Comment on Signal under fire for storing encryption keys in plaintext

Blizzard@lemmy.zip ⁨4⁩ ⁨months⁩ ago

• henfredemars@infosec.pub ⁨4⁩ ⁨months⁩ ago

  With what? Where would you store the encryption key for the encryption key on a desktop system where it would not be accessible to an attacker?

  Perhaps there could be a pin or password that must be entered every time to decrypt it into memory.

  source

  • eco_game@discuss.tchncs.de ⁨4⁩ ⁨months⁩ ago

    As the article states, currently all processes are able to read the file which contains the key. Instead, you could store the key in the macOS Keychain (and Linux/Windows equivalents), which AFAIK is a list of all sorts of sensitive data (think WiFi passwords etc.), encrypted with your user password. I believe the Keychain also only let’s certain processes see certain entries, so the Signal Desktop App could see only its own encryption key, whereas for example iMessage would only see the iMessage encryption key.

    source

    • TheEntity@lemmy.world ⁨4⁩ ⁨months⁩ ago

      There is no single keychain on Linux, and supposedly on Windows too. Signal would need to either support a few dozens of password managers or require a specific one, both options terrible in their own way. This isn’t something that can be done without making broad assumptions about the user’s system.

      source

      • eco_game@discuss.tchncs.de ⁨4⁩ ⁨months⁩ ago

        I’m not too knowledgeable on that topic, but doesn’t Linux store WiFi or smb-share passwords in some keychain?

        source

        • -> View More Comments
    • muntedcrocodile@lemm.ee ⁨4⁩ ⁨months⁩ ago

      Wifi passwords are piss easy to read out well at least on windows.

      source

      • eco_game@discuss.tchncs.de ⁨4⁩ ⁨months⁩ ago

        Only if you’re logged in as an Administrator though. A “standard” user account can’t access WiFi passwords on Windows.

        source

        • -> View More Comments
  • boredsquirrel@slrpnk.net ⁨4⁩ ⁨months⁩ ago

    Something you know, something you have, something you are.

    3FA:

    • Pin
    • Security Key/TPM/Secure element
    • fingerprint / iris scan

    You could also start with just one of these

    source

    • ArcaneSlime@lemmy.dbzer0.com ⁨4⁩ ⁨months⁩ ago

      fingerprint / iris scan

      Nope, I’m out. I’m not giving my unchangeable biological data to the Computer Gods because A) Fuck that and B) the police in my country can compel the use of biometrics to unlock things but cannot compel you to give up your pass as it is protected by the first amendment. Yes I think the bios should be protected too but that isn’t the reality in which I live.

      source

      • FutileRecipe@lemmy.world ⁨4⁩ ⁨months⁩ ago

        Nope, I’m out.

        From the person you replied to, emphasis mine:

        You could also start with just one of these

        source

        • -> View More Comments
      • boredsquirrel@slrpnk.net ⁨4⁩ ⁨months⁩ ago

        Yeah that factor may not be wanted. But it is a security factor.

        You could hash it securely so the computer gods dont know your fingerprint. And you could only use it in addition to another factor.

        source
    • veniasilente@lemm.ee ⁨4⁩ ⁨months⁩ ago

      Isn’t the idea that not everyone has access to your biometrics?

      There’s honestly no need to make computers ask people for piss scans:

      something you know

      A password

      something you have

      Access to the password

      something you are

      The person who knows the password

      source

      • boredsquirrel@slrpnk.net ⁨4⁩ ⁨months⁩ ago

        A password can be cracked and is often very bad.

        source

        • -> View More Comments
• RagingHungryPanda@lemm.ee ⁨4⁩ ⁨months⁩ ago

  Yo dawg

  source