discoverbtc on Nostr: I was not aware of this #security hole in Signal Desktop. The database encryption key ...

I was not aware of this #security hole in Signal Desktop. The database encryption key was stored in plaintext for years. It's partially fixed now. Links below.

I looked at their repo and it hasn't been fully patched yet. For now they're supporting a fallback option, which means the key may still be stored in plaintext. You can check by looking at the config file where the key is stored.

"In addition to migrating to encrypted/keystore-backed local database encryption keys on supported platforms, our implementation also includes some additional troubleshooting steps and a temporary fallback option that will allow users to recover their message database using their legacy database encryption key if something goes wrong. This should help minimize data loss if any edge cases or other keystore-related bugs are discovered during the migration process and production rollout. The temporary fallback and legacy key will both be removed after everything has been tested and deployed on a wide variety of devices across various operating systems and OS versions."

https://www.bleepingcomputer.com/news/security/signal-downplays-encryption-key-flaw-fixes-it-after-x-drama/

https://github.com/signalapp/Signal-Desktop/pulls?q=is%3Apr+is%3Aclosed+safeStorage