# Signal under fire for storing encryption keys in plaintext in Desktop app **URL:** \ **Category:** Linux lounge\ **Created:** [July 9, 2024, 1:44pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838 "2024-07-09T13:44:08Z")\ **Posts on this page:** 19\ **Page:** 2
**Author:** ![winnyace](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/winnyace/32/135698_2.png) [@winnyace](https://forum.endeavouros.com/u/winnyace)\ **Post date:** [July 10, 2024, 2:47pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/21 "2024-07-10T14:47:58Z")
There’s the also the fact Signal prides itself on being secure and private. This, kind of, goes against that. There are solutions to this issue, from your keyring suggestion to simply just prompting the user to re-enter their password every time they open up the desktop app. ---
**Author:** ![ricklinux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/ricklinux/32/110798_2.png) [@ricklinux](https://forum.endeavouros.com/u/ricklinux)\ **Post date:** [July 10, 2024, 4:55pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/22 "2024-07-10T16:55:22Z")
Maybe if users weren’t so quick to condemn and start blasting social media sites with negative feedback and instead approached the companies with valid feedback and examples of the issues as well as asking for possible solutions there would be a more willingness to listen. If users don’t accept the answers then they can give their reasons why and try to elicit a more positive approach to rectifying some of the issues. The company has the right to decide what and if any changes they make. Users will either accept that or company may lose users based on their answers and decisions. It is what it is but it is up to the users to make valid arguments with positive persuasions that makes sense. ---
**Author:** ![mbod](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mbod/32/16833_2.png) [@mbod](https://forum.endeavouros.com/u/mbod)\ **Post date:** [July 10, 2024, 5:14pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/23 "2024-07-10T17:14:16Z")
> [@dalto](#): > > This is a lovely narrative but we shouldn’t accept it. We need applications to get better about securing their data. What do you mean by that? Do you ask every desktop application that stores data in my HOME directory to encrypt it? Emails, office documents, everything should be encrypted by the application (libreoffice, thunderbird, etc.)? I dont think that this is the right approach. ---
**Author:** ![dalto](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/dalto/32/5577_2.png) [@dalto](https://forum.endeavouros.com/u/dalto)\ **Post date:** [July 10, 2024, 5:41pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/24 "2024-07-10T17:41:44Z")
> [@mbod](#): > > Do you ask every desktop application that stores data in my HOME directory to encrypt it? I am not saying that libreoffice needs to encrypt my documents automatically. However, if libreoffice adds a function to encrypt documents, I expect that encryption to be secure and reliable. Likewise, any application that holds secrets, needs to manage them securely. Encryption keys are secrets. Keeping them in a plaintext file is unacceptable. Any application that chooses to do that, should be considered broken and should be fixed. Just saying, meh, if someone gets access to your data you are screwed anyway isn’t a reasonable or acceptable response for a company to make about their product. I am not saying “Don’t use Signal”. I am saying “We need hold Signal accountable and ask them to do better with security”. ---
**Author:** ![drunkenvicar](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/drunkenvicar/32/112222_2.png) [@drunkenvicar](https://forum.endeavouros.com/u/drunkenvicar)\ **Post date:** [July 10, 2024, 7:17pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/25 "2024-07-10T19:17:47Z")
> [@anon93652015](#): > > Getting access to someone’s browser directory could literally ruin their life. > [@mbod](#): > > At the end of the day the lesson learned by this discussion is: If somebody has access to your $HOME you are screwed anyways. Absolutely. For the average person (one) a password list breach coupled with (two) all the PII an intruder could grab would be enough to make one’s life unbearable for months and maybe for life if an alternative identity (or identities) is established. > [@dalto](#): > > Just saying, meh, if someone gets access to your data you are screwed anyway isn’t a reasonable or acceptable response for a company to make about their product. Not for a company no. It comes off as side-stepping or deflecting to be sure. > [@ricklinux](#): > > Maybe if users weren’t so quick to condemn and start blasting social media sites with negative feedback and instead approached the companies with valid feedback and examples of the issues as well as asking for possible solutions there would be a more willingness to listen. If users don’t accept the answers then they can give their reasons why and try to elicit a more positive approach to rectifying some of the issues. The company has the right to decide what and if any changes they make. Users will either accept that or company may lose users based on their answers and decisions. It is what it is but it is up to the users to make valid arguments with positive persuasions that makes sense. As someone who lives their life in the minority by refusing to knee-jerk, I completely agree doing the opposite of knee jerk in the scenario you layed out, would be so much more constructive. The knee-jerkers [the ones whose first instinct is to get uber-negative online] forget that they have a choice and can abandon the app whose terms you don’t agree with. Your last two sentences spot on too. Fascinating thread, intelligent responses. good reading. ---
