3r3122.  
Illustration thehackernews.com 3r31-10. 3r3122.  
3r3122.  
Signal gained popularity after it became known as the “favorite messenger” of Edward Snowden. In 201? he said that he used Signal daily, presumably to communicate with journalists. 3r3122.  
3r3122.  
The Signal messenger is positioned as a specially protected means of communication, which uses end-to-end encryption, which should exclude unauthorized access to the contents of the correspondence. However, as it turned out, there are situations when all efforts to encrypt Signal information are crossed out. 3r3122.  
3r3122.  

Do time

3r3122.  
Information security researcher Matthew Syush shared his discovery that one of the most secure crypto-messengers “planted” an impressive size “pig” to its users. The Signal messenger during the migration process from the Chrome extension to a full-fledged desktop client exports user messages to unprotected text files. 3r3122.  
3r3122.  
3r380.
I created a GitHub issue for the record: https://t.co/XzEHZPMYX0 3r3122. 3r3122. Here is a screenshot of the exported data, including exlusive logs with @thegrugq - Insane. Totally insane. 3r340. pic.twitter.com/gA8dPTaJrR
3r3394. - Matt Suiche (@msuiche) October 2? 201
3r399. 3r3128.
3r33130. BleepingComputer went ahead and found out that the same exact problem manifests itself in Linux Mint. 3r3122.  
3r3122.  
When exporting conversations to disk, Signal forms separate folders named by name and phone number of contacts. All dialog content is stored in plain text JSON. The program does not display any warnings that the information is decrypted and saved to disk. This moment is the key to the threat of leakage of confidential data. 3r3122.  
3r3122.  
The worst thing in this situation is that unencrypted messages remain on the disk even after the upgrade is completed, and you have to delete them manually, if, of course, the user guesses at all
 
3r3122.  

Do two

3r3122.  
But this was not enough! The second problem in Signal Desktop was revealed by another researcher Nathan Shochy. 3r3122.  
3r3122.  
3r380.
. @signalapp If you’re not logging on your computer, you’re not able to access it. #pwned
3r3386. #bugbounty
3r388. #fulldisclosure
#infosec 3r33939. pic.twitter.com/ylsegJICJP
3r3394. - Nathaniel Suchy (@nathanielrsuchy) October 2? 201
3r399. 3r3128.
3r33130. 3r3122.  
3r3122.  
Nathan Shochy learned that during the Signal Desktop installation an encrypted SQLite database (db.sqlite) is created with an archive of user messages. The encryption key for the database is generated by the messenger without user interaction and is used every time you need to read the database with a message archive. Who would have thought that the key is stored locally and in clear text? This key can be found on the PC in the file 3r3109. % AppData% Signalconfig.json and on the Mac in 3r3109. ~ /Library /Application Support /Signal /config.json [/i] . 3r3122.  
3r3122.  
3r3115. 3r3122.  
3r3122.  

Do three, Signal blue flame burn!

3r3122.  
Apparently, the problems with Signal do not end there. For example, another expert, Keith McCammon, indicates that Signal Desktop is not good at removing attachments from "disappearing" messages. The function of “disappearing” messages was positioned by developers as an additional layer of security, but in fact it works very unreliably. According to McCammon, all attachments remain on the Signal users disk even after they should be deleted. 3r33130.
! function (e) {function t (t, n) {if (! (n in e)) {for (var r, a = e.document, i = a.scripts, o = i.length; o-- ;) if (-1! == i[o].src.indexOf (t)) {r = i[o]; break} if (! r) {r = a.createElement ("script"), r.type = "text /jаvascript", r.async =! ? r.defer =! ? r.src = t, r.charset = "UTF-8"; var d = function () {var e = a.getElementsByTagName ("script")[0]; e.parentNode.insertBefore (r, e)}; "[object Opera]" == e.opera? a.addEventListener? a.addEventListener ("DOMContentLoaded", d,! 1): e.attachEvent ("onload", d ): d ()}}} t ("//mediator.mail.ru/script/2820404/"""_mediator") () (); 3r3128.
3r33130.