[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190912222921.ozyhvh4t6gqzczrn@wrycode>
Date: Thu, 12 Sep 2019 18:29:22 -0400
From: notspam@...st
To: oss-security@...ts.openwall.com
Subject: Re: Telegram privacy fails again.
>IMO, If Whatsapp/Telegram wanted to take this functionality more seriously,
>they'd need to be writing the images to disk in an encrypted form from the
>outset. It increases the overhead of display, and wouldn't necessarily stop
>forensic recovery etc, but it would mean that other apps couldn't simply
>watch the directory and upload anything which appears in it in a usable
>form. That's a whole other can of worms though as it's another set of keys
>to manage.
There's no way to take this functionality seriously - the feature is a
joke. A privacy feature centered around trusting another user's
node to delete a file you already sent them is silly. Unfortunately,
it seems like nobody gets this; even Matrix clients are supposed to
have message redaction soon.
The original email didn't contain a security vulnerability (remember
the name of this list?) - it was blogspam. It didn't belong here for
the same reason that you don't see Snapchat bugs on this list.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
