-
-
Notifications
You must be signed in to change notification settings - Fork 2.9k
Description
The mobile Signal app supports protecting access using, e.g., a pattern or fingerprint.
I hope, but doubt, that this also entails sensibly encrypted data storage,
which would be based on a user-supplied secret that is not stored on the device.
The desktop app obviously does not support anything like this!
- The app does not have any access lock
- Messages are encrypted since commit 3105b77 of July 2018 using a key stored in plain next to the data
- Attachments (files, images etc.) are stored in plain
There have been multiple reports and requests in this direction since more than four 5 years -
see, e.g., #452, #1850, #1895, and #2008, but they were denied and further commenting on them was locked.
There is even a pull request #5465 provided by a user that would have solved the issue, but it was rejected.
Are you serious?
For a messenger that boasts high-grade end-to-end encryption,
this situation is not just a missing feature but a severe security flaw.