Technology

59534 readers

3209 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

372

Signal under fire for storing encryption keys in plaintext on desktop app (stackdiary.com)

submitted 4 months ago by ForgottenFlux@lemmy.world to c/technology@lemmy.world

72 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] ilickfrogs@lemmy.world 19 points 4 months ago* (last edited 4 months ago) (2 children)

Researchers were able to clone a user’s entire Signal session by copying the local storage directory, allowing them to access the chat history on a separate device

This has actually been useful for me in the past when reinstalling my OS lmao. In an ideal world we could reverify by entering a code from our phones to unlock the desktop local storage after moving it. My biggest wish for Signal is more seamless message history movement across devices and ecosystems. Fuck even proper back ups would be nice.

[–] EngineerGaming@feddit.nl 3 points 4 months ago (1 children)

My biggest issue with Signal is it being so mobile-oriented. Mobile use seems to be encouraged, and even to register you are directly told to go to the mobile app (and if you register in a VM, you're then stuck using it because it wants you to scan a QR code which is so easy to do in a VM!) No thanks, I don't trust my mobile - they're much harder to make private and "yours" than a desktop. Was it that hard to just add a field for entering the verification code in the desktop client? Sure, I did end up using signal-cli, but it is not mentioned anywhere officially. Point is about how the Signal itself tries to push you onto mobile.

[–] balder1991@lemmy.world 2 points 4 months ago (1 children)

I don't trust my mobile - they're much harder to make private and "yours" than a desktop.

Still mobile phones are designed with much more security in mind than desktop environments, and basically everybody has a device.

[–] EngineerGaming@feddit.nl 1 points 4 months ago

Security is not everything though, you need to balance it with privacy and independence as well. Which are, indeed, harder on Android.

[–] NinjaCheetah@sh.itjust.works 2 points 4 months ago

Not having backups here on iOS stresses me out. I like using iOS beta updates, but knowing I’m one bad beta from having to restore my phone (where every other little thing except Signal is backed up and waiting) and lose my conversation history forever really bugs me.