> Timing side-channels are extremely hard to perform, especially if it is over the internet.
Not all attackers are over the internet. Especially the ones who have had the opportunity to capture your past traffic, e.g. because they compromised your internet gateway, or have the ability to MITM you and may have used that ability to compromise other devices on your LAN or inject malicious javascript that could perform certain timing attacks from your own machine.
> But all of this does not matter because all modern protocols use algorithms that are safe from timing attacks.
New classes of timing attacks are discovered on a regular basis. Then existing implementations have to be hardened again. Moreover, it's generally not the algorithm itself that has to resist the attack. Sometimes it isn't even the cryptography -- Spectre can allow the attacker to read arbitrary memory from the address space of a vulnerable program, and the timing vulnerability doesn't have to be in the cryptography library, it could be in any part of the program.
> If the master key was generated with a weak rng then the same would also be true for any ephemeral keys. That being said I doubt that any device capable of running signal is going to have a weak RNG.
This is a thing that happened:
https://www.schneier.com/blog/archives/2008/05/random_number...
And even after they fixed it, so that ephemeral keys were no longer using the bad PRNG, the long-term keys generated with the bad PRNG were still in use by anyone not paying attention.
There are also degrees of brokenness. A bad PRNG may produce output that can be guessed but not inexpensively. The attacker may be willing to pay the high price once to crack the long-term key but not pay the same price for each of thousands of messages.
> The easiest solution here is to not backup the signal directory.
But then you don't have a backup of the signal directory when your phone falls into a wood chipper.