> webworxshop opened this issue on 4 Dec 2020

Triple yikes.

Though it looks like the issue was finally closed minutes ago:

> Hi there, sorry, this issue was fixed in 5.17 (which hit 100% production on 7/21). There was another issue tracking this and it looks like I forgot to close this one.

Still, that's a lot of time for such a bug to exist!

> I've also recently had a probably unrelated issue where my mic was still audible to the other party after I hung up the call.

That one there is a cataclysmic security land mine. Absolutely unacceptable.

That was the last straw after [0]. I don't think I can recommend Signal at this time.

To Downvoters: So these bugs are all fine then? They are not security issues then? Not only having images being sent to the wrong contacts but also having the microphone still on after ending the call and being audible to the other party? That's fine right?

If this happened on any other messaging app, I would expect a massive outcry and urgency to fix these critical issues.

[0] https://news.ycombinator.com/item?id=27951076

Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition.

Which type of privacy breach is more likely to have tangible and direct negative effects on an average user's life - a nation state storing their communications in a database, Facebook graphing their contacts and using them for friend recommendations, or their friends/family/boss/acquaintances being sent random private photos from their phone and audio of private conversations they have in their home, without them knowing?

One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands.

I agree these bugs that Signal has are serious. With hat said, your examples aren't that great for counters.

"a nation state storing their communications in a database" - The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison.

"Facebook graphing their contacts and using them for friend recommendations" - but, it's not just for friend recommendations and possibly more importantly, it's not just their users, is it? Not to mention it's ignoring the purposeful opinion-biasing they have openly taken part in to manufacture consent for any number of issues.

While these bugs are bad and should be prioritized for fix, they are seemingly random. Sure they can possibly be exploited (possible, haven't seen proof of concept for purposeful exploitation), but random bugging vs clear and present danger on current and historical precedents of governments and technocratic oligarchs? Me thinks your trust may be a bit misplaced or you're just being obtuse for sake of obtuseness.

>The power differential and historic missteps of governments makes this ludicrous to think of as "OK" in comparison.

wasn't that kind of the point?

>Yes. Signal's only selling point is privacy. Both of these bugs are huge privacy breaches that kill its value proposition.

Absolutely agree. However, you should always look at the bigger picture

a) How was the issue handled? What was the priority? Did they try to downplay it? Was the type of vulnerability patched altogether?

b) If a) merits for change, what's the alternative that has better overall security, UX, existing userbase, and track record.

Personally, I'd rather take a product with good public incident handling track record, than one without anything on public record.

>One of the main worries with companies having access to your unencrypted private data is that no matter how careful they are with it, it can still end up in the wrong hands. Signal is directly sending your data into the wrong hands.

Categorical label of "wrong hands" is unnecessarily ominous. Company with access to your private data can lead to that data being sold, or stolen by nation states / organized crime. You sending nudes / sensitive documents to your friend on Signal is less dangerous, although it can be much more embarrassing. Your peer probably isn't going to sell it to the highest bidder (or was it the case the recipient could be any Signal user? IIUC that was not the case)

Laurens Cerulus @laurenscerulus Feb 20, 2020

News: The EU Commission told its staff to start using @signalapp to chat to friends and contacts. The move is part of an effort to fix the holes in EU cybersecurity. Story (for Pros for now) https://twitter.com/bendrath/status/1230455295018766337

Why on Earth are people downvoting you? This is an absolute dealbreaker for any messaging app, much less one whose raison d'etre is privacy and secure messaging.

Probably because the common mindset here is that anyone can make a mistake, and that the person who did it learned their lesson and will never do it again.

And to verify, the "mistake" is seeming to not actually care that this was a serious bug for 7 months (cough while they launched MobileCoin)? That is an attitude issue--and one endemic to Signal (which, most charitably, simply doesn't have the resources to sufficiently care sometimes)--not a "mistake" I expect to be easily rectified.

(And as I mention on a nearby post: you don't have to fix it to widely disclose it; like, you don't work in the dark to fix an issue like this for seven months as, even if it were your "top priority": you quickly time box it and then disclose the issue so people can mitigate their exposure or help better crowdsource finding the information you need to fix the issue.)

It also sounded like a very difficult bug to track down, even as a top priority. Requiring a combination of certain settings plus a rare database ID intersection.

Combine that with not logging user behaviour heavily for privacies sake makes this a very tough one to replicate.

All of which was addressed in the bug report.

The realities of software development on a large scale with a privacy focus are sometimes hard to grasp. Although I do admit 7 months for a production release is quite a long time, even factoring in the pandemic and mobile app Play Store release cycles.

So, did they disclose the issue? Were people using Signal warned somewhere that this was a known issue that they were hunting down? (I am guessing not as no one here has been like "oh yeah: everyone using Signal knew to be careful with this feature".) It being a difficult bug to fix doesn't mean that's your only recourse for something this serious.

Does any app push bug report notifications to users? Should Microsoft Windows or Google Chrome warn users every time there’s a bug that can compromise their whole system just by visiting a certain website or downloading random pieces of software only a tiny subset of users will ever be exposed to?

I get the motivation with a security/privacy critical app like Signal but this would also be a UX and customer support nightmare that IRL could grind a project to a halt.

Not to mention expecting users to know how to balance the risks of said bugs vs not using the app at all because they were scared off it. Back to using far less secure options.

I think having public forums to report and track the bugs for more advanced users is probably the right balance.

The better solution is internal fixes and triaging the serious bugs appropriately so they get the attention they need. Instead of just offloading highly technical information barrages to average users.

Temporarily blocking features until a patch is released is something that could make sense. But again only in certain circumstances. You can turn off photo sharing here but other cases it’s not so straight forward without crippling the entire app for a rare bug. It’s a difficult balancing act without a uniform solution.

Usually when there are serious bugs in Windows, these get notified.

Latest example: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

Released Jul 1, 2021

Workarounds:

Option 1 - Disable the Print Spooler service

Option 2 - Disable inbound remote printing through Group Policy

Let’s be honest, if Telegram or WhatsApp did that mistake, all of that mindset would beat it to death and then jump on its corpse for three days straight.

And bring it up in every conversation even slightly tangential to either of them =)

So which app would you recommend?

Matrix.

This isn't a valid argument.

Yeah you see that question mark at the end of the sentence? It's a question.

Stopped doing calls on Signal after my Android contacts started telling me that they see active calls minutes after I successfully hung up from my side (iOS). Not to mention the countless UX bugs.

I’m back on WhatsApp and not telling anyone anymore to move to Signal or any app whatsoever. I’m done.

The first issue was fixed and just closed, and seems like it was very difficult to track down.

It's fixed in 5.17 and this is the release number I see on the Google playstore.

Unfortunately for my ubuntu 18.04 LTS and this is in no way Signal's fault (but maybe the desktop version doesn't have that bug ?):

    $ apt-cache policy signal-desktop
    signal-desktop:
      Installé : 5.10.0
      Candidat : 5.10.0
     Table de version :
     *** 5.10.0 500
            500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages
            100 /var/lib/dpkg/status
         5.9.0 500
            500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages
         5.8.0 500
            500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages

Would rolling into the beta help here? https://support.signal.org/hc/en-us/articles/360007318471-Si...

I don't think so:

    $ apt-cache policy signal-desktop-beta
    signal-desktop-beta:
      Installé : (aucun)
      Candidat : 5.11.0-beta.1
     Table de version :
         5.11.0-beta.1 500
            500 https://updates.signal.org/desktop/apt xenial/main amd64 Packages

It was closed 4 minutes ago; when was it fixed? ETA: Ah, 4 days ago (more than half a year after it was opened).