Signal under fire for storing encryption keys in plaintext
brie @ brie @beehaw.org Posts 24Comments 138Joined 2 yr. ago
European Commission sends preliminary findings to Apple and opens additional non-compliance investigation against Apple under the Digital Markets Act
OMG! We’re at forty! (Announcing the release of Fedora Linux 40) - Fedora Magazine
Apple will require notarization for apps from third party app stores, and will disable updates for apps installed via third party app stores if staying outside EU
Alan Pope: "Multiple genuine-looking scam cryptocurrency miners and fake Bitcoin wallet applications have been published in the Snap store since 2018."
Kakao Entertainment seems to be planning legal action against Tachiyomi (and forks)
Fossify Gallery is now on F-Droid, and Simple Gallery got removed due to a proprietary dependency
YouTuber The Completionist's Open Hand Foundation Accused of Keeping Charitable Donations - IGN
Restricting access to files within a user is why sandboxing is useful. It in theory limits the scope of a vulnerability in an app to only the files it can read (unless there is a sandbox escape). Android instead prevents apps from accessing other apps' files by having each app run as a separate user.
One way to keep the encryption keys encrypted at rest is to require the login password (or another password) to open the app, and use it to encrypt the keys. That said, if an adversary can read Signal's data, they can almost certainly just replace Signal with a password-stealing version.