News for hackers. Stuff that matters.

A comment on Leaked phone number of Mark Zuckerberg reveals he is on Signal. Parent comment

Re:Leaked phone number of Mark Zuckerberg reveals he is on S... by yorwba on Tuesday April 06, 2021 @03:49AM (#26709202)
And what was the suggestion? The flow of information is (You typing → IME converts key presses into text → Signal receives text) so Signal can't do anything to prevent a malicious IME from sending the text elsewhere. The best they could do is raise users' awareness that Signal won't protect them if there's spyware with privileged access on their device, and that their IME might be such spyware.
[ Parent | on HN ]
Re:Leaked phone number of Mark Zuckerberg reveals he is on S... by astrange on Tuesday April 06, 2021 @04:00AM (#26709276)
Mainly the OS has security options to prevent IME network connections that aren't always on by default, but users can enable them. (They might be off because it disables some features that need internet access.)

IIRC there was also some Android API that could be used in the app to help, but I don't remember what it actually did atm.

[ Parent | on HN ]
Re:Leaked phone number of Mark Zuckerberg reveals he is on S... by alias_neo on Tuesday April 06, 2021 @05:51AM (#26709984)
Perhaps your man the incognito keyboard option? Signal uses it, but no API I can imagine will protect against a malicious IME.

Worse still, even if you block IME internet access on a device with a factory-maliciois IME, they could just upload the data using some other service on the device.

Installing a known-good IME seems like the only fix I can think of?

[ Parent | on HN ]