Hacker News Reader

This seems to be problem with Signal to be honest.

AFAIK you can always use more secure data protection classes for your database[0]

They are using the default one, which is allowing AFU attack.

[0] https://support.apple.com/en-ca/guide/security/secb010e978a/...

Would switching to say, Protected Unless Open have a negative performance impact? Otherwise, it seems like a kind of obvious oversight not to use a more restrictive data protection class. I'd be curious to know the Signal team's rationale for using PUFUA.

Actually i just checked their entitlements on github and it is set to NSFileProtectionComplete.

Seems stranger than I thought

edit: After diving into code, they are using NSFileProtectionCompleteUntilFirstUserAuthentication for their DB file, probably they have some reason

So useless for a stolen cracked phone like this case?

Presumably it lets things like notifications work.

Reply on news.ycombinator.com