- cross-posted to:
- [email protected]
- [email protected]
- cross-posted to:
- [email protected]
- [email protected]
You must log in or # to comment.
Signal should change this, but it’s typical of the traditional desktop OS security model in which applications running under the user’s account are considered trustworthy. Security-oriented software like Signal should take a more hardened approach, but this is not some glaring security hole.
That’s what I was thinking, my private keys are also chilling in plaintext on my filesystem.
With even email clients and web browsers running arbitrary and untrusted remote code on a regular basis, that model needs serious reconsideration.
This xkcd shouldn’t still be insightful. https://xkcd.com/1200/
Maybe its time to rethink desktop security. I realize that there is credential manager on windows, keychain on mac, and similar on gnu/linux; even with that it seems for a lot of services “all” you need to do is steal a cookie and all of a sudden you are someone else.
seems to be the way both apple and MS are going.
Idea of using a web browser for a platform was dumb enough and the reason why none of the keys were stored in appropriate services.
Removed by mod
as Electron has no integration with the rest of the system,
You pretty much can use Electron to build an application and use native OS-specific features. It only requires thinking about it and a bit of work, but technically isn’t much harder to do than with anything else. And there are some things useful in windows for that, based on user login credentials.
But ultimately, if the developers didn’t care about doing that, it won’t happen, regardless of them using Electron or writing fully native apps.
Electron is capable of having just as good integration with the system as native applications. It’s just that a lot of people are not optimizing these cross platform apps to have optimal integration with them. Electron has the safeStorage API that allows you to use kwallet or GNOME Keyring to securely store information. I believe both Discord and Spotify use this on Linux.
Electron is capable of having just as good integration with the system as native applications
It will never have this since it’s incapable of using native widgets and theming, which are far more important than just looks, especially to people with disability. safeStorage is something I didn’t know about, but it seems it wasn’t used. Apart from huge RAM footprint, Electron also wakes CPU a lot which makes it absolute garbage on battery powered systems.
It will never have this since it’s incapable of using native widgets and theming
You can criticize Electron’s performance and memory footprint, but as long as there’s an API to access something, it can access the same features as a native app, it just depends on the company’s willingness to do it. HTML is also one of the best platforms in terms of accessibility.
The problem though, is that cross-platform apps are optimized for that: sharing the same code among systems, and using specific OS features complicate things, so the tendency is to use the same solution for all of them, even when it isn’t the correct one. Also, they make it possible for developers who don’t know a certain OS well to still build for it, making things potentially worse in the user experience.
it is true that they do not integrate with widgets and theming, but that’s not exclusive to electron. GTK apps don’t follow system widgets, nor will they follow theming on non-gtk desktops. I do also prefer desktop apps not be written in electron for the performance reasons you mentioned.
I mean if somebody has physical access and is logged in they have your data anyways right?
For Linux not much of a problem since amount of malware is not that big. On Windows however a different story.
deleted by creator
A pull request was made in April 2023 to implement Electron’s safeStorage API to address this problem, but there has been no follow-up from Signal
I hate hearing shit like this. What are they thinking?
They are thinking “your computer, your problem”.
Researchers were able to clone a user’s entire Signal session by copying the local storage directory, allowing them to access the chat history on a separate device
This has actually been useful for me in the past when reinstalling my OS lmao. In an ideal world we could reverify by entering a code from our phones to unlock the desktop local storage after moving it. My biggest wish for Signal is more seamless message history movement across devices and ecosystems. Fuck even proper back ups would be nice.
Not having backups here on iOS stresses me out. I like using iOS beta updates, but knowing I’m one bad beta from having to restore my phone (where every other little thing except Signal is backed up and waiting) and lose my conversation history forever really bugs me.
Storing stuff as plain text is so hot right now.
The image is of the iOS app, but the headline is about the desktop app 🧐
unplayable
At least convert it to wingdings or something.
Wingdings is a font so… it already is.
Am I missing something? Hasn’t this been known for years now? I think they previously commented on this before.
It has been known and they can’t really change it. I think it’s only now that people are realizing this is an issue or at least something happened to start the avalanche.
Why not password protect the keys (ala Linux ssh / gpg symmetric encryption for local storage of PPK)
I told the guy I buy a certain thing that should be legal in this state from that trusting Signal is a bad idea and he should use some coded language if we were going use it. I do anyway, but I doubt that matters.
