News for hackers. Stuff that matters.
Re:Signal Desktop is corrupting its database by 0x0 on Sunday February 28, 2021 @06:59AM (#26292764)
I thought sqlite was very resilient and have a hard time understanding how an sqlite file can be corrupted. Are they manipulating the sqlite file outside of sqlite APIs? Are they mixing up file descriptors and writing garbage into an sqlite handle?
Re:Signal Desktop is corrupting its database by primeos on Sunday February 28, 2021 @07:51AM (#26293045)
They encrypt the DB via SQLCipher: https://github.com/sqlcipher/sqlcipher

Not sure how reliable and resilient SQLCipher is but that might (significantly?) increase the risk for a bug/corruption to occur. And the encryption certainly makes the analysis more difficult (while, at least on GNU/Linux, I don't see any advantage as the encryption key is stored unencrypted in ~/.config/Signal/config.json - not sure if other Desktop platforms support secure keystores like on Android and iOS). I briefly tried to analyze my corrupted DB but quickly gave up as I'm not familiar with SQLCipher and basically only got a generic "Error: file is not a database" error message when trying to decrypt it (and there's no plaintext header IIRC so it looks just like random data).

I also had multiple backups of the SQLCipher DB that I could successfully access manually but I was unable to use them for Signal-Desktop (not sure if this was due to some other Electron DBs/state, the stateful Signal protocol, or something else - IIRC the only hint was the "Database startup error: Error: SQLITE_NOTADB: file is not a database" message that didn't really help much).

Re:Signal Desktop is corrupting its database by RJIb8RBYxzAMX9u on Sunday February 28, 2021 @08:09AM (#26293167)
How does it differ from the 1st party encryption[0]? I couldn't find any comparison in SQLCipher's readme.

[0] https://www.sqlite.org/see/doc/trunk/www/readme.wiki

Re:Signal Desktop is corrupting its database by kbumsik on Sunday February 28, 2021 @08:25AM (#26293258)
The official SQLite Encryption Extension is not free (one-time $2000 + optional support) and do not allow re-distribute the source code.

SQLCipher has open-source communitiy edition.

Re:Signal Desktop is corrupting its database by dj_mc_merlin on Sunday February 28, 2021 @07:52AM (#26293049)
"How To Corrupt An SQLite Database File": https://www.sqlite.org/howtocorrupt.html
Re:Signal Desktop is corrupting its database by appleflaxen on Sunday February 28, 2021 @08:16AM (#26293204)
the SQLite documentation is incredible. the dev team is so thoughtful and reflective, and shares not only the code/application, but their understanding.

As popular as it is, it's still underrated.

Re:Signal Desktop is corrupting its database by dssound on Sunday February 28, 2021 @07:42AM (#26292992)
I had issues with corruption during a Xamarin project - its easy to do with bad coding but if proper practices are made then it shouldn't occur much.