Hector Martin

Am I tripping or if you upgrade Signal Desktop, it saves all your messages in plain text (messages.json) + attachments locally so you can re-import them in the newer version? #fail #wtf

There is no magical pixie dust encryption algorithm that will protect your messages in such a way that whatever new version of Signal can access them but no other app or user can (on a desktop). If you have local access it's game over.

any such challenge can be resolved by a dev who actually takes time to address it

Security is more than just the dev's job. How would a dev account for me giving out my passwords to everyone?

Would it not be safe to assume people chosing privacy tools have no intent on sharing passwords with just everyone. They'd use a post-it. As long as the devs don't supply the tools to get the job done in a way that gets the job done. Security is a waste of time, and it often is.

There's tools to encrypt hard drives already so the question becomes why we can trust security conscious people to not hand out passwords but also cant trust them to run bitlocker?

What does harddrive encryption have to do with anything ? This is about signal not handling data in a trusted way.