Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/adulau/statuses/110989243094591045">Alexandre Dulaunoy (adulau@infosec.exchange)'s status on Friday, 27-Oct-2023 18:17:10 JST</a><a href="https://infosec.exchange/@adulau" title="adulau@infosec.exchange"><img src="https://gnusocial.jp/avatar/204538-48-20231027091710.webp" width="48" height="48" alt="Alexandre Dulaunoy" style="position: absolute; left: 0; top: 0;">Alexandre Dulaunoy</a><div><ul><li><li><a href="https://gnusocial.jp/user/204539" title="jvoisin@infosec.exchange">jvoisin</a></li></ul></div></section><article><p>Digging a little bit in the some ICC profiles added in signal-app, I updated the original issue and there is clearly an issue where new ICC profiles are created from the Google skia library. </p><p><a href="https://github.com/signalapp/Signal-Desktop/issues/6031#issuecomment-1702432836" rel="nofollow noreferrer">https://github.com/signalapp/Signal-Desktop/issues/6031#issuecomment-1702432836</a></p><p>This issue only appears when the media-quality is to high. Maybe an allow-list strategy like the mat2 tool written by <a href="https://infosec.exchange/@jvoisin">@jvoisin</a> would be better to be sure that new metadata created are discarded by default.</p><p><a href="https://mastodon.world/@signalapp" rel="nofollow noreferrer">@signalapp</a> </p><p><a href="https://infosec.exchange/tags/privacy" rel="tag">#privacy</a> <a href="https://infosec.exchange/tags/signal" rel="tag">#signal</a> <a href="https://infosec.exchange/tags/signalapp" rel="tag">#signalapp</a> <a href="https://infosec.exchange/tags/metadata" rel="tag">#metadata</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/2240382#notice-4411699">In conversation</a><time datetime="2023-10-27T18:17:10+09:00" title="Friday, 27-Oct-2023 18:17:10 JST">Friday, 27-Oct-2023 18:17:10 JST</time> <span>from <span><a href="https://infosec.exchange/@adulau/110989243094591045" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@adulau/110989243094591045">permalink</a><h4>Attachments</h4><ol><li><label><a rel="external" href="https://gnusocial.jp/attachment/1721051">Dependencies among SignalApp and where the ICC profiles are created from which includes the Google copyright.</a></label><br><a href="https://media.infosec.exchange/infosec.exchange/media_attachments/files/110/989/239/354/120/776/original/784eef0aacd6c835.png" rel="external">https://media.infosec.exchange/infosec.exchange/media_attachments/files/110/989/239/354/120/776/original/784eef0aacd6c835.png</a></li><li><article><header><div>Domain not in remote thumbnail source whitelist: opengraph.githubassets.com</div><h5><a href="https://github.com/signalapp/Signal-Desktop/issues/6031#issuecomment-1702432836This">Signal Desktop inserts invalid information (including copyright information) into photo exif data · Issue #6031 · signalapp/Signal-Desktop</a></h5><div></div></header><div>I took a picture of an object, when sending a photo to Signal (in a private message) and uploading it to a PC through Signal Desktop, I get an excessive amount of metadata (exif), and the worst tag...</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Alexandre Dulaunoy (adulau@infosec.exchange)'s status on Friday, 27-Oct-2023 18:17:10 JSTAlexandre Dulaunoy
- Signal
- jvoisin
Digging a little bit in the some ICC profiles added in signal-app, I updated the original issue and there is clearly an issue where new ICC profiles are created from the Google skia library.
https://github.com/signalapp/Signal-Desktop/issues/6031#issuecomment-1702432836
This issue only appears when the media-quality is to high. Maybe an allow-list strategy like the mat2 tool written by @jvoisin would be better to be sure that new metadata created are discarded by default.
@signalapp
#privacy #signal #signalapp #metadata
In conversationFriday, 27-Oct-2023 18:17:10 JST from infosec.exchangepermalink
Attachments
1. Dependencies among SignalApp and where the ICC profiles are created from which includes the Google copyright.
  https://media.infosec.exchange/infosec.exchange/media_attachments/files/110/989/239/354/120/776/original/784eef0aacd6c835.png
2. Domain not in remote thumbnail source whitelist: opengraph.githubassets.com
  Signal Desktop inserts invalid information (including copyright information) into photo exif data · Issue #6031 · signalapp/Signal-Desktop
  I took a picture of an object, when sending a photo to Signal (in a private message) and uploading it to a PC through Signal Desktop, I get an excessive amount of metadata (exif), and the worst tag...

Public

Embed Notice

HTML Code

Corresponding Notice