Am I tripping or if you upgrade Signal Desktop, it saves all your messages in plain text (messages.json) + attachments locally so you can re-import them in the newer version? #fail #wtf
Show this thread
-
And if you're talking about keys stored in memory being useless, you're also sort of implying old fashioned, non-PFS style encryption is useless. Anyway, you're being condescending and it's annoying. Encryption at rest isn't "magic pixie dust" or "throwing encryption at a wall".
You keep trying to straw man me. I never said encryption at rest is useless. I said you need to know your threat model. Encryption at rest is only useful when (attack surface of storage) > (attack surface of active system).
-
-
Of course you can concoct artificial scenarios where encryption at rest helps on a desktop, but the benefit is *minimal*, won't stop a dedicated attacker, and thus Signal not encrypting at rest backups on a desktop is not a WTF.
-
If you want encryption at rest against external attackers, *use FDE*. If you want security across app boundaries, *use different users or sandboxing*. There are much better solutions to real attack scenarios than Signal throwing some random crypto onto its backups.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.