But surely if it was stored encrypted, it would still need a key to unlock that info. Which would be on your PC. And could therefore be used by anything else to unlock your data.
The only safe way would be encrypt it with a password that only you know, and you’d need to enter before getting back into the software. And there couldn’t be any “I forgot my password” function either. You lose it, the data is gone.
Summary:
- Signal’s desktop app stores encryption keys for chat history in plaintext, making them accessible to any process on the system
- Researchers were able to clone a user’s entire Signal session by copying the local storage directory, allowing them to access the chat history on a separate device
- This issue was previously highlighted in 2018, but Signal has not addressed it, stating that at-rest encryption is not something the desktop app currently provides
- Some argue this is not a major issue for the “average user”, as other apps also have similar security shortcomings, and users concerned about security should take more extreme measures
- However, others believe this is a significant security flaw that undermines Signal’s core promise of end-to-end encryption
- A pull request was made in April 2023 to implement Electron’s safeStorage API to address this problem, but there has been no follow-up from Signal
A pull request was made in April 2023 to implement Electron’s safeStorage API to address this problem, but there has been no follow-up from Signal
I hate hearing shit like this. What are they thinking?
They are thinking “your computer, your problem”.
They’re thinking “This doesn’t improve shareholder value, so we’re not going to put it on a sprint this quarter”, same as every other commercial piece of software does.
Also, this quarter becomes “ever” after about six months of it sitting in a backlog waiting.
Researchers were able to clone a user’s entire Signal session by copying the local storage directory, allowing them to access the chat history on a separate device
This has actually been useful for me in the past when reinstalling my OS lmao. In an ideal world we could reverify by entering a code from our phones to unlock the desktop local storage after moving it. My biggest wish for Signal is more seamless message history movement across devices and ecosystems. Fuck even proper back ups would be nice.
My biggest issue with Signal is it being so mobile-oriented. Mobile use seems to be encouraged, and even to register you are directly told to go to the mobile app (and if you register in a VM, you’re then stuck using it because it wants you to scan a QR code which is so easy to do in a VM!) No thanks, I don’t trust my mobile - they’re much harder to make private and “yours” than a desktop. Was it that hard to just add a field for entering the verification code in the desktop client? Sure, I did end up using signal-cli, but it is not mentioned anywhere officially. Point is about how the Signal itself tries to push you onto mobile.
I don’t trust my mobile - they’re much harder to make private and “yours” than a desktop.
Still mobile phones are designed with much more security in mind than desktop environments, and basically everybody has a device.
Not having backups here on iOS stresses me out. I like using iOS beta updates, but knowing I’m one bad beta from having to restore my phone (where every other little thing except Signal is backed up and waiting) and lose my conversation history forever really bugs me.
At least convert it to wingdings or something.
Wingdings is a font so… it already is.
Why not password protect the keys (ala Linux ssh / gpg symmetric encryption for local storage of PPK)
Am I missing something? Hasn’t this been known for years now? I think they previously commented on this before.
It has been known and they can’t really change it. I think it’s only now that people are realizing this is an issue or at least something happened to start the avalanche.
I don’t see what the big deal is. I store all kinds of sensitive information in plain text. SSNs, credit card numbers, birthdates and religious and political affiliation information.
The guy I bought it all from said it was okay, he stores it in plain text, too. (I’m joking, of course! Any information about you all that I’ve bought on the dark web, I’m storing responsibly.)
I wonder where one can go to buy data about themselves.
phew!
I don’t care what you do with your data… As long as your being careful with my data.
Under normal circumstances I wouldn’t expect any privacy between processes on a desktop OS under the same UID.
If you use Chrome’s password manager on Windows your password database is unlocked with your password upon login and is available to every process you run.
There’s only so much you can do, as an app, to protect against OS deficiencies.
The desktop app on Windows is a sacrifice of security for convenience.
The image is of the iOS app, but the headline is about the desktop app 🧐
unplayable
End-to-end encryption stops being secure… at the end… Who would’ve thought
What a useless app decrypts messages on my own screen when I log in with my passwords & other protections/protocols just for me to read them?
