Wire-desktop: CVE-2017-6901 Critical security controls bypass

[dkorzhevin]

Hello,

I propose to start discussion about latest desktop (Windows) Wire client, which is bypassing Windows 10 lock screen.

So, basically, even after screen is locked, anyone can see info about message Sender an part of Message in pop up window, right after message received by desktop client.

I think, maby this problem related to default settings or some kind of uncommon usage of GDI libraries, because any other program doesn't bypassing lock screen (Skype, Viber, Telegram, Signal, Wickr, etc...).

Dmitry Korzhevin

[dkorzhevin]

Just small sample.

Windows 10 x86_64 LTSB Version 1607 (OS Build 14393.969)

[gregor]

This is standard Windows 10 behavior. Notifications are managed on the system level. You can change that option in the Windows 10 Settings app. Go to Settings -> System -> Notifications & a
ctions. You will find an option to select whether notifications should be shown on the lockscreen or not.

You can always set notifications to not leak their content via the preferences within Wire or disable them from there.

[dkorzhevin]

I know, but this settings related only to Wire. All other apps doesn't have such "free conduct". Wire represents itself as top-notch secure application messenger, out from the box.

And, all users who have Windows 10 must take additional steps to be sure their conversations will not leaked.

I think, in this case, this is problem, related to Wire app client (or Electron) directly. In other case - you should activate big pop-up window with security checklist or instructions, notifying all users with Windows 10, that they should System settings.

Dmitry

[dkorzhevin]

Or, you can for example add additional check of underlying system version, and if this is Windows 10, you can change Wire settings to more "private", hiding sender and message contents.

Just as example.

[gregor]

Skype's notifications on the classic Windows app are indeed not shown. Skype built their own notification system long before Windows supported the notion of notifications on the system level. Since they are not hooked into the standard Windows 10 notification system, they bypass the notification Settings. Electron's notification support is hooked into the Windows notifications system. Other apps based on Electron behave excatly the same.

I agree that we can improve our user experience and advise customers how to be even more conscious about their privacy. As stated in all our privacy/security documentations our focus is to keep you safe online in communicating from device to device. Ensuring the device is not compromised is your own responsibility. Especially if you are a privacy and security conscious user we rely on your own ability to maintain a secure system. This does not deviate from mobile platforms. You need to change an Android system level setting in order for notifications to hide content on the lockscreen. An option that Windows 10 does not even provide unfortunately, which is why we added it to our in app preferences in the first place.

[gregor]

The behavior also matches that for all types of notifications on both macOS and iOS. You have to go to Preferences -> Notifications and for each app individually set the option to hide notifications from the lockscreen. As most apps and browsers are hooked into the macOS notification system the ones you listed above show notifications on the lockscreen as well.

[gregor]

@dkorzhevin I will go ahead this issue as it is a OS level functionality that is missing. We have noted down the idea to enhance the way we educate users on how to manage their systems - with no immediate plans to implement any changes.