- It’s extremely common for Chinese people to use third-party keyboards.

- If they do this, all security Signal provides is undermined.

- Signal tells people it’s a secure way of communicating. People in China believe this and use Signal without realising they aren’t secure.

- It’s fair to expect Signal – an organisation founded and run by Americans – to not be aware that Chinese people use their phones in a very different way to westerners.

- A Chinese woman has been telling them about this problem for years and asking for a warning to be put into Signal so that Chinese users are aware they can’t use Signal securely in this way.

- Signal conspicuously ignored her for a very long time. Things like Moxie blocking her on Twitter, misrepresenting the request as a “boiling the ocean” type request, saying she was just attention-seeking, saying that people should decompile keyboards to prove they are transmitting keystrokes, etc. Have you ever heard a security professional say that they need evidence that something is being actively exploited before they will do anything about it?

- Finally after a year of this, he replied to a man on Twitter saying “Totally, if this is the thing people want, that's np.” – as if this hasn’t been brought up over and over again by her to the point of him blocking her because she was annoying him too much.

- At this point people point out that this is what she has been asking for for years. So he apologises. To the men he’s talking to, not her.

- And just recently, it turns out insecure keyboard leaking is something that has been affecting hundreds of millions of Chinese users. So it was absolutely a real problem that Chinese Signal users needed to be aware of, and it was a major security fuckup that Signal delayed warning people for over a year.

Unsurprisingly, she’s less than polite when talking about Signal. And she’s a provocative person in general. But the fact remains that she was telling Signal about a real problem for a long time, and they were conspicuously ignoring it when it came from her but finally acted on the problem when she got a few white men to repeat the complaint for her. I get that she rubs some people up the wrong way, but if you’re a person from the west being told by a Chinese person that there’s something particular to their demographic that is wrecking your security, you should pay attention, not do everything you can to avoid them.

I don’t trust software to be secure if they disregard security issues because they don’t like who is reporting them, and nobody else should either.

Here are some links:

https://www.technologyreview.com/2023/08/21/1078207/sogou-ke...

https://twitter.com/RealSexyCyborg/status/119769534457579929...

https://twitter.com/RealSexyCyborg/status/135100660456555724...

https://community.signalusers.org/t/signal-should-warn-users...

https://twitter.com/moxie/status/1351205613645258756