4 mo. ago • 66%

Signal under fire for storing encryption keys in plaintext

stackdiary.com Signal under fire for storing encryption keys in plaintext

Popular encrypted messaging app Signal is facing criticism over a security issue in its desktop application. Researchers and app users are raising

15 comments

Ah yes, the old "your data isn't safe when an attacker has full access to your pc account" vulnerability

31
- Yeah fuck security in layers, my first layer is 100% bulletproof so I got no reason to worry
  
  9
  
  Exactly, which is why your drives should be encrypted.
  
  Once you lose physical control of a device, all bets are off, drive encryption at least slows down attackers significantly.
  
  I have far more sensitive, and a greater volume of data, on the drive than just comms.
  
  3
- Not necessarily. There are many paths to exfiltrated data that don't require privileged access, and can be exploited through vulnerabilities in other applications.
  
  2
Don't the keys have to be in plaintext at some point so they can be used

15
- Yeah but they don't have to be visible to every process the user runs, my Minecraft mods really don't need access to my encryption keys
  
  5
- They could at least allow for setting paaword. Then your keys are encrypted with that password
  
  3
I think the issue that they are trying to make is that there are modern ways of protecting the keys with hardware level security, that aren’t being used. As someone who works in AppSec this is all too common. All it takes is one library in an application to be popped (doesn’t have to be signal), and security keys end up leaked. If it isn’t already, I’m sure that signals keys will be included in exfil scripts.

Tools like TPM and SecureEnclaves (TrustZone,etc) mean that malware, and other nasties have a higher bar that they need to meet.

7
- Yeah, and electron already has a secureStorage API that handles the OS interop for you. Which signal isn't using, and a PR already exists to enable...
  
  4
  
  I'm not surprised... I think people ('the ones that care at least') would be horrified to know how much of this stuff slips through, because it's hard (there are so many other things that are pulling at developers that something falls through the cracks). Most of the time the right answer is to bring it up. Then thank them when they resolve the issue (with beer and pizza money at the very least).
  
  Looks like it's waiting for approval, https://github.com/signalapp/Signal-Desktop/pull/6933 for anyone else thats interested.
  
  5

You've viewed 15 comments.