Beehaw
  • Communities
  • Create Post
  • search
    Search
  • Login
  • Sign Up
 Nemeski   ( @neme@lemm.ee )  to Privacy Guides@lemmy.oneEnglish · 1 year ago

Signal under fire for storing encryption keys in plaintext

stackdiary.com

external-link
message-square
28
link
fedilink
  • cross-posted to:
  • foss
  • privacy@lemmy.ca
117
external-link

Signal under fire for storing encryption keys in plaintext

stackdiary.com

 Nemeski   ( @neme@lemm.ee )  to Privacy Guides@lemmy.oneEnglish · 1 year ago
message-square
28
link
fedilink
  • cross-posted to:
  • foss
  • privacy@lemmy.ca
Popular encrypted messaging app Signal is facing criticism over a security issue in its desktop application. Researchers and app users are raising
  •  eco_game   ( @eco_game@discuss.tchncs.de ) 
    link
    fedilink
    English
    arrow-up
    18
    ·
    1 year ago

    As the article states, currently all processes are able to read the file which contains the key. Instead, you could store the key in the macOS Keychain (and Linux/Windows equivalents), which AFAIK is a list of all sorts of sensitive data (think WiFi passwords etc.), encrypted with your user password. I believe the Keychain also only let’s certain processes see certain entries, so the Signal Desktop App could see only its own encryption key, whereas for example iMessage would only see the iMessage encryption key.

    •  🇦🇺𝕄𝕦𝕟𝕥𝕖𝕕𝕔𝕣𝕠𝕔𝕠𝕕𝕚𝕝𝕖   ( @muntedcrocodile@lemm.ee ) 
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Wifi passwords are piss easy to read out well at least on windows.

      •  eco_game   ( @eco_game@discuss.tchncs.de ) 
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Only if you’re logged in as an Administrator though. A “standard” user account can’t access WiFi passwords on Windows.

        •  🇦🇺𝕄𝕦𝕟𝕥𝕖𝕕𝕔𝕣𝕠𝕔𝕠𝕕𝕚𝕝𝕖   ( @muntedcrocodile@lemm.ee ) 
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 year ago

          Because a non admin account is the default right? Right?

          •  ReversalHatchery   ( @ReversalHatchery@beehaw.org ) 
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            UAC prompts you since vista if you want to let a process elevate it’s rights to be able to do that

            •  🇦🇺𝕄𝕦𝕟𝕥𝕖𝕕𝕔𝕣𝕠𝕔𝕠𝕕𝕚𝕝𝕖   ( @muntedcrocodile@lemm.ee ) 
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              Luckily nobody ever just clicks through those.

Privacy Guides@lemmy.one

privacyguides@lemmy.one

Subscribe from Remote Instance

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !privacyguides@lemmy.one
lock
Community locked: only moderators can create posts. You can still comment on posts.

In the digital age, protecting your personal information might seem like an impossible task. We’re here to help.

This is a community for sharing news about privacy, posting information about cool privacy tools and services, and getting advice about your privacy journey.


You can subscribe to this community from any Kbin or Lemmy instance:

  • Subscribe on Kbin.social
  • Subscribe on Lemmy.one
  • Subscribe on Lemmy.ml
  • Subscribe on Beehaw.org

Learn more…


Check out our website at privacyguides.org before asking your questions here. We’ve tried answering the common questions and recommendations there!

Want to get involved? The website is open-source on GitHub, and your help would be appreciated!


This community is the “official” Privacy Guides community on Lemmy, which can be verified here. Other “Privacy Guides” communities on other Lemmy servers are not moderated by this team or associated with the website.


Moderation Rules:

  1. We prefer posting about open-source software whenever possible.
  2. This is not the place for self-promotion if you are not listed on privacyguides.org. If you want to be listed, make a suggestion on our forum first.
  3. No soliciting engagement: Don’t ask for upvotes, follows, etc.
  4. Surveys, Fundraising, and Petitions must be pre-approved by the mod team.
  5. Be civil, no violence, hate speech. Assume people here are posting in good faith.
  6. Don’t repost topics which have already been covered here.
  7. News posts must be related to privacy and security, and your post title must match the article headline exactly. Do not editorialize titles, you can post your opinions in the post body or a comment.
  8. Memes/images/video posts that could be summarized as text explanations should not be posted. Infographics and conference talks from reputable sources are acceptable.
  9. No help vampires: This is not a tech support subreddit, don’t abuse our community’s willingness to help. Questions related to privacy, security or privacy/security related software and their configurations are acceptable.
  10. No misinformation: Extraordinary claims must be matched with evidence.
  11. Do not post about VPNs or cryptocurrencies which are not listed on privacyguides.org. See Rule 2 for info on adding new recommendations to the website.
  12. General guides or software lists are not permitted. Original sources and research about specific topics are allowed as long as they are high quality and factual. We are not providing a platform for poorly-vetted, out-of-date or conflicting recommendations.

Additional Resources:

  • EFF: Surveillance Self-Defense
  • Consumer Reports Security Planner
  • Jonah Aragon (YouTube)
  • r/Privacy
  • Big Ass Data Broker Opt-Out List
Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 1 user / day
  • 1 user / week
  • 2 users / month
  • 22 users / 6 months
  • 714 local subscribers
  • 20.5K subscribers
  • 539 Posts
  • 5.45K Comments
  • Modlog
  • mods:
  •  jonah   ( @jonah@lemmy.one ) 
  •  dngray   ( @dngray@lemmy.one ) 
  •  Freddy   ( @freddy@lemmy.one ) 
  •  ninchuka   ( @ninchuka@lemmy.one ) 
  •  jonah   ( @jonah@lemmy.jonaharagon.net ) 
  • BE: 0.19.13
  • Modlog
  • Legal
  • Instances
  • Docs
  • Code