Signal for Mac users should disable notifications to keep their messages secure

If you’re using Signal for secure messaging, here’s something to be aware of. The app is one of the best-regarded encrypted messaging tools out there, but Mac owners who use Signal might inadvertently be putting their privacy at risk.

As Motherboard reports, security researcher Alec Muffett discovered that Signal messages sent to a Mac can persist in the notifications center, even if you have the app’s settings tuned to delete them.

#HEADSUP: #Security Issue in #Signal. If you are using the @signalapp desktop app for Mac, check your notifications bar; messages get copied there and they seem to persist — even if they are "disappearing" messages which have been deleted/expunged from the app. pic.twitter.com/CVVi7rfLoY

— Alec Muffett (@AlecMuffett) May 8, 2018

That fact suggests that otherwise private messages live on in the operating system, which is something other researchers are looking into at the moment.

(some) of your disappearing Signal msgs are belong to us Msgs may remain in the UI of macOS's Notification Center (as @AlecMuffett noted) – and also stored in user-readable OS database. Blog post explains why, how to recover/decode msgs, & mitigations: https://t.co/kUwrcbsCSr

— patrick wardle (@patrickwardle) May 9, 2018

It’s a serious concern for anyone who relies on the Signal Mac app, but remember: to take advantage of this flaw, a hacker would need to compromise or obtain your Mac, and by then it’s probably game over.

To turn off the setting — and we recommend that you do — go to the Settings menu within the Signal for Mac app and select either “Neither name nor message” or “Disable notifications” to make sure that your private messages don’t stray beyond Signal.

Read more
May 09, 2018 at 02:40PM

from TechCrunch
via IFTTT