Signal under fire for storing encryption keys in plaintext
stackdiary.com
Popular encrypted messaging app Signal is facing criticism over a security issue in its desktop application. Researchers and app users are raising
  • hendrik@palaver.p3x.deEnglish
    0·
    4 months ago

    I trust my computer and operating system. And there are several other keys and credentials stored on that laptop. I think it’s better for me to have a file that I can backup and understand how the encryption works, than to do some trickery to hide it mostly from me and maybe a bit from malware, or tie it to some hardware TPM device or something. I’m always not sure if I should rely on those too much.

  • root@precious.netEnglish
    0·
    4 months ago

    Under normal circumstances I wouldn’t expect any privacy between processes on a desktop OS under the same UID.

    If you use Chrome’s password manager on Windows your password database is unlocked with your password upon login and is available to every process you run.

    There’s only so much you can do, as an app, to protect against OS deficiencies.

    The desktop app on Windows is a sacrifice of security for convenience.

  • skozzii@lemmy.caEnglish
    0·
    4 months ago

    Anyone who uses Windows can’t be that concerned with security in the first place.

    I don’t understand the issue here.

    • woelkchen@lemmy.worldEnglish
      0·
      4 months ago

      Yes, you don’t understand that the story is about the Mac client and then later it was found out that Linux and Windows are equally affected. Did you even attempt to read it?

    • Evil_Shrubbery@lemm.eeEnglish
      0·
      4 months ago

      What a useless app decrypts messages on my own screen when I log in with my passwords & other protections/protocols just for me to read them?

      No, ty, I’ll decrypt everything in my mind only, securely under a tinfoil protection device.

  • Zak@lemmy.worldEnglish
    0·
    4 months ago

    Signal should change this, but it’s typical of the traditional desktop OS security model in which applications running under the user’s account are considered trustworthy. Security-oriented software like Signal should take a more hardened approach, but this is not some glaring security hole.

      • MeanEYE@lemmy.worldEnglish
        0·
        4 months ago

        For Linux not much of a problem since amount of malware is not that big. On Windows however a different story.

    • cestvrai@lemm.eeEnglish
      0·
      4 months ago

      That’s what I was thinking, my private keys are also chilling in plaintext on my filesystem.

      • ChillPill@lemmy.worldEnglish
        0·
        4 months ago

        Maybe its time to rethink desktop security. I realize that there is credential manager on windows, keychain on mac, and similar on gnu/linux; even with that it seems for a lot of services “all” you need to do is steal a cookie and all of a sudden you are someone else.

        • vrighter@discuss.tchncs.deEnglish
          0·
          4 months ago

          fuck no. It’s imbossible to be productive on an android or ios phone, where the os is hostile to you actually using it the way you want.

          For an example of rethinking desktop security, see wayland in linux, and how ll accessibility programs now don’t cannot possibly work.

        • MeanEYE@lemmy.worldEnglish
          0·
          4 months ago

          Idea of using a web browser for a platform was dumb enough and the reason why none of the keys were stored in appropriate services.

  • N00dle@lemmy.worldEnglish
    0·
    4 months ago

    Am I missing something? Hasn’t this been known for years now? I think they previously commented on this before.

    • MeanEYE@lemmy.worldEnglish
      0·
      4 months ago

      It has been known and they can’t really change it. I think it’s only now that people are realizing this is an issue or at least something happened to start the avalanche.

  • Blackmist@feddit.ukEnglish
    0·
    4 months ago

    But surely if it was stored encrypted, it would still need a key to unlock that info. Which would be on your PC. And could therefore be used by anything else to unlock your data.

    The only safe way would be encrypt it with a password that only you know, and you’d need to enter before getting back into the software. And there couldn’t be any “I forgot my password” function either. You lose it, the data is gone.

  • Flying Squid@lemmy.worldEnglish
    0·
    4 months ago

    I told the guy I buy a certain thing that should be legal in this state from that trusting Signal is a bad idea and he should use some coded language if we were going use it. I do anyway, but I doubt that matters.

      • MeanEYE@lemmy.worldEnglish
        0·
        4 months ago

        Quite-good is stretching it a bit. It’s serviceable but it’s still Electron with gazillion megabytes of RAM taken for no reason and absolute nightmare on laptops since browsers like waking CPU a lot.

          • Björn Tantau@swg-empire.deEnglish
            0·
            4 months ago

            It takes up half a GB of RAM and constantly keeps the CPU active. It’s still on X11 and thus integrates poorly with the rest of my Wayland apps. It seems to report itself to Pipewire as something else every other week and is thus impossible to control reliably.

            It works well and I haven’t encountered any crashes or other bugs in months. But I genuinely think it could have been much better as a QT app or so. Plus, thanks to Electron there isn’t an ARM version either making it impossible to run on my Raspberry Pi or my Pinephone.

            • mrvictory1@lemmy.worldEnglish
              0·
              4 months ago

              Use these to enable Wayland support: –enable-features=UseOzonePlatform --ozone-platform=wayland

              To launch the app on ARM, install electron from package manager, copy paste signal’s application directory and launch like this:

              /path/to/electron /path/to/app.asar

              I don’t use Signal, these are generic instructions for electron apps so YMMV.

            • MeanEYE@lemmy.worldEnglish
              0·
              4 months ago

              I don’t know why they didn’t just make it a web application. It’s the same damn thing. Just like there’s web.whatsapp.com, make Signal the same way. At least that way I get to use my own browser and in a single instance.

            • EngineerGaming@feddit.nlEnglish
              0·
              4 months ago

              I can appreciate the functionality, but cannot really call an application “good” if it eats up more than half a gigabyte of RAM while being something as simple as a messenger.

      • D_Air1@lemmy.mlEnglish
        0·
        4 months ago

        I have a couple problems with it aside from being electron.

        1. On linux, whether it is a native package or flatpak. I have to launch it twice for it to open.

        2. I can’t restore chats from my phone to the desktop application which frankly sucks. It makes sense if they don’t wanna have to store extra data on their servers, but at least let the backups that I manually take on my phone be usable on the desktop. Not having the majority of your conversations from before you linked the desktop app is a pain in the arse.

        • AbackDeckWARLORD@sh.itjust.worksEnglish
          0·
          4 months ago

          It had a PR open before with gif search, but the desktop dev closed it because he didn’t want to review something so big. Nevermind most of the PR was just assets.

  • MajorHavoc@programming.devEnglish
    0·
    4 months ago

    I don’t see what the big deal is. I store all kinds of sensitive information in plain text. SSNs, credit card numbers, birthdates and religious and political affiliation information.

    The guy I bought it all from said it was okay, he stores it in plain text, too. (I’m joking, of course! Any information about you all that I’ve bought on the dark web, I’m storing responsibly.)