Re:Vuvuzela: Metadata-private messaging
by giancarlostoro on Tuesday February 05, 2019 @05:29PM
(#19090654)
I agree, I wish Signal could work in my terminal somehow in a way that's more secure than their "Desktop" application. They were storing the decryption keys in plain text in a SQLite database iirc. I understand why they have to store it, but it's just bad if it's plaintext.
[ Parent
| on HN ]
Re:Vuvuzela: Metadata-private messaging
by lgierth on Tuesday February 05, 2019 @06:46PM
(#19091283)
There signal-cli [1] which works pretty nicely. Uses SMS for initial signup.
What's your attacker model here? On which operating system can the filesystem be compromised, but your application remains unaffected?
Re:Vuvuzela: Metadata-private messaging
by giancarlostoro on Tuesday February 05, 2019 @07:32PM
(#19091559)
Any unencrypted file system can have the conversations in plain text extracted, without having to boot the OS or open the application to decrypt the contents.
Re:Vuvuzela: Metadata-private messaging
by deusofnull on Tuesday February 05, 2019 @05:44PM
(#19090792)
jesus christ, i didnt know that....
Re:Vuvuzela: Metadata-private messaging
by giancarlostoro on Tuesday February 05, 2019 @06:01PM
(#19090959)
Yeah, it's cause of the way their crypto works, you encrypt the next message with the hash of the previous or something of the sort. Somebody stored it in plaintext for the desktop version, and I believe it's a SQLite DB so it was easy to discover... It sucks, I wish they had at least encrypted it with a pin at the minimum or something? Maybe Yubikey might make sense for Signalin the desktop not sure.
Also the messages are stored in plaintext:
https://github.com/signalapp/Signal-Desktop/issues/1017
They say it's a non-fix cause you can use full disk encryption, and honestly that's what I do anyway, so I'm not as bothered.