Popular encrypted messaging app Signal is facing criticism over a security issue in its desktop application. Researchers and app users are raising

As mentioned in the comments, plain text keys aren’t bad because they are necessary. You have to have at least one plain text key in order to be able to use encryption

  • Riskable@programming.devEnglish
    86·
    6 days ago

    This is a, “it’s turtles all the way down!” problem. An application has to be able to store its encryption keys somewhere. You can encrypt your encryption keys but then where do you store that key? Ultimately any application will need access to the plaintext key in order to function.

    On servers the best practice is to store the encryption keys somewhere that isn’t on the server itself. Such as a networked Hardware Security Module (HSM) but literally any location that isn’t physically on/in the server itself is good enough. Some Raspberry Pi attached to the network in the corner of the data center would be nearly as good because the attack you’re protecting against with this kind of encryption is someone walking out of the data center with your server (and then decrypting the data).

    With a device like a phone you can’t use a networked HSM since your phone will be carried around with you everywhere. You could store your encryption keys out on the Internet somewhere but that actually increases the attack surface. As such, the encryption keys get stored on the phone itself.

    Phone OSes include tools like encrypted storage locations for things like encryption keys but realistically they’re no more secure than storing the keys as plaintext in the application’s app-specific store (which is encrypted on Android by default; not sure about iOS). Only that app and the OS itself have access to that storage location so it’s basically exactly the same as the special “secure” storage features… Except easier to use and less likely to be targeted, exploited, and ultimately compromised because again, it’s a smaller attack surface.

    If an attacker gets physical access to your device you must assume they’ll have access to everything on it unless the data is encrypted and the key for that isn’t on the phone itself (e.g. it uses a hash generated from your thumbprint or your PIN). In that case your effective encryption key is your thumb(s) and/or PIN. Because the Signal app’s encryption keys are already encrypted on the filesystem.

    Going full circle: You can always further encrypt something or add an extra step to accessing encrypted data but that just adds inconvenience and doesn’t really buy you any more security (realistically). It’s turtles all the way down.

    • tatterdemalion@programming.dev
      13·
      6 days ago

      This reminds me of the apparent gnome-keyring security hole. It’s mentioned in the first section of the arch wiki entry: https://wiki.archlinux.org/title/GNOME/Keyring

      Any application can read keyring entries of the other apps. So it’s pretty trivial to make a targeted attack on someone’s account if you can get them to run an executable on their machine.

    • Skull giver@popplesburger.hilciferous.nl
      6·
      5 days ago

      Phones come with pretty easy encryption APIs that use hardware encryption stores to do the encryption work. You can copy the entire data folder to the same phone after a factory reset, but the messages won’t decrypt. It’s a useful extra encryption feature that’s pretty tough to crack (as in, governments will struggle) but trivial to implement.

      Desktop operating systems lack this. I believe Windows can do it through Windows Hello but that requires user interaction (and Windows isn’t sandboxed anyway so it doesn’t protect you much if you’re running malware are the same time). Don’t know about macOS, but I assume it’s the same story. Linux lacks support for security hardware entirely and doesn’t even try (see: the useless Keychain API copy).

      What desktop operating systems do protect you from, though, is offline attacks. Someone needs to know your password to log in and grab the keys, even if they know your disk’s encryption key. Not even your Bitlocker recovery key will suffice to get your keys out of a locked Windows Hello key store. Linux can implement this ad well, in theory, but nothing seems to actually implement any of it.

      Leveraging modern key store mechanisms would protect Signal on macOS and Windows. On Linux you’d still be in the same shitty situation, though if they were to implement the key store API, someone could at least eventually make something secure in the future.

      • sic_1@feddit.de
        8·
        5 days ago

        Signal seem to be the least compromising messenger app out there with their privacy policy and open source code base. It’s only natural they are frequent victims of FUD.