Conversation

Notices

1. Embed this notice
   Soatok Dreamseeker (soatok@furry.engineer)'s status on Thursday, 16-May-2024 20:47:40 JST Soatok Dreamseeker

   One of the Matrix developers saw fit to comment on my gist https://gist.github.com/soatok/8aef6f67fec9c702f510ee24d19ef92b?permalink_comment_id=5058644#gistcomment-5058644

   In response, I actually looked at their code, identified two security vulnerabilities, and disclosed them to their security@ email.

   This reaffirms the opinion I held previously.

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Friday, 17-May-2024 04:35:16 JST Soatok Dreamseeker

     in reply to

     I suspect there are even more, but that's as much of my time and energy as I want to put into looking at their code.

   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Friday, 17-May-2024 04:35:16 JST Soatok Dreamseeker

     in reply to

     Found and disclosed a 3rd vuln on my lunch break because I wondered, "what if I just got lucky and hit the places that were actually vuln?"

     lol

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Friday, 17-May-2024 04:36:13 JST Haelwenn /элвэн/ :triskell:

     in reply to
     @soatok Really makes me wonder about their audit…
   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Friday, 17-May-2024 04:40:08 JST Soatok Dreamseeker

     in reply to

     • Haelwenn /элвэн/ :triskell:

     @lanodan I haven't looked at the audit report yet. They might have only reviewed the Rust code, which I haven't looked at yet

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Inex Code (inex@pony.social)'s status on Friday, 17-May-2024 09:25:12 JST Inex Code

     in reply to

     @soatok I find it especially hilarious taking into account that several years ago I found an issue in their IV bits generation something during file encryption, while I didn't know a thing about encryption stuff. My photos sent from one client just couldn't be decrypted on the other one and I started debugging.

     Turned out to be an issue in the protocol specification, and developers of different clients interpreted it differently. 3rd party clients did it right, Element did it wrong. So all the files sent with Element back then had a faulty initialization vector.

     Can't find that issue with all the details now though, looks like it is lost during repo migrations or something like that.

     NeonPurpleStar :heart_bi: likes this.