Privacy

32167 readers

224 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
Don't promote proprietary software
Try to keep things on topic
If you have a question, please try searching for previous discussions, maybe it has already been answered
Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
Be nice :)

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago

MODERATORS

[email protected]

473

Signal under fire for storing encryption keys in plaintext on desktop app (stackdiary.com)

submitted 4 months ago by ForgottenFlux to c/[email protected]

254 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 12 points 4 months ago* (last edited 4 months ago) (2 children)

How in the fuck are people actually defending signal for this

Probably because Android (at least) already uses file-based encryption, and the files stored by apps are not readable by other apps anyways.

And if people had to type in a password every time they started the app, they just wouldn't use it.

[–] [email protected] 19 points 4 months ago (1 children)

Popular encrypted messaging app Signal is facing criticism over a security issue in its desktop application.

Emphasis mine.

[–] ChapulinColorado 13 points 4 months ago (1 children)

I think the point is the developers might have just migrated the code without adjustments since that is how it was implemented before. Similar to how PC game ports sometimes run like shit since they are a close 1-1 of the original which is not always the most optimized or ideal, but the quickest to output.

[–] x1gma 6 points 4 months ago

Been a few days since using electron, but AFAIK electron can't be used as a wrapper for android apps, or can it? Or is their android app a web app wrapped into a "native" android app too?

Also, since this seems to be an issue since 2018, 6 years should be plenty to rewrite using a native secure storage...

[–] [email protected] 2 points 4 months ago

AFAIK Android encrypts entire fs with one key. And ACL is not encryption.