No, ty, I’ll decrypt everything in my mind only, securely under a tinfoil protection device.
There’s a desktop application?
Yes, and it’s quite good. Apart from this.
I have a couple problems with it aside from being electron.
-
On linux, whether it is a native package or flatpak. I have to launch it twice for it to open.
-
I can’t restore chats from my phone to the desktop application which frankly sucks. It makes sense if they don’t wanna have to store extra data on their servers, but at least let the backups that I manually take on my phone be usable on the desktop. Not having the majority of your conversations from before you linked the desktop app is a pain in the arse.
On linux, whether it is a native package or flatpak. I have to launch it twice for it to open.
Could it be yours is set to start in the tray?
Nope, its basically the same issue that the flatpak is happening, but I’m not using the flatpak. https://github.com/flathub/org.signal.Signal/issues/454
For me the january 13th solution seems to work, but I was doing that to begin with so I never noticed the issue. Signal flatpak, openSUSE Tumbleweed and KDE Plasma 6. Signal is started with --use-tray-icon --start-in-tray
I never have to launch twice on flatpak.
And I only keep conversations for 2 to 4 weeks so starting over doesn’t bother me. Sorry if that doesn’t work for you too.
I don’t do temporary conversations, but this is the open issue on the flatpak https://github.com/flathub/org.signal.Signal/issues/454. The thing is, I’m having the same issue as the flatpak even though I’m not using the flatpak.
That sucks and they need to fix it. Still out hasn’t happened here yet. Are you on Gnome desktop environment?
Nope, I’m on KDE.
I wonder if it’s only happening on KDE? Either way, I’m sure it needs to be corrected.
-
Quite-good is stretching it a bit. It’s serviceable but it’s still Electron with gazillion megabytes of RAM taken for no reason and absolute nightmare on laptops since browsers like waking CPU a lot.
It doesn’t have gif searching though which is so annoying.
It had a PR open before with gif search but the desktop dev closed it because he didn’t want to review something so big. Nevermind most of the PR was just assets.
It’s a shitty overbloated Electron app.
It’s fast and has good functionality, what exactly is bloated about it?
It takes up half a GB of RAM and constantly keeps the CPU active. It’s still on X11 and thus integrates poorly with the rest of my Wayland apps. It seems to report itself to Pipewire as something else every other week and is thus impossible to control reliably.
It works well and I haven’t encountered any crashes or other bugs in months. But I genuinely think it could have been much better as a QT app or so. Plus, thanks to Electron there isn’t an ARM version either making it impossible to run on my Raspberry Pi or my Pinephone.
Use these to enable Wayland support: –enable-features=UseOzonePlatform --ozone-platform=wayland
To launch the app on ARM, install electron from package manager, copy paste signal’s application directory and launch like this:
/path/to/electron /path/to/app.asar
I don’t use Signal, these are generic instructions for electron apps so YMMV.
I don’t know why they didn’t just make it a web application. It’s the same damn thing. Just like there’s web.whatsapp.com, make Signal the same way. At least that way I get to use my own browser and in a single instance.
People being triggered by the sheer existence of Electron – it just HAS to be “shitty”, even if it works perfectly fine.
I can appreciate the functionality, but cannot really call an application “good” if it eats up more than half a gigabyte of RAM while being something as simple as a messenger.
Also there are better solutions if you want to have your UI in HTML nowadays. You don’t need to embed a whole web browser in each app.
Which ones, for example?
😳😬
Anyone who uses Windows can’t be that concerned with security in the first place.
I don’t understand the issue here.
Yes, you don’t understand that the story is about the Mac client and then later it was found out that Linux and Windows are equally affected. Did you even attempt to read it?
I trust my computer and operating system. And there are several other keys and credentials stored on that laptop. I think it’s better for me to have a file that I can backup and understand how the encryption works, than to do some trickery to hide it mostly from me and maybe a bit from malware, or tie it to some hardware TPM device or something. I’m always not sure if I should rely on those too much.