**Author:** ![hwmpunk](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/h/9de0a6/32.png) [@hwmpunk](https://forum.endeavouros.com/u/hwmpunk)\ **Post date:** [July 15, 2024, 5:23am UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/26 "2024-07-15T05:23:01Z")
Honest question, is session really more private and encrypted than signal? I’ve never heard a solid argument for that, I recall it doesn’t do perfect forwarding or something like that, which is as moot of an argument as this signal situation in the eyes of some. I also remember the consensus being that if you use onion, you stand out like a sore thumb to your isp and anyone watching your isp. ---
**Author:** ![BluishHumility](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bluishhumility/32/70412_2.png) [@BluishHumility](https://forum.endeavouros.com/u/BluishHumility)\ **Post date:** [July 15, 2024, 5:28pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/27 "2024-07-15T17:28:05Z")
> [@hwmpunk](#): > > Honest question, is session really more private and encrypted than signal? Session doesn’t require a phone number, which may be a privacy advantage depending on your use case. Session is not “more” encrypted than Signal; in fact, it uses the same end-to-end encryption protocol (the [Signal Protocol](https://en.wikipedia.org/wiki/Signal_Protocol)). ---
**Author:** ![hwmpunk](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/h/9de0a6/32.png) [@hwmpunk](https://forum.endeavouros.com/u/hwmpunk)\ **Post date:** [July 15, 2024, 5:43pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/28 "2024-07-15T17:43:37Z")
Given that Signal now allows usernames and has an option to completely hide your phone number, I’d say that advantage is even at this point. If there are no other advantages to Session, then trying to convert the masses away from Signal doesn’t seem like a worthwhile endeavor. ---
**Author:** ![BluishHumility](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bluishhumility/32/70412_2.png) [@BluishHumility](https://forum.endeavouros.com/u/BluishHumility)\ **Post date:** [July 15, 2024, 6:11pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/29 "2024-07-15T18:11:34Z")
> [@hwmpunk](#): > > Signal now allows usernames and has an option to completely hide your phone number It’s good that Signal added support for this, but Session does not require a phone number or email address for _creating_ an account (not just sending messages), so this is a little different. [https://getsession.org/faq#identity-protection](https://getsession.org/faq#identity-protection) Session also routes traffic through Tor’s Onion network ([https://getsession.org/faq#onion-routing](https://getsession.org/faq#onion-routing)), making it impossible to track where Session messages are going or coming from. There are not central servers either. In general, it is more anonymous than Signal. > [@hwmpunk](#): > > trying to convert the masses away from Signal doesn’t seem like a worthwhile endeavor I’m not aware of anyone trying to “convert the masses away from Signal”, but for anyone who was motivated to switch to another messager because of the plaintext encryption key drama, it seems they have addressed that issue in the wake of the Twitter backlash: > **[Signal downplays encryption key flaw, fixes it after X drama](https://www.bleepingcomputer.com/news/security/signal-downplays-encryption-key-flaw-fixes-it-after-x-drama/)** > > Signal is finally tightening its desktop client's security by changing how it stores plain text encryption keys for the data store after downplaying the issue since 2018. ---
**Author:** ![andrewb](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/a/85e7bf/32.png) [@andrewb](https://forum.endeavouros.com/u/andrewb)\ **Post date:** [July 15, 2024, 7:05pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/30 "2024-07-15T19:05:53Z")
There are still features of Session that make it worthwhile. I like both, and use Signal more due to the people I need to communicate with. I would prefer to use Session more if not always. Session has no central service like Signal needs. Session uses less metadata. With Signal, it’s known who you were talking to, but not what was said. Session doesn’t have that issue. Read up on the Session website and their youtube channel. ---
**Author:** ![hwmpunk](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/h/9de0a6/32.png) [@hwmpunk](https://forum.endeavouros.com/u/hwmpunk)\ **Post date:** [July 15, 2024, 8:12pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/31 "2024-07-15T20:12:50Z")
Sorry, I meant that from what I understand about Tor, if you use it you stand out like a sore thumb to your ISP because hardly anyone uses it unless you’re in a very dense metro area. So to get into extremes, it might shine a light more so than just a vpn to where they can try to pinpoint the user? I also heard that the majority of the nodes are now controlled by the big boys and it could be compromised? ---
**Author:** ![shuvashish76](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/shuvashish76/32/90945_2.png) [@shuvashish76](https://forum.endeavouros.com/u/shuvashish76)\ **Post date:** [July 27, 2024, 5:42am UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/32 "2024-07-27T05:42:17Z")
> **[Nadim Kobeissi (@kaepora)](https://nitter.privacydev.net/kaepora/status/1810611336675565934)** > > Signal’s cult status amongst the cryptography in-group has led to a corrupt discourse that punishes constructive critical thinking and ostracizes any analysis of Signal that’s not wholly positive as being done in bad faith. Signal’s leadership has... Signal blocks security researchers ---
