search

signalapp / Signal-iOS

A private messenger for iOS.
https://signal.org
GNU Affero General Public License v3.0
10.62k stars 2.96k forks source link

API v1 (iOS9 - Old iPhone 4S) - disconnected, no more able to register #5114

Closed fjg closed 2 years ago

fjg commented 2 years ago

Bug description

Since today, using Signal as usual for years, I was disconnected from the server and the app requested me to re-connect from zero my number. I received the SMS code, typed it but then the app said "Verification failure, cannot finalize operation - SignalServiceKit.NetworkManagerError 401". Seams like a permission denied.

Something should have changed on the server side right? As I am not able to upgrade the app for years now, but it was still working (no group, no new features, but it was ok). I know, you can recommand to change phone (too old...). Still I am not considering this option right now but I would like to continue to use Signal. Is that possible or is this a dead end?

It also disconnected the desktop app linked to my phone... no more able to use Signal anymore :/

Steps to reproduce

Actual result: Describe here what happens after you run the steps above (i.e. the buggy behaviour)

Error message: "Verification failure, cannot finalize operation - SignalServiceKit.NetworkManagerError 401"

Expected result: Describe here what should happen after you run the steps above (i.e. what would be the correct behaviour)

Able to register to the service and use the app as before

Screenshots

Device info

Device: iPhone 4S

iOS version: 9.3.6 (last version on this model)

Signal version: 2.43.3.1, last version compatible with iOS9 (old one ;)

Link to debug log

redm123 commented 2 years ago

Same here with iOS10, last version on iPhone 5. Seems the devices were killed server side. Was this on purpose? Or ignorance? Or just a bug? I can understand that Apple makes it increasingly difficult to maintain app versions on older iOS versions. But supporting older devices serverside seems doable... esp. if it's just authentication/registration! I mean, in the end we talk about sending some messages back and forth..

Please reconsider and make older devices work again!

PS: This also killed my uptodate iPadOS 14.x and Mac clients, that were bundled with the phone. This seems broken by design...!

And even worse, I suppose (haven't tried) I couldn't even transfer the message history to another device..

systwi-again commented 2 years ago

Same thing happened to me. iOS 10.3.4 on an iPhone 5. Signal was working fine one day, then the next it showed the first time setup wizard. I don't know if I lost my messages or not (really hoping I didn't).

When trying to go through the setup again my phone too shows the infamous Verification failure, cannot finalize operation - SignalServiceKit.NetworkManagerError 401 error. Really hoping this can be fixed, as I mainly used Signal to talk to my boss and coworkers.

Comemuffins commented 2 years ago

I'm experiencing the same issue as well.

iOS 10.3.4 on an iPhone 5, with Signal version 3.9.0.13 installed. Had issues sending messages on August 27 (Friday), then noticed that my phone number was no longer registered on September 2 (Thursday). Tried to re-register my phone number but kept running into the same "Verification failure, cannot finalize operation - SignalServiceKit.NetworkManagerError 401" message.

Based on reading the Signal subreddit and community forums, this issue affected other iOS users. Unfortunately, the only way to fix the issue is to install the newest Signal update, 5.19.1.0, which is only available to iOS 11 or later.

It does not seem like Signal is concerned with users who are unable to install this update, suggesting this change was made purposely.

The worst part is that your Signal messages and contact list remain inaccessible unless you can re-register your phone number, meaning that Signal has effectively blocked you from accessing your own data. That seems awfully boneheaded to me.

It would be nice if they fixed this issue for users running older versions of iOS, but I'm not holding much hope that they will do the right thing.

anomal commented 2 years ago

@Comemuffins I suspect that for iOS 10 and iOS 9, the 5.19.1.0 update is fixing a different problem. The 5.19.1.0 code change https://github.com/signalapp/Signal-iOS/commit/cca8c818010d39c302bbebce93f35b34b3c8872e is related to censorship circumvention, and that reported bug is from an Egypt number (which I assume requires censorship circumvention) where they got the error message "Invalid response from service" instead of "Verification failure, cannot finalize operation - SignalServiceKit.NetworkManagerError 401".

I am not using iOS 9/10 myself, but an important Signal contact is, so this seriously disrupts my Signal functionality as well. There are network effects to not supporting iOS 9/10; it doesn't just affect iOS 9/10 users, but their Signal contacts as well. WhatsApp still supports iOS 10, and Telegram supports iOS 9, so there are people with functional iPhones who can no longer use Signal, and would be unable to switch from Whatsapp to Signal.

Can anyone send them a debug log? https://support.signal.org/hc/en-us/articles/360007318591-Debug-Logs-and-Crash-Reports#ios_debug has instructions on "Steps to share a debug log from Signal's registration or PIN flow", but I am not sure if it works with the old Signal version.

redm123 commented 2 years ago

I tried it. Something happens, but it basically just says that uploading the log failed.

Comemuffins commented 2 years ago

Since this issue has not been resolved, here are two screenshots illustrating the problem on an iPhone 5 running iOS 10.3.4 with Signal version 3.9.0.13 installed.

