News for hackers. Stuff that matters.

A comment on Signal on Android: Images sent to wrong contacts.

Re:Signal on Android: Images sent to wrong contacts by hrjfjjfjfjd on Sunday July 25, 2021 @02:51PM (#27951820)
How can an unencrypted copy of some media end up at the wrong user? Isn't that supposed to be end-to-end encrypted, especially when stored on the signal servers?
[ Parent | on HN ]
Re:Signal on Android: Images sent to wrong contacts by jeroenhd on Sunday July 25, 2021 @03:19PM (#27952070)
The chat client misinterprets something and attaches a file to the message. The encryption works fine, the business logic of the app failed.

E2EE won't protect you from a client accidentally encrypting and submitting files in the wrong chats.

[ Parent | on HN ]
Re:Signal on Android: Images sent to wrong contacts by hrjfjjfjfjd on Sunday July 25, 2021 @03:28PM (#27952159)
But what exactly went wrong with signal here?

Could someone remotely instruct my signal client to share media? Previously sent or arbitrary files?

[ Parent | on HN ]
Re:Signal on Android: Images sent to wrong contacts by maqp on Sunday July 25, 2021 @05:30PM (#27953093)
They would have to compromise your client which is in no way different from compromising your device. The NSO / Pegasus systems do just that. They allow arbitrary command execution, which includes sending any file on your phone to any contact over Signal. Nothing software can do to protect from that. If you need 100% guarantee something doesn't leak over electronics, don't store it electronically. Ask them Slavs https://www.theguardian.com/world/2013/jul/11/russia-reverts...
[ Parent | on HN ]
Re:Signal on Android: Images sent to wrong contacts by jeroenhd on Sunday July 25, 2021 @05:10PM (#27952943)
The app accidentally attached seemingly random media to messages. The other end has no control over what images they receive when. There was no hack or remote control at play, just a bug.
[ Parent | on HN ]
Re:Signal on Android: Images sent to wrong contacts by drexlspivey on Sunday July 25, 2021 @03:27PM (#27952137)
It was a bug on the client that encrypted and sent the message to the wrong user. If it was a bug in the server that messed up the routing it would be impossible for the wrong recipient to see the message.
[ Parent | on HN ]