Oops.

Oops

  • realDek4y@lemmy.world
    17·
    4 months ago

    “We’re committed to providing a helpful user experience while maintaining our high security standards as our technology evolves.”

    Ah, the most high security there is, plain text files.

  • qx128@lemmy.world
    4·
    4 months ago

    Sadly, looks like they also didn’t store the files in an area accessible only to the user that created them. That seems like the most logical protection… I’m less worried about encryption if only my user id can access the files…

    • pivot_root@lemmy.world
      3·
      4 months ago

      According to the post linked in the article, it’s under ~/Library/Application Support.

      The good news is that ~/Library isn’t world-readable by default. The bad news is that it’s still very easily readable by any process running under the user and by any other user with admin privileges or access to sudo.

  • henfredemars@infosec.pub
    4·
    4 months ago

    I’m a little confused. If the conversations weren’t stored in plain text, wouldn’t the key have to be stored on your computer also? Isn’t that plain text with extra steps?

    • black0ut@pawb.social
      10·
      4 months ago

      Depends on the system, but normally, the OS provides a way to encrypt a file using the user credentials. It’s completely seamless while the user is logged in and using the computer. It’s true that any program running with the user privileges and within its session can open the file, but once the user logs out it’s unreadable.

      • pivot_root@lemmy.world
        6·
        4 months ago

        With MacOS, specifically, it’s stupidly easy and unintrusive to enable disk encryption. Outside of that, programs can save key-value pairs to Keychain (a credential store) and use that to store a randomly-generated encryption key.

        It’s true that any program running with the user privileges and within its session can open the file, but once the user logs out it’s unreadable.

        If the data was saved to the login Keychain, it should only be accessible while that specific user is logged in. The existence of vulnerabilities notwithstanding, it should actually be reasonably secure as long as System Integrity Protection is enabled and the program in question isn’t running. SIP stops users (including root) from messing with system files or processes, and the Keychain requires a user password prompt to give programs access to entries created by other programs.

        Now, considering all the above… it would have taken a day at most to figure out how to encrypt the data before it gets written to the file so it’s not just sitting completely out in the open.