Signal under fire for storing encryption keys in plaintext on desktop app
Signal under fire for storing encryption keys in plaintext on desktop app
Popular encrypted messaging app Signal is facing criticism over a security issue in its desktop application. Researchers and app users are raising
You're viewing a single thread.
There's a desktop application?
Yes, and it's quite good. Apart from this.
It's a shitty overbloated Electron app.
It's fast and has good functionality, what exactly is bloated about it?
People being triggered by the sheer existence of Electron – it just HAS to be "shitty", even if it works perfectly fine.
I can appreciate the functionality, but cannot really call an application "good" if it eats up more than half a gigabyte of RAM while being something as simple as a messenger.
Also there are better solutions if you want to have your UI in HTML nowadays. You don’t need to embed a whole web browser in each app.
Which ones, for example?
Something like tauri does, by using the OS web engine, so the apps can be a few KB (depending on the code of course).
It takes up half a GB of RAM and constantly keeps the CPU active. It's still on X11 and thus integrates poorly with the rest of my Wayland apps. It seems to report itself to Pipewire as something else every other week and is thus impossible to control reliably.
It works well and I haven't encountered any crashes or other bugs in months. But I genuinely think it could have been much better as a QT app or so. Plus, thanks to Electron there isn't an ARM version either making it impossible to run on my Raspberry Pi or my Pinephone.
I don't know why they didn't just make it a web application. It's the same damn thing. Just like there's web.whatsapp.com, make Signal the same way. At least that way I get to use my own browser and in a single instance.
Use these to enable Wayland support: --enable-features=UseOzonePlatform --ozone-platform=wayland
To launch the app on ARM, install electron from package manager, copy paste signal's application directory and launch like this:
/path/to/electron /path/to/app.asar
I don't use Signal, these are generic instructions for electron apps so YMMV.
I have a couple problems with it aside from being electron.
-
On linux, whether it is a native package or flatpak. I have to launch it twice for it to open.
-
I can't restore chats from my phone to the desktop application which frankly sucks. It makes sense if they don't wanna have to store extra data on their servers, but at least let the backups that I manually take on my phone be usable on the desktop. Not having the majority of your conversations from before you linked the desktop app is a pain in the arse.
I never have to launch twice on flatpak.
And I only keep conversations for 2 to 4 weeks so starting over doesn't bother me. Sorry if that doesn't work for you too.
I don't do temporary conversations, but this is the open issue on the flatpak https://github.com/flathub/org.signal.Signal/issues/454. The thing is, I'm having the same issue as the flatpak even though I'm not using the flatpak.
That sucks and they need to fix it. Still out hasn't happened here yet. Are you on Gnome desktop environment?
Nope, I'm on KDE.
I wonder if it's only happening on KDE? Either way, I'm sure it needs to be corrected.
That would certainly be a weird one.
On linux, whether it is a native package or flatpak. I have to launch it twice for it to open.
Could it be yours is set to start in the tray?
Nope, its basically the same issue that the flatpak is happening, but I'm not using the flatpak. https://github.com/flathub/org.signal.Signal/issues/454
For me the january 13th solution seems to work, but I was doing that to begin with so I never noticed the issue. Signal flatpak, openSUSE Tumbleweed and KDE Plasma 6. Signal is started with --use-tray-icon --start-in-tray
Glad that it works for you. I may have to switch over to the flatpak then.
-
It doesn’t have gif searching though which is so annoying.
It had a PR open before with gif search, but the desktop dev closed it because he didn’t want to review something so big. Nevermind most of the PR was just assets.
Quite-good is stretching it a bit. It's serviceable but it's still Electron with gazillion megabytes of RAM taken for no reason and absolute nightmare on laptops since browsers like waking CPU a lot.
Fair points, I normally use it on a high-end gaming pc, making me ignorant to issues of that nature.