{"action":"created","issue":{"url":"https://api.github.com/repos/wireapp/wire-android/issues/1077","repository_url":"https://api.github.com/repos/wireapp/wire-android","labels_url":"https://api.github.com/repos/wireapp/wire-android/issues/1077/labels{/name}","comments_url":"https://api.github.com/repos/wireapp/wire-android/issues/1077/comments","events_url":"https://api.github.com/repos/wireapp/wire-android/issues/1077/events","html_url":"https://github.com/wireapp/wire-android/issues/1077","id":249916964,"number":1077,"title":"Disappearing Messages retaining word length information is a security leak","user":{"login":"phoenixeliot","id":491376,"avatar_url":"https://avatars1.githubusercontent.com/u/491376?v=4","gravatar_id":"","url":"https://api.github.com/users/phoenixeliot","html_url":"https://github.com/phoenixeliot","followers_url":"https://api.github.com/users/phoenixeliot/followers","following_url":"https://api.github.com/users/phoenixeliot/following{/other_user}","gists_url":"https://api.github.com/users/phoenixeliot/gists{/gist_id}","starred_url":"https://api.github.com/users/phoenixeliot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phoenixeliot/subscriptions","organizations_url":"https://api.github.com/users/phoenixeliot/orgs","repos_url":"https://api.github.com/users/phoenixeliot/repos","events_url":"https://api.github.com/users/phoenixeliot/events{/privacy}","received_events_url":"https://api.github.com/users/phoenixeliot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-08-14T02:12:42Z","updated_at":"2017-08-14T17:38:02Z","closed_at":null,"body":"## The problem\r\n\r\nDisappearing messages used to completely disappear after the timer expired.\r\nNow the disappearing messages leave behind blue squiggles after the message expires — with the squiggles matching the length of the words in the original message, with spaces in between.\r\n\r\nBy retaining information about the number of messages sent, their length, and the length of each word, a lot of information is retained.\r\n\r\nWhen I write a disappearing message, I do so because I do not want any record of the message to exist, not even on my phone. I do not even want proof that any messages were sent, nevermind any information about their contents. I don't want this information on my phone in case my phone is stolen and accessed.\r\n\r\nThere should at the very least be an option to turn this behavior off.\r\n\r\nNote: This information doesn't seem to stay on the receiver's end, but I object even to the fact that it's stored anywhere at all after expiring.\r\n\r\nFor me, this strongly reduces my trust in the ongoing security of the app if this kind of security compromise is made for the sake of a \"cool feature\". It especially does not help that this change occurred without me being told about it — I was caught by surprise by this behavior.\r\n\r\n## Environment\r\n\r\n* Wire version that exhibits the issue: 2.38.352\r\n* Last Wire version that did not exhibit the issue (if applicable): Not sure.\r\n* Android OS version used to run Wire: 7.1.2\r\n* Is this a custom firmware or a stock one: Stock \r\n* Mobile phone model/manufacturer: Google Pixel\r\n* Mobile network type (EDGE/LTE/Wi-Fi/Offline): Any\r\n\r\n## Details\r\n\r\n- Send an expiring message (I tried 5 minutes or less)\r\n- note the length of the words in the message (for example, send \"a aa aaa aaaa aaaaa aaaaaa\")\r\n- when the message expires, see that the squiggles match up with the original text perfectly.\r\n\r\n## Screenshots\r\n\r\nI don't think Wire allows screenshots to be taken."},"comment":{"url":"https://api.github.com/repos/wireapp/wire-android/issues/comments/322256590","html_url":"https://github.com/wireapp/wire-android/issues/1077#issuecomment-322256590","issue_url":"https://api.github.com/repos/wireapp/wire-android/issues/1077","id":322256590,"user":{"login":"someoneEsle","id":21009625,"avatar_url":"https://avatars1.githubusercontent.com/u/21009625?v=4","gravatar_id":"","url":"https://api.github.com/users/someoneEsle","html_url":"https://github.com/someoneEsle","followers_url":"https://api.github.com/users/someoneEsle/followers","following_url":"https://api.github.com/users/someoneEsle/following{/other_user}","gists_url":"https://api.github.com/users/someoneEsle/gists{/gist_id}","starred_url":"https://api.github.com/users/someoneEsle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/someoneEsle/subscriptions","organizations_url":"https://api.github.com/users/someoneEsle/orgs","repos_url":"https://api.github.com/users/someoneEsle/repos","events_url":"https://api.github.com/users/someoneEsle/events{/privacy}","received_events_url":"https://api.github.com/users/someoneEsle/received_events","type":"User","site_admin":false},"created_at":"2017-08-14T17:38:02Z","updated_at":"2017-08-14T17:38:02Z","body":"Hmm, sounds like you ran into a bug then. Sorry about that. What\ndevice/OS/wire version is your friend on?\n(I will probably follow up tomorrow when I go back to the office)\n\nOn Aug 14, 2017 19:28, \"Phoenix Eliot\" <notifications@github.com> wrote:\n\n> Hm. That doesn't seem to match the behavior I see. All of the messages I\n> sent a couple days ago with very short timers still have squiggles\n> remaining in my chat log. The person I sent them to confirms that the\n> message has disappeared from their history.\n>\n> Deleting the messages is an okay workaround, except for this issue which\n> makes it easy to delete the wrong one (which happened to me while trying to\n> delete the squiggles): #1078\n> <https://github.com/wireapp/wire-android/issues/1078>\n>\n> —\n> You are receiving this because you commented.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/wireapp/wire-android/issues/1077#issuecomment-322254184>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AUCU2czd8Gg4g8_oSybyBQa81LKctQ9Qks5sYIPRgaJpZM4O14En>\n> .\n>\n"}}
{"actor":{"display_login":"someoneEsle"}}