this post was submitted on 26 Nov 2023
295 points (95.1% liked)
Privacy
30856 readers
477 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
There is nothing more that I hate then typing on my Phone. I can't life without Signal Desktop.
maybe try setting up a matrix bridge if you feel confident you can secure that properly. On one hand it might increase attack surface (use only servers and bridges with End to Bridge Encryption) but what's an attack surface on software that is so ridiculously compromised. Also you can try using an alternative client such as Flare. Though YMMV, for me the last time I've used it it was quite rough around the edges but I'm happy to see it's actively maintained so might be worth checking out.
Also no, flatpak doesn't fix this issue. Yeah it provides some isolation which can be further improved with flatseal, and other defense-in-depth methods. But unless you are willing to face the trade-offs of using Qubes, you won't compartmentalize your entire system. The key file in question is stored in
~/.local/share
. I'm not denying vulnerabilities in userland applications, but thanks to it's wide reach, often massive codebases and use of unsafe languages like C, it's the core system or networked software that is the most common attack vector. And that doesn't ship and will never ship via flatpak.The most obvious way this is exploitable is directory traversal. But not only that. Just look up "Electron $VULNERABILITY", be it CSRF, XSS or RCE. Sandbox escape is much easier with this crap than any major browser, since
contextIsolation
is often intentionally disabled to access nodejs primitives instead of electron's safer replacements. Btw Signal Desktop is also an electron app.https://github.com/Genymobile/scrcpy