This screenshot shows the verification failure message that I receive when I try to re-register my phone number on the app:

This second screenshot shows the debug log failure message that I receive when I try to generate a debug log from Signal's registration process (i.e., Tap 8x on an empty space on the screen):

jimio-signal commented 2 years ago

Hey all, sorry to hear that you’ve been unable to connect to the Signal service from these older devices and operating systems. The version of Signal that you have been running is missing many updates over the course of the last year or more, including one change in which an API request switched from using a phone number to a UUID. We have been working to remove phone numbers from our server-side logic, and this version will no longer work with the service.

redm123 commented 2 years ago

Poor performance! Very disappointing and ignorant. I mean things like that have also other implications, like how long can we use hardware in order to save the worlds resources? From a project like Signal I was expecting more than from the average crappy app shop! Whatsapp, Threema, all still work...

anomal commented 2 years ago

@jimio-signal You linked to Signal-Server-Private, so it's 404 for us. Can you link to the relevant change in the public Signal-Server GitHub repo instead? I understand that the old app version might not be able to send new messages anymore (which is disappointing), but does a non-registration API endpoint requiring a UUID stop users from accessing the old, existing messages on their phone?

Being able to access old messages would provide some closure and opportunity to retrieve important data, even if it's by taking screenshots.

jimio-signal commented 2 years ago

You linked to Signal-Server-Private, so it's 404 for us. Can you link to the relevant change in the public Signal-Server GitHub repo instead?

^^ apologies for that! updated/edited my comment with a pointer to the public commit.

also, I understand the frustration here, and I'll see what we can do, but also want to share that we need to make these sort of changes to keep the overall Signal ecosystem healthy, and that dropping support for older releases/clients will continue to be necessary as we work on improving the product and infrastructure.

anomal commented 2 years ago

Honestly, I am extremely disappointed that a not-for-profit organization doesn't care if poor people won't have access to private, end-to-end encrypted communication. We know that in developing countries, smartphones are much more affordable and widespread than personal computers; that Apple donates used, old iPhones to developing countries; and that people in developing countries are much more likely to live under oppressive regimes. I thought Signal was supposed to help people living in oppressive regimes organize to make change or to survive, but now it's lower priority than convenience for developers.

In Canada in 2020, there were many complaints about the COVID Alert app not supporting old iPhones, since everyone has to have access to the technology for the whole communication network to work--like Signal--and the technical reason given was the lack of a low-energy Bluetooth technology in older iPhones. There isn't this kind of firmware reason why Signal can't support older iPhones, so it must have been a conscious decision to prioritize developer convenience at the expense of reducing the user base to those with newer technology.

It looks like the expectation is that unless enough people with old iPhones living in oppressive regimes use a VPN to bypass their country's censorship, post a complaint in English by giving up some their privacy to reveal the exact country they are living in, and publicly self-identify with their marginalized group that is targeted by a nation-state, then this issue is going to be considered affecting very few people and with few social and survival consequences.

I'm relatively privileged compared to the rest of the world, and if it's already affecting my social network, then it's going to affect exponentially more in less privileged communities worldwide. For over a month, I had to fall back to using SMS with self-censoring, not because I'm purposely trying to boycott Signal, but because I have no choice. A contact of mine, who used to be on Signal and who introduced me to Signal, is no longer on Signal, because their iPhone is no longer supported. In order for me to use Signal, my contacts need to be able to use Signal.

Sadly, even when end users are asking to at least have control over and access to their own data, @jimio-signal's response sounds like "What I'm hearing is that your primary concern as an end user is that you want to control our system design and to freeze our APIs, but we have a right to make our own architectural decisions." The problem with this response isn't that technical details are provided, but that because user data resides on the user's phone instead of on Signal's servers, Signal considers user data to be outside of their system design and not their problem. If an organization lost years of customer data because of a server problem, it would normally considered unacceptable and unprofessional, but Signal disowns user data to such an extreme that they disown responsibility for allowing users to access it. (Why does user access to their own local data have a dependency on an external server at a specific domain name with specific SSL certificate with specific API being up, which they have no control over?) I don't see how users losing access to their own data is acceptable, unless the argument is "You still have your data, it's just in encoded in some binary format. We never promised that you should be able to view your data in a human-readable format. Your mistake as an end user is misunderstanding the technical distinction between 'data' versus 'information'."

systwi-again commented 2 years ago

@jimio-signal Here's my suggestion. Continue to provide API support for all versions of the Signal client, and any that report versions ≤ the version number you've specified, have the user manually type in a confirmation message, like I understand the potential risks yet choose to continue anyway. so they can continue to use the app. You could maybe even add a small caution symbol (e.g. this emoji: ⚠️) next to other Signal users using older versions of the client in your contacts list, saying something like "this user is using an older version of the Signal client, which may have security vulnerabilities." Is this an acceptable trade-off?

I greatly look forward to hearing your feedback.

systwi-again commented 2 years ago

Six months later and I'm still greatly looking forward to hearing @jimio-signal 's feedback on this problem (or any other Signal dev). I don't live in Ukraine, but I would imagine there are some people out there that can't afford the newest devices and having Signal work on their older devices would be extremely useful during the current events going on. Even, and maybe especially, Russians as well, as they certainly need to be careful on their opinions and choice of words.

Well, since this issue seems as if it will never be resolved, can anybody think of another secure/private alternative to Signal that will work on older devices? I'm all ears for suggestions.