News for hackers. Stuff that matters.
Re:Signal Desktop is corrupting its database by primeos on Sunday February 28, 2021 @07:51AM (#26293045)
They encrypt the DB via SQLCipher: https://github.com/sqlcipher/sqlcipher

Not sure how reliable and resilient SQLCipher is but that might (significantly?) increase the risk for a bug/corruption to occur. And the encryption certainly makes the analysis more difficult (while, at least on GNU/Linux, I don't see any advantage as the encryption key is stored unencrypted in ~/.config/Signal/config.json - not sure if other Desktop platforms support secure keystores like on Android and iOS). I briefly tried to analyze my corrupted DB but quickly gave up as I'm not familiar with SQLCipher and basically only got a generic "Error: file is not a database" error message when trying to decrypt it (and there's no plaintext header IIRC so it looks just like random data).

I also had multiple backups of the SQLCipher DB that I could successfully access manually but I was unable to use them for Signal-Desktop (not sure if this was due to some other Electron DBs/state, the stateful Signal protocol, or something else - IIRC the only hint was the "Database startup error: Error: SQLITE_NOTADB: file is not a database" message that didn't really help much).

Re:Signal Desktop is corrupting its database by RJIb8RBYxzAMX9u on Sunday February 28, 2021 @08:09AM (#26293167)
How does it differ from the 1st party encryption[0]? I couldn't find any comparison in SQLCipher's readme.

[0] https://www.sqlite.org/see/doc/trunk/www/readme.wiki

Re:Signal Desktop is corrupting its database by kbumsik on Sunday February 28, 2021 @08:25AM (#26293258)
The official SQLite Encryption Extension is not free (one-time $2000 + optional support) and do not allow re-distribute the source code.

SQLCipher has open-source communitiy edition.