Wifi passwords are piss easy to read out well at least on windows.
Comment on Signal under fire for storing encryption keys in plaintext
eco_game@discuss.tchncs.de 4 months agoAs the article states, currently all processes are able to read the file which contains the key. Instead, you could store the key in the macOS Keychain (and Linux/Windows equivalents), which AFAIK is a list of all sorts of sensitive data (think WiFi passwords etc.), encrypted with your user password. I believe the Keychain also only let’s certain processes see certain entries, so the Signal Desktop App could see only its own encryption key, whereas for example iMessage would only see the iMessage encryption key.
muntedcrocodile@lemm.ee 4 months ago
eco_game@discuss.tchncs.de 4 months ago
Only if you’re logged in as an Administrator though. A “standard” user account can’t access WiFi passwords on Windows.
muntedcrocodile@lemm.ee 4 months ago
Because a non admin account is the default right? Right?
ReversalHatchery@beehaw.org 4 months ago
UAC prompts you since vista if you want to let a process elevate it’s rights
TheEntity@lemmy.world 4 months ago
There is no single keychain on Linux, and supposedly on Windows too. Signal would need to either support a few dozens of password managers or require a specific one, both options terrible in their own way. This isn’t something that can be done without making broad assumptions about the user’s system.
eco_game@discuss.tchncs.de 4 months ago
I’m not too knowledgeable on that topic, but doesn’t Linux store WiFi or smb-share passwords in some keychain?
TheEntity@lemmy.world 4 months ago
Either multiple different keychains or even you can have no keychain-like application in your system at all.
The WiFi passwords are usually stored in
/etc/NetworkManageras plain files. Granted, they are not accessible directly by non-root users as they are being managed by the NetworkManager daemon, but there is nothing generic for such a thing. Signal rolling a similar daemon for itself would be an overkill. The big desktop environments (GNOME, KDE…) usually have their own keychain-like programs that the programs provided by these environments use, but that only solves this problem for the users of these specific environments.To me it’s perfectly expected the Signal encryption keys are readable by my user account.