If you think that the #media files you receive on your end-to-end #encrypted secure messaging apps can not be tampered with, you need to think again! explore this new type of media form jacking below.
Conversation
This Tweet was deleted by the Tweet author. Learn more
Signal stores media in internal storage rather than demanding access to external storage and sharing it with other apps by default. WhatsApp, etc. are explicitly designed to share received media with other apps by default. They go out of their way to store it in shared storage.
1
2
Even with developer.android.com/preview/privac, apps can still go out of the way to use shared media. Most apps take a similar approach on iOS. Signal's approach of not sharing media by default is rare among widely used apps. Users can still explicitly share the media files with other apps.
1
2
There's a lot more to an app having good privacy characteristics than using end-to-end encryption. WhatsApp using the Signal encryption protocol doesn't mean that it offers comparable privacy and security when it comes to other things like not sharing your media with other apps.
1
2
This Tweet was deleted by the Tweet author. Learn more
They're explicitly choosing to share the media with other apps. To disallow other apps from reading it, they would simply need to use the standard storage inside the app sandbox. They're requesting the external storage permission and going out of their way to make it shared data.
They're using the internal app storage for most other purposes such as the messages and settings. It's an explicit choice to make the media available to other applications with external storage access. It's not a mistake that the data is shared with other apps. It's their choice.
1
This Tweet was deleted by the Tweet author. Learn more
It can mitigate a file access vulnerability in the app or the OS, which is why Signal encrypts the database with the hardware-backed keystore. It doesn't protect the data against an exploit of the app or the OS if it's not limited to file access though.
1
1
1
Show replies