• 3 Posts
  • 77 Comments
Joined 1 year ago
cake
Cake day: June 17th, 2023

help-circle




  • As the article states, currently all processes are able to read the file which contains the key. Instead, you could store the key in the macOS Keychain (and Linux/Windows equivalents), which AFAIK is a list of all sorts of sensitive data (think WiFi passwords etc.), encrypted with your user password. I believe the Keychain also only let’s certain processes see certain entries, so the Signal Desktop App could see only its own encryption key, whereas for example iMessage would only see the iMessage encryption key.















  • I really like the convenience and also added security. For example, while using my half broken Pixel, I noticed two things:

    1. Unlocking with two hands and a pin is pretty fast, but with one hand it takes forever compared to fingerprint.
    2. For “secure” apps (Aegis, Bitwarden, Banking apps), it’s quite nice to use my fingerprint instead of master passwords. The odds of someone managing to get in there by spoofing my fingerprint or something are practically 0, whereas when I would just use the same pin as my phone it would be stupidly insecure. Even when using a separate 6 character pin, it’s still very easy for bystanders to watch and see the pin (and it’s slower and less convenient).

    Also in terms of general security I’m perfectly fine with it, as my actual fingerprint never leaves the phone (AFAIK not even the sensor but don’t quote me on that) and I can just purposefully scan the wrong finger or a dirty finger 5 times and it’s locked.

    That is also the reason why I absolutely hate face unlock, I’ve quite often just taken a random friends phone, held it up to their face for 1 second, and I was in. That stuff is scary.