is done against a mobile app. e.g. “Given a vulnerability, this is what crafting an exploit looks like”