Hector Martin

Credential minimization is desirable and good security practice, otherwise users just write them down. Sure, if you *really* want an app-level PIN every time you switch to an app you can implement that with crypto, but *nobody* wants that for a messaging app.

I write down my passwords.. encrypted.. in a password manager.. I sure as hell don't want anything sensitive stored in plaintext on my hdd even if the hdd is encrypted!

Which is fine, *if* you type in your password every time you use it. Which is not what most people want with an IM app. If you just keep the password manager active forever without requiring master password re-entry, the net benefit of its encryption is ~zero.

What's the target demographic for Signal? People who don't care about security? Why would they even use it in the first place? If it shits on security, it fails at being useful.

Make Signal require the password every time you open the window and watch the userbase disappear. And then you still get pwned by a keylogger anyway. Seriously. Wrong solution. If you want app isolation, get the damn OS to do app isolation.

Just make it optional and let the user decide their level of paranoia.

And then you're still insecure against rogue apps running simultaneously with Signal anyway. So the users think they're more secure, but they mostly aren't. You can add crappy half-assed protections into Signal, or you can do it right and get the OS to do it.

It would be a lot more secure against for example a girlfriend opening Signal while I'm in the kitchen and reading my old messages because there's no way I'm locking my computer so she can't use it to watch youtube.