I told the guy I buy a certain thing that should be legal in this state from that trusting Signal is a bad idea and he should use some coded language if we were going use it. I do anyway, but I doubt that matters.
Signal should change this, but it’s typical of the traditional desktop OS security model in which applications running under the user’s account are considered trustworthy. Security-oriented software like Signal should take a more hardened approach, but this is not some glaring security hole.
It’s actually by design. First of all they shot themselves in the foot by choosing Electron as platform to build desktop applications as Electron has no integration with the rest of the system, at least not as deep as native application has. Both Linux and, I believe, MacOS have secure storage programs for keys and passwords. Windows however does not, at least it didn’t back when we got screwed. So this is another reason why they chose to store in clear text, you have to cater to largest audience no matter how dumb the solution is.
In its truest sense this is what a technical debt is. Shitty choice costing you increasingly more as the time goes on and now they are simply too deep to pull out. They are committed to this approach and simply switching would require too much money and effort.
And you are right, it’s 100% security hole and a juicy attack vector. FileZilla did the same thing and there’s malware out there specifically targeting this software and is using user’s servers for propagation. Our systems got infected the same way long time ago because one of employees was retarded enough to use FileZilla and save password in config file even though I said not to. Since password was saved in clear text format and FTP is not terribly hard protocol to implement we got screwed. After that incident when our servers were almost taken down from internet, FTP was banned and any form of password login without two factors.
as Electron has no integration with the rest of the system,
You pretty much can use Electron to build an application and use native OS-specific features. It only requires thinking about it and a bit of work, but technically isn’t much harder to do than with anything else. And there are some things useful in windows for that, based on user login credentials.
But ultimately, if the developers didn’t care about doing that, it won’t happen, regardless of them using Electron or writing fully native apps.
Electron is capable of having just as good integration with the system as native applications. It’s just that a lot of people are not optimizing these cross platform apps to have optimal integration with them. Electron has the safeStorage API that allows you to use kwallet or GNOME Keyring to securely store information. I believe both Discord and Spotify use this on Linux.
Electron is capable of having just as good integration with the system as native applications
It will never have this since it’s incapable of using native widgets and theming, which are far more important than just looks, especially to people with disability. safeStorage is something I didn’t know about, but it seems it wasn’t used. Apart from huge RAM footprint, Electron also wakes CPU a lot which makes it absolute garbage on battery powered systems.
It will never have this since it’s incapable of using native widgets and theming
You can criticize Electron’s performance and memory footprint, but as long as there’s an API to access something, it can access the same features as a native app, it just depends on the company’s willingness to do it. HTML is also one of the best platforms in terms of accessibility.
The problem though, is that cross-platform apps are optimized for that: sharing the same code among systems, and using specific OS features complicate things, so the tendency is to use the same solution for all of them, even when it isn’t the correct one. Also, they make it possible for developers who don’t know a certain OS well to still build for it, making things potentially worse in the user experience.
That’s what I was thinking, my private keys are also chilling in plaintext on my filesystem.
I mean if somebody has physical access and is logged in they have your data anyways right?
For Linux not much of a problem since amount of malware is not that big. On Windows however a different story.
With even email clients and web browsers running arbitrary and untrusted remote code on a regular basis, that model needs serious reconsideration.
This xkcd shouldn’t still be insightful. https://xkcd.com/1200/
Maybe its time to rethink desktop security. I realize that there is credential manager on windows, keychain on mac, and similar on gnu/linux; even with that it seems for a lot of services “all” you need to do is steal a cookie and all of a sudden you are someone else.
fuck no. It’s imbossible to be productive on an android or ios phone, where the os is hostile to you actually using it the way you want.
For an example of rethinking desktop security, see wayland in linux, and how ll accessibility programs now
don’tcannot possibly work.DeX mode: Am I a joke to you?
i do have and use that. But it’s still running android apps. which are designed for a touchscreen.
Termux is great though
Idea of using a web browser for a platform was dumb enough and the reason why none of the keys were stored in appropriate services.
