8
Enlarge / You may want to nicely ask your friends who use Signal on the Mac desktop to change their notification settings.
(credit: Signal)
Signal, the privacy-focused voice and text-messaging application, offers an attractive bit of operational security: ephemeral text messages that "self-delete" after a predetermined amount of time.
There is just one small problem, however, with that feature on the Mac desktop version of the application, as information security consultant Alec Muffett discovered: if you send a self-deleting message to someone using the macOS application, the message lives on in macOS' Notifications history.
#HEADSUP: #Security Issue in #Signal.
If you are using the @signalapp desktop app for Mac, check your notifications bar; messages get copied there and they seem to persist — even if they are "disappearing" messages which have been deleted/expunged from the app.
pic.twitter.com/CVVi7rfLoY
— Alec Muffett (@AlecMuffett) May 8, 2018
Ars reproduced the problem, which Patrick Wardle of Objective See conducted a particularly deep dive on—revealing that the problem is, in part, a bug in the way Signal handles calls to the macOS notification system and, in part, is just how macOS notifications work.
Read 3 remaining paragraphs | Comments
