3 ms·

Signal has "message requests". iMessage doesn't have "message requests", and receives messages in a unique path which goes through the kernel. Signal's message

Signal has "message requests". iMessage doesn't have "message requests", and receives messages in a unique path which goes through the kernel. Signal's message request, notably, also shows me the requester's avatar image. I don't know if that hits the kernel but it certainly hits code that as a category has suffered lots of security issues over the years. Which is to say: There's room for improvement all over!

genewitch 2y ago
That avatar thing is exploitable on discord, at least. Don't recall the specifics, just keywords.
- immibis 2y ago
  You might be thinking of the minor Cloudflare exploit where the attacker can send you a message, then see on which Cloudflare PoP their profile image got cached.