End-to-end encryption stops being secure… at the end… Who would’ve thought
Signal under fire for storing encryption keys in plaintext on desktop app
Submitted 4 months ago by ForgottenFlux@lemmy.world to technology@lemmy.world
https://stackdiary.com/signal-under-fire-for-storing-encryption-keys-in-plaintext/
Comments
vhstape@lemmy.sdf.org 4 months ago
Evil_Shrubbery@lemm.ee 4 months ago
What a useless app decrypts messages on my own screen when I log in with my passwords & other protections/protocols just for me to read them?
No, ty, I’ll decrypt everything in my mind only, securely under a tinfoil protection device.
root@precious.net 4 months ago
Under normal circumstances I wouldn’t expect any privacy between processes on a desktop OS under the same UID.
If you use Chrome’s password manager on Windows your password database is unlocked with your password upon login and is available to every process you run.
There’s only so much you can do, as an app, to protect against OS deficiencies.
The desktop app on Windows is a sacrifice of security for convenience.
ForgottenFlux@lemmy.world 4 months ago
[deleted]asdfasdfasdf@lemmy.world 4 months ago
A pull request was made in April 2023 to implement Electron’s safeStorage API to address this problem, but there has been no follow-up from Signal
I hate hearing shit like this. What are they thinking?
MeanEYE@lemmy.world 4 months ago
They are thinking “your computer, your problem”.
ilickfrogs@lemmy.world 4 months ago
Researchers were able to clone a user’s entire Signal session by copying the local storage directory, allowing them to access the chat history on a separate device
This has actually been useful for me in the past when reinstalling my OS lmao. In an ideal world we could reverify by entering a code from our phones to unlock the desktop local storage after moving it. My biggest wish for Signal is more seamless message history movement across devices and ecosystems.
EngineerGaming@feddit.nl 4 months ago
My biggest issue with Signal is it being so mobile-oriented. Mobile use seems to be encouraged, and even to register you are directly told to go to the mobile app (and if you register in a VM, you’re then stuck using it because it wants you to scan a QR code which is so easy to do in a VM!) No thanks, I don’t trust my mobile - they’re much harder to make private and “yours” than a desktop. Was it that hard to just add a field for entering the verification code in the desktop client? Sure, I did end up using signal-cli, but it is not mentioned anywhere officially. Point is about how the Signal itself tries to push you onto mobile.
NinjaCheetah@sh.itjust.works 4 months ago
Not having backups here on iOS stresses me out. I like using iOS beta updates, but knowing I’m one bad beta from having to restore my phone (where every other little thing except Signal is backed up and waiting) and lose my conversation history forever really bugs me.
JackGreenEarth@lemm.ee 4 months ago
The image is of the iOS app, but the headline is about the desktop app 🧐
jdeath@lemm.ee 4 months ago
unplayable
Ghostalmedia@lemmy.world 4 months ago
Storing stuff as plain text is so hot right now.
MajorHavoc@programming.dev 4 months ago
I don’t see what the big deal is. I store all kinds of sensitive information in plain text. SSNs, credit card numbers, birthdates and religious and political affiliation information.
The guy I bought it all from said it was okay, he stores it in plain text, too. (I’m joking, of course! Any information about you all that I’ve bought on the dark web, I’m storing responsibly.)
fxt_ryknow@lemmy.world 4 months ago
phew!
I don’t care what you do with your data… As long as your being careful with my data.
dependencyinjection@discuss.tchncs.de 4 months ago
I wonder where one can go to buy data about themselves.
hendrik@palaver.p3x.de 4 months ago
I trust my computer and operating system. And there are several other keys and credentials stored on that laptop. I think it's better for me to have a file that I can backup and understand how the encryption works, than to do some trickery to hide it mostly from me and maybe a bit from malware, or tie it to some hardware TPM device or something. I'm always not sure if I should rely on those too much.
grrgyle@slrpnk.net 4 months ago
There’s a desktop application?
ichbinjasokreativ@lemmy.world 4 months ago
Yes, and it’s quite good. Apart from this.
bjoern_tantau@swg-empire.de 4 months ago
It’s a shitty overbloated Electron app.
D_Air1@lemmy.ml 4 months ago
I have a couple problems with it aside from being electron.