**Author:** ![d-air1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/d-air1/32/70006_2.png) [@d-air1](https://forum.endeavouros.com/u/d-air1)\ **Post date:** [July 29, 2024, 2:11am UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/33 "2024-07-29T02:11:47Z")
I wouldn’t say security researchers. Just that guy specifically. He hasn’t pointed to any one else being blocked and generally seems to be making a fuss. ---
**Author:** ![Bink](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bink/32/87216_2.png) [@Bink](https://forum.endeavouros.com/u/Bink)\ **Post date:** [July 29, 2024, 4:13am UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/34 "2024-07-29T04:13:00Z")
That was my takeaway impression too after reading that link. It would be more accurate to say Signal blocked Nadim, as “researches” implies more than one. It’s not clear there’s more than one. Clearly, Nadim is not pleased about that, but the reason _why_ he was blocked isn’t clear either. If you go and look at [the GitHub pull request](https://github.com/signalapp/Signal-Desktop/pull/6849#issuecomment-2218845070) he screenshots there, you’ll note that the post directly above (not in the screenshot) is a response from a Signal dev explaining how they have addressed the issue and thanking contributors for their assistance. ---
**Author:** ![TomDoe](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/tomdoe/32/41570_2.png) [@TomDoe](https://forum.endeavouros.com/u/TomDoe)\ **Post date:** [July 29, 2024, 6:47am UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/35 "2024-07-29T06:47:48Z")
Apparently the encryption is now secured via the keyring and auto-login users promptly complain because they have to enter the password. > > > \### Using a supported version? > > \- \[X\] I have searched searched open and closed i…ssues for duplicates. > \- \[X\] I am using Signal-Desktop as provided by the Signal team, not a 3rd-party package. > > \### Overall summary > > After upgrading to 7.16.0, I see a login keyring password prompt. > > \> The login keyring did not get unlocked when you logged into your computer. > > Signal doesn't launch until the prompt goes away, but I can hit the cancel button multiple times to make that happen. > > This issue has existed before (#5914). > > 1. What is the cause of the issue? > 2. What should users do in the meantime? > 3. If needed, when will Signal developers release a fix? > > \### Steps to reproduce > > 1. Attempt to launch Signal. > > \### Expected result > > Signal launches immediately. > > \### Actual result > > The login prompt appears, and Signal does not launch. > > \### Screenshots > > \_No response\_ > > \### Signal version > > 7.16.0 > > \### Operating system > > Debian based > > \### Version of Signal on your phone > > \_No response\_ > > \### Link to debug log > > \_No response\_ ---
**Author:** ![winnyace](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/winnyace/32/135698_2.png) [@winnyace](https://forum.endeavouros.com/u/winnyace)\ **Post date:** [July 29, 2024, 7:01am UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/36 "2024-07-29T07:01:33Z")
I guess you can’t win them all. I believe for this type of app, though, auto-login shouldn’t really be a feature, for, hopefully, obvious reasons. ---
**Author:** ![limotux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/limotux/32/35347_2.png) [@limotux](https://forum.endeavouros.com/u/limotux)\ **Post date:** [July 29, 2024, 3:31pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/37 "2024-07-29T15:31:14Z")
> [@winnyace](#): > > I guess you can’t win them all. I believe for this type of app, though, auto-login shouldn’t really be a feature, for, hopefully, obvious reasons. I believe storing anything anywhere simply does not guarantee anything even if it is password protected. Same for storing anything on any device that connects to the internet, or even connect to another device that connects to the internet. This is if you want to be sure nobody else gets access! But still, we have to live with the cloud and the internet. Just be wise! ---
**Author:** ![winnyace](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/winnyace/32/135698_2.png) [@winnyace](https://forum.endeavouros.com/u/winnyace)\ **Post date:** [July 29, 2024, 6:25pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/39 "2024-07-29T18:25:46Z")
Yep, I agree. In this case, though, I just find the idea of an auto-login feature for something that says it is private and secure and whatnot a bit too slippery in its nature. It is correct that it is ultimately one’s responsibility to take care of their system, but this feature isn’t exactly required on an app of this nature and especially done in this fashion. ---
**Author:** ![Bink](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bink/32/87216_2.png) [@Bink](https://forum.endeavouros.com/u/Bink)\ **Post date:** [July 29, 2024, 9:27pm UTC](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838/40 "2024-07-29T21:27:43Z")
I believe the “auto-login” was in reference to Linux login, and being asked for a password was in reference to needing to unlock the wallet (eg: KDE Wallet) before Signal would successfully launch. [Previous page](https://forum.endeavouros.com/t/signal-under-fire-for-storing-encryption-keys-in-plaintext-in-desktop-app/57838.md?page=1)