Hacker News Reader

Comment by mopsi | Hacker News Reader

There's a hacky way to back up messages sent on IOS, if you sync messages to desktop client, because it stores messages in a SQLite database. While encrypted, encryption key for the database is kept as plaintext in a JSON file. :)

On Windows:

1. Download "DB Browser for SQLite" https://sqlitebrowser.org/

2. Unpack it and run "DB Browser for SQLCipher.exe".

3. Open database, select "%APPDATA%\Signal\sql\db.sqlite".

4. In the following dialog, select "Raw key" type and enter the encryption key stored in "%APPDATA%\Signal\config.json" into Password field (prefix it with 0x).

5. Now you can work with the database, including exporting its contents to unencrypted SQLite, CSV and JSON.

The process should be similar on other platforms.

View on HN

The Signal desktop client is a poster child for “lousy Electron app” and a sucky user experience. I don’t use Signal a lot and get maybe three or four messages a day in total. Every time I launch the desktop client it counts the messages one by one like a small child would.

Yes, I instantly get sad each time I fire it up. Aside being the lousiest of Electron apps, it has no security features at all. Just pair once with your phone and anyone gaining access to your computer can read your messages. Are the messages on my computer encrypted? I don't know. I wish I could set up a strong password.

While encrypted, encryption key for the database is kept as plaintext in a JSON file.

...which is kept right next to the encrypted DB and presumably has the same permissions, so what's the point?

A more secure delete, for one.

Not really considering SQLite databases can use WAL commits and it’s easy to view those previous commits.

SQLCipher encrypts the WAL.[1]

[1] https://www.zetetic.net/sqlcipher/design/

From your source, it uses the same key:

> Write Ahead Log Files - Using the new WAL mode (i.e. PRAGMA journal_mode = WAL;), page data stored in the WAL file is encrypted using the datbase key. Pages in the rollback journal are encrypted using the same key as the main database. Verification: create an encrypted database, start a transaction, make changes, and then inspect the -wal file using hexdump or a similar program.

So destroying the key makes both unrecoverable.

Yes, Except the key isn’t destroyed it’s in the json file next to the main db file. Meaning user’s deleted messages could still be recovered.

Even if the user went as far as deleting the json file, it could still possibly be recovered due to the way the FS ‘deletes’ files.

I think the other posters are saying it’s much easier to shred a small file than it is to shred a multiple GB database, although these days it doesn’t matter so much for a database that small. It’s super efficient for file systems though.

Yes. And I'm talking generally. I don't know what Signal does.

Thank you. I haven't been able to try it immediately as I don't normally use the desktop client, but that looks like a workaround that could be useful.

Reply on news.ycombinator.com