Signal-android: Check if updating user is in group

Created on 28 Jul 2017 · 2Comments · Source: signalapp/Signal-Android

I have:

[x] searched open and closed issues for duplicates
[x] read https://github.com/WhisperSystems/Signal-Android/wiki/Submitting-useful-bug-reports

Bug description

Groups can be compromised if group id and one member is known, as documented here (page 8 and following)

Steps to reproduce

See link from Bug description

Possible fix

This should be fixed by checking whether a user is part of a group before updating it.

Source

pajowu

Most helpful comment

Page 18:

Open WhisperSystems is currently developing a new group management system with advanced administrative features so that they decided not apply our fix.

FeuRenard on 28 Jul 2017

🎉3 👍1

All 2 comments

Page 18:

Open WhisperSystems is currently developing a new group management system with advanced administrative features so that they decided not apply our fix.

FeuRenard on 28 Jul 2017

🎉3 👍1

GitHub Issue Cleanup:
See #7598 for more information.