Signal has recently addressed a long-standing security flaw in its desktop client, finally fixing how it stored encryption keys. Here’s a quick overview of the issue and the solution:

– Initially, Signal Desktop stored encryption keys in plain text, making user data vulnerable.
– This flaw was highlighted back in 2018 but had not been addressed until now.
– Mobile security researchers Talal Haj Bakry and Tommy Mysk reignited the discussion by pointing out this key vulnerability.
– In response to ongoing criticism and recent attention from Elon Musk’s tweet, Signal has taken steps to enhance its desktop client security.

Here’s what Signal has done to improve its security measures:

– Independent developer Tom Plant proposed using Electron’s SafeStorage API to secure Signal’s data store against offline attacks.
– Signal has implemented support for Electron’s SafeStorage API, with this new security feature set to be available in an upcoming Beta version.
– The updated security measures include migrating to encrypted/keystore-backed local database encryption keys, troubleshooting steps, and a temporary fallback option.

It’s reassuring to see Signal taking proactive steps to address this security issue and prioritize user data protection. Stay tuned for the upcoming Beta version with enhanced security features!