Hacker News Reader

Comment by JimDabell | Hacker News Reader

Signal totally lost my confidence with the Chinese IME debacle. They were told repeatedly for a year that Chinese Signal users were vulnerable and needed a warning in the app. They intentionally ignored the problem because the wrong type of person was reporting it. Then once enough white men repeated the complaint, they put the warning in. Prejudice is a security vulnerability if it makes you ignore vulnerability reports. Signal have demonstrated that they have this security vulnerability and as far as I can see they haven’t taken any steps to close it.

View on HN

I can't tell if you're genuinely ignorant or purposefully misrepresenting nearly everything about the issue.

It's not a "security vulnerability" in Signal that the user can install a third party keyboard app that spies on them, even after the OS warns them against that risk, nor is it Signal's fault that keyboard apps are not required to respect the private-mode call/flag an app can use.

The only solution to close this hole would be for Signal to implement its own virtual keyboard, which would be a massive undertaking.

> They were told repeatedly for a year that Chinese Signal users were vulnerable and needed a warning in the app. They intentionally ignored the problem because the wrong type of person was reporting it.

Stop racebaiting - race had nothing to do with it.

Naomi Wu threw a profanity-laden, insult-filled temper tantrum because she was apparently the last person on the planet to get the "third party keyboards are insecure" memo, accused Signal of misleading marketing because she wildly misinterpreted it saying it guarantees users privacy, and was outraged the Signal app does not warn people using a non-stock keyboard that their privacy might be violated. She demanded they add a warning.

Signal said "not our responsibility to warn users about stuff they've installed" which is a reasonable take, especially since Android OS warns about security risks upon installation of a third party keyboard. Signal is not a vulnerability-scanning tool, it's a messaging app.

Moxinspike said he felt Naomi was making a huge scene about it to stir up shit on social media for attention, and I think he's right. Scroll through her twitter feed and you'll see she's like a Singapore version of Briana Wu; just one outrage-bait post after another...and lashing out at other developers, like the first page of her twitter feed; here's her abusively lashing out at the entire Mastodon dev community in a cryptic-passive-aggressive way:

https://twitter.com/RealSexyCyborg/status/158953417392850124...

The tweet making fun of the "struggles of e-thots" was particularly rich, too.

> I can't tell if you're genuinely ignorant or purposefully misrepresenting nearly everything about the issue.

Do you want to try this reply again?

Interesting. Totally missed this news. Could you edit/post some links to this coverage?

A summary, because it’s a bit spread out over a few places:

- It’s extremely common for Chinese people to use third-party keyboards.

- If they do this, all security Signal provides is undermined.

- Signal tells people it’s a secure way of communicating. People in China believe this and use Signal without realising they aren’t secure.

- It’s fair to expect Signal – an organisation founded and run by Americans – to not be aware that Chinese people use their phones in a very different way to westerners.

- A Chinese woman has been telling them about this problem for years and asking for a warning to be put into Signal so that Chinese users are aware they can’t use Signal securely in this way.

- Signal conspicuously ignored her for a very long time. Things like Moxie blocking her on Twitter, misrepresenting the request as a “boiling the ocean” type request, saying she was just attention-seeking, saying that people should decompile keyboards to prove they are transmitting keystrokes, etc. Have you ever heard a security professional say that they need evidence that something is being actively exploited before they will do anything about it?

- Finally after a year of this, he replied to a man on Twitter saying “Totally, if this is the thing people want, that's np.” – as if this hasn’t been brought up over and over again by her to the point of him blocking her because she was annoying him too much.

- At this point people point out that this is what she has been asking for for years. So he apologises. To the men he’s talking to, not her.

- And just recently, it turns out insecure keyboard leaking is something that has been affecting hundreds of millions of Chinese users. So it was absolutely a real problem that Chinese Signal users needed to be aware of, and it was a major security fuckup that Signal delayed warning people for over a year.

Unsurprisingly, she’s less than polite when talking about Signal. And she’s a provocative person in general. But the fact remains that she was telling Signal about a real problem for a long time, and they were conspicuously ignoring it when it came from her but finally acted on the problem when she got a few white men to repeat the complaint for her. I get that she rubs some people up the wrong way, but if you’re a person from the west being told by a Chinese person that there’s something particular to their demographic that is wrecking your security, you should pay attention, not do everything you can to avoid them.

I don’t trust software to be secure if they disregard security issues because they don’t like who is reporting them, and nobody else should either.

Here are some links:

https://www.technologyreview.com/2023/08/21/1078207/sogou-ke...

https://twitter.com/RealSexyCyborg/status/119769534457579929...

https://twitter.com/RealSexyCyborg/status/135100660456555724...

https://community.signalusers.org/t/signal-should-warn-users...

https://twitter.com/moxie/status/1351205613645258756

Ah the custom keyboard leak vector. I remember this controversy now.

It doesn't sound like a Signal's problem. When the user compromises the system, the whole system is compromised, not just Signal, and there are many ways to do it, not only keyboard, any spyware would do. IME is a system component, so it's the system vendor's problem that they neither provide nor recommend an IME.

> It doesn't sound like a Signal's problem

It is. This was discussed at length in the Signal users community link I provided. I’m not going to repeat everything that was said over there. Do you have anything new to add that wasn’t covered there?

Mere existence of discussion doesn't mean much, you can't talk facts away.

Reply on news.ycombinator.com