- cross-posted to:
- signal@lemmy.ml
- cross-posted to:
- signal@lemmy.ml
When I press on some message to forward it, it shows me Random usernames of contacts I don’t know. And it even shows some Mobile Numbers I don’t know. For example, one number starts with +964 that’s Iraq. I’m from Europe tho. These contacts and numbers are from all over the place.
Edit: This only happens on Signal Desktop. If I try to forward a message on Android it only shows my Contacts. And none of these unkown ones.
You must log in or register to comment.
Wtf is happening in these comments
No clue.
Use molly
Its not a problem with the Android App.
Huge if true! You could conceivably submit your phone to a Cybersecurity company and share in any reward.
Help us with:
- Your OS Version
- OS settings that are possibly related
- How you obtained Signal
- Signal version
- Video proof
- Steps to reproduce
Who knows how to compute a hash for an installed mobile phone app? We need to compare it with legit.
The video proof. It also shows the OS and Steps to reproduce. How I obtained Signal: Flathub Signal Version: 6.38.0 OS Settings: Nothing relevant.
I advise you stop using Signal Desktop immediately, they keep the database key in plaintext. Exposed over 5 years ago and still not fixed. Frankly I find this pretty pathetic. Making this safer could be as simple as encrypting such files with something like age and perhaps regenerate the keys on a frequent basis (yes I know full disk encryption is somehow a viable solution against unwanted physical access. But instead, they’d rather focus on security by network effect by adding shiny UX features instead of fixing infrastructural stuff, like improving trust by decentralization, not requiring phone numbers to join, or adding support for app pasphrase (which is available in case of Molly, along with regular wiping of RAM data which makes things like cold boot or memory corruption attacks harder)
There is nothing more that I hate then typing on my Phone. I can’t life without Signal Desktop.
For all of our safety, consider submitting a bugreport.
Thanks for the Link. I submitted a report.
link to report so we can track? thanks!
I don’t think it’s the same user, but here’s a report on GitHub with same repro
This is a totally different thing, and I also don’t get what the problem of this user is. He wants to share a picture and then just like on android the list of your recent chats opens where of course the pofilepic shows to know where you want to send it to, and he somehow doesn’t want the profile pic to be there even tho this is totally normal behavior from android and iOS since… always? Or do I misunderstand his problem because I don’t use iOS? Well the most important part, it doesn’t sound like my problem at all.
I just followed his link and submitted my report. Don’t have any link.
Why did someone see that I joined Signal? People who already know your number and already have you in their contacts see that they can contact you on Signal. Nothing is sent to them by your Signal app or the Signal service. They just see a number they know is registered. If someone knows how to send you an insecure SMS, we want them to see that they can send you a Signal message instead.
Why did I see that my contact joined Signal? You are notified when someone that is stored in your contact list is a new Signal user. If you can send an insecure SMS to a contact, we want you to know you can send a Signal message instead.
I hate this.
So Signal does not protect against those that fill their contacts with every existing number?
But also, this does not explain why is it only happening in the desktop app for OP
Protect against what? People knowing you have Signal? Excuse me if it’s obvious to everyone else, but I’m struggling to understand the issue here.
It confirms that your number is valid and in use.
Has anyone else been able to reproduce this? I just tried and was not able to.
OP, is it possible these people were in group chats you were part of?
No, they are not. I’m in two groups. None of them are in the groups. I only use Signal for Real life friends from my Country. I never joined any random group. These people are from all over the world.
Interesting. Are there any other accounts on your phone that provide contacts? Maybe social media or other chat platforms? On Android you can see accounts in Settings > Passwords & Accounts (or somewhere similar; it varies a little between brands). You can also check inside your Contacts app by expanding the sidebar (again, varies by brand).
Just a thought. I don’t have any other contact providers on my phone so I can’t test it myself.
Please keep us posted if you get any official response or learn anything new!
Nope. And I maybe had to add (did it now) that this only appears to be a problem with Signal Desktop. My signal app on android doesn’t even show other contacts from strangers. I will update this if I get a response, of course.
I still don’t see any bug report anyone can follow up on… I cannot trust OP’s experience until that’s linked here.
The bug report forum from Signal doesn’t give you any link.
Group chats very likely. There are often sync issues from mobile, so these may just be old spam or group chat numbers.
I just counted. Signal leaked 56 random people to me.
