Hacker News new | ask | show | jobs
by 0xy 67 days ago
It would've taken you less time to Google, but sure: https://www.bleepingcomputer.com/news/security/signal-fixes-...

Send a GIF to Contact A, Contact B receives random private images? Absolutely inexcusable slop code project. This class of state management bugs should not be possible with a well-architected client, period.

Signal's E2E encryption is more like End 2 Random End.
1 comments
alance 66 days ago
Or why not include the source of your claim up front?

From GitHub comments: https://github.com/signalapp/Signal-Android/issues/10247

Greyson:

> Hi there, sorry, this issue was fixed in 5.17 (which hit 100% production on 7/21)

They had a difficult to reproduce problem reported in late December 2020, and got the fix rolled out seven months later.

Not sure your criticism "absolutely inexcusable slop code" is well considered.

link
0xy 66 days ago
So 7 months of their users getting rinsed by an extremely serious issue exposing your private photos to random contacts. Seems like slop code to me. Those kinds of state management bugs should not be possible. It indicates code divorced from best practice state management.

Knowing that bug COULD exist, means that you cannot be sure that messages you send in Signal will make it to the recipient you intend given the poor quality. This means the E2E encryption is fundamentally broken, by the way. Because the client is lying to you about the true state of who it's about to send to.

The recipient text has fundamentally zero relationship to the true recipient of the message given that bug.

Having the UI and message sending code reference two different versions of state is incredible incompetence.

link