-
On linux, whether it is a native package or flatpak. I have to launch it twice for it to open.
-
I can’t restore chats from my phone to the desktop application which frankly sucks. It makes sense if they don’t wanna have to store extra data on their servers, but at least let the backups that I manually take on my phone be usable on the desktop. Not having the majority of your conversations from before you linked the desktop app is a pain in the arse.
-
vladmech@lemmy.world 4 months ago
It doesn’t have gif searching though which is so annoying.
MeanEYE@lemmy.world 4 months ago
Quite-good is stretching it a bit. It’s serviceable but it’s still Electron with gazillion megabytes of RAM taken for no reason and absolute nightmare on laptops since browsers like waking CPU a lot.
N00dle@lemmy.world 4 months ago
Am I missing something? Hasn’t this been known for years now? I think they previously commented on this before.
MeanEYE@lemmy.world 4 months ago
It has been known and they can’t really change it. I think it’s only now that people are realizing this is an issue or at least something happened to start the avalanche.
thegreenguy@sopuli.xyz 4 months ago
According to the article there is a pull request which should fix it.
Imgonnatrythis@sh.itjust.works 4 months ago
At least convert it to wingdings or something.
KairuByte@lemmy.dbzer0.com 4 months ago
Wingdings is a font so… it already is.
Blackmist@feddit.uk 4 months ago
But surely if it was stored encrypted, it would still need a key to unlock that info. Which would be on your PC. And could therefore be used by anything else to unlock your data.
The only safe way would be encrypt it with a password that only you know, and you’d need to enter before getting back into the software. And there couldn’t be any “I forgot my password” function either. You lose it, the data is gone.
skozzii@lemmy.ca 4 months ago
Anyone who uses Windows can’t be that concerned with security in the first place.
I don’t understand the issue here.
woelkchen@lemmy.world 4 months ago
Yes, you don’t understand that the story is about the Mac client. Did you even attempt to read it?
1stTime4MeInMCU@mander.xyz 4 months ago
Why not password protect the keys (ala Linux ssh / gpg symmetric encryption for local storage of PPK)
FlyingSquid@lemmy.world 4 months ago
I told the guy I buy a certain thing that should be legal in this state from that trusting Signal is a bad idea and he should use some coded language if we were going use it. I do anyway, but I doubt that matters.
iiGxC@slrpnk.net 4 months ago
😳😬
Zak@lemmy.world 4 months ago
Signal should change this, but it’s typical of the traditional desktop OS security model in which applications running under the user’s account are considered trustworthy. Security-oriented software like Signal should take a more hardened approach, but this is not some glaring security hole.
cestvrai@lemm.ee 4 months ago
That’s what I was thinking, my private keys are also chilling in plaintext on my filesystem.
NobodyElse@sh.itjust.works 4 months ago
With even email clients and web browsers running arbitrary and untrusted remote code on a regular basis, that model needs serious reconsideration.
This xkcd shouldn’t still be insightful. xkcd.com/1200/
ChillPill@lemmy.world 4 months ago
Maybe its time to rethink desktop security. I realize that there is credential manager on windows, keychain on mac, and similar on gnu/linux; even with that it seems for a lot of services “all” you need to do is steal a cookie and all of a sudden you are someone else.
MeanEYE@lemmy.world 4 months ago
cley_faye@lemmy.world 4 months ago
You pretty much can use Electron to build an application and use native OS-specific features. It only requires thinking about it and a bit of work, but technically isn’t much harder to do than with anything else. And there are some things useful in windows for that, based on user login credentials.
But ultimately, if the developers didn’t care about doing that, it won’t happen, regardless of them using Electron or writing fully native apps.
priapus@sh.itjust.works 4 months ago
Electron is capable of having just as good integration with the system as native applications. It’s just that a lot of people are not optimizing these cross platform apps to have optimal integration with them. Electron has the safeStorage API that allows you to use kwallet or GNOME Keyring to securely store information. I believe both Discord and Spotify use this on Linux.
kerrigan778@lemmy.world 4 months ago
I mean if somebody has physical access and is logged in they have your data anyways right?
MeanEYE@lemmy.world 4 months ago
For Linux not much of a problem since amount of malware is not that big. On Windows however a different story.