{"action":"closed","issue":{"url":"https://api.github.com/repos/WhisperSystems/Signal-Android/issues/5340","repository_url":"https://api.github.com/repos/WhisperSystems/Signal-Android","labels_url":"https://api.github.com/repos/WhisperSystems/Signal-Android/issues/5340/labels{/name}","comments_url":"https://api.github.com/repos/WhisperSystems/Signal-Android/issues/5340/comments","events_url":"https://api.github.com/repos/WhisperSystems/Signal-Android/issues/5340/events","html_url":"https://github.com/WhisperSystems/Signal-Android/issues/5340","id":140681908,"number":5340,"title":"App reading SMS when Signal is locked","user":{"login":"ephexeve","id":915606,"avatar_url":"https://avatars.githubusercontent.com/u/915606?v=3","gravatar_id":"","url":"https://api.github.com/users/ephexeve","html_url":"https://github.com/ephexeve","followers_url":"https://api.github.com/users/ephexeve/followers","following_url":"https://api.github.com/users/ephexeve/following{/other_user}","gists_url":"https://api.github.com/users/ephexeve/gists{/gist_id}","starred_url":"https://api.github.com/users/ephexeve/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ephexeve/subscriptions","organizations_url":"https://api.github.com/users/ephexeve/orgs","repos_url":"https://api.github.com/users/ephexeve/repos","events_url":"https://api.github.com/users/ephexeve/events{/privacy}","received_events_url":"https://api.github.com/users/ephexeve/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-14T14:06:13Z","updated_at":"2016-03-14T17:41:54Z","closed_at":"2016-03-14T17:41:54Z","body":"I have:\r\n- [X] searched open and closed issues for duplicates\r\n- [X] read https://github.com/WhisperSystems/Signal-Android/wiki/Submitting-useful-bug-reports\r\n\r\n### Bug description\r\nI am not sure if this is a vulnerability, if it's a bug or a \"feature\". When using Signal as a default SMS app and enable the locked option, as far as I know, no one should be able to access any received message. However, if you have any two factor-authentication enable on Google (using Google as an example) and try to login to your Google account, you will receive an SMS and Google will automatically read the SMS and authenticate you, without any need of manually having to unlock Signal, copy the authentication code and paste it to Google's prompt.\r\n\r\nThis should probably work with any app that will automatically read any SMS received to authenticate any 2 second-authentication code. \r\n\r\nThis concerns me, because if I have any type of malware listening to my SMS app, it will be able to read any message I receive without worrying if Signal is locked or not. \r\n\r\n### Steps to reproduce\r\n- Remove your Google account from your Android settings.\r\n- Make sure Signal is locked and is your default SMS app.\r\n- Login to your Google Account.\r\n- Wait for the SMS.\r\n- Google will automatically authenticate you.\r\n\r\n### Device info\r\nSamsung Galaxy S5 running Cyanogen lastest nightly build of KLTE.\r\n** Signal Version: 3.13.1\r\n\r\n"}}