Skip to content

Desktop app does not support protected storage #5703

@DDvO

Description

@DDvO

The mobile Signal app supports protecting access using, e.g., a pattern or fingerprint.
I hope, but doubt, that this also entails sensibly encrypted data storage,
which would be based on a user-supplied secret that is not stored on the device.

The desktop app obviously does not support anything like this!

  • The app does not have any access lock
  • Messages are encrypted since commit 3105b77 of July 2018 using a key stored in plain next to the data
  • Attachments (files, images etc.) are stored in plain

There have been multiple reports and requests in this direction since more than four 5 years -
see, e.g., #452, #1850, #1895, and #2008, but they were denied and further commenting on them was locked.
There is even a pull request #5465 provided by a user that would have solved the issue, but it was rejected.
Are you serious?

For a messenger that boasts high-grade end-to-end encryption,
this situation is not just a missing feature but a severe security flaw.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions