Am I tripping or if you upgrade Signal Desktop, it saves all your messages in plain text (messages.json) + attachments locally so you can re-import them in the newer version? #fail #wtf
Show this thread
-
If you encrypt at rest with a password based key (using KDF) that you don't store anywhere, and decrypt only chunks of the data at rest to store in memory, then you are limiting the attack surface. Also, this helps against device theft where they don't conrol your running app
Unless you want to input your password for every single message you view, the key has to be in memory while you use the app, at which point any other process can grab it.
-
-
You're solving these problems with the wrong, insufficient solution. This isn't Signal's job. Use sandboxing or user isolation to protect apps from each other. Use FDE and lock screens to protect against device theft.
-
Yeah, you are right. Windows should also store credentials in json plain text on the disk to make
@gentilkiwi job easier for mimikatz. And users should just use Bitlocker as a security boundary against mimikatz. - Show replies
New conversation -
-
-
'Chunks' can mean 'your last 5 days of messages'. Scrolling further would require a retype. But even if it is kept in memory, it's still good against device theft.
-
We already have FDE to protect against device theft. Doing it in the app would require you to log in on every boot. It makes a lot more sense to have FDE for the whole system rather than each app implementing its own thing.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.