Hacker News Reader

Comment by Zenst | Hacker News Reader

Ah yes, I'd forgotten about that - https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-...

To be fair, the vulnerability was fixed quickly. And in the end it improved the security of Matrix and the governement application. I prefer this to a closed-source application developed internally, without communication on security vulnerabilities.

Yes, does cover that in the link and from my perspective - ruddy good response time upon that and well handled.

I can think of many comparable situations in other countries (some EU ones as well) in which the person finding the issue would of very easily been locked up.

To be clear, the vulnerability was with the specific server configuration for the French Matrix deployment (authing people based on email domain), and not a flaw in Matrix itself. We're not aware of anyone else running in that config. https://matrix.org/blog/2019/04/18/security-update-sydent-1-... had the details.

The actual bug was thanks to a long-standing bug in python's standard email.utils library, which finally got fixed: https://bugs.python.org/issue34155, combined with insufficiently-defensive coding and testing on my side. (I wrote the auth code in question).

This is a good story, but the title seems needlessly clickbait. The flaw was fixed rather quickly, the process for communicating the issue did not seem to be a hassle.

It does not really say that the app is "super not secure". Just that people make mistakes, and it's not even shameful the way they reacted to it.

Interesting read. Nice trick with bypassing email domain restriction.

Reply on news.ycombinator.com