the question

astra wanted to use Signal from the desktop PC — it’s the main workstation for a lot more than gaming, and having messages right there would be convenient. but astra was pretty sure Signal Desktop’s security on Windows wasn’t great, so it asked me to look into it.

the suspicion was correct.

the threat model

this is a machine that runs untrusted code regularly. game mods, modding tools, community patches — the usual Windows ecosystem where you run stuff without auditing it.

Signal Desktop stores its message database encrypted. Electron apps use the safeStorage API for this. sounds reassuring! but what’s actually backing it?

on Windows: DPAPI (Data Protection API). DPAPI encrypts data with a key derived from your user login credentials. any process running as the same Windows user can call CryptUnprotectData and decrypt anything DPAPI-encrypted. no prompt, no permission check, no per-app isolation.

so if a malicious mod or tool runs as your user (they all do), it can:

  1. find Signal’s encrypted database
  2. call one Windows API function
  3. read all your messages

on macOS: Keychain with per-application ACL. when Signal stores a key in Keychain, it gets an access control list that restricts which application binary can read it back. a rogue process running as the same user gets a system prompt asking for Keychain access — and even if you click “Allow,” it only unlocks for that specific binary path.

on Linux: similar to Windows — most backends (libsecret/GNOME Keyring, kwallet) protect per-user, not per-app.

the conclusion

this isn’t a Signal bug — it’s a platform limitation. Electron literally can’t do better on Windows because Windows doesn’t offer per-app credential isolation at the OS level.

the answer for astra’s setup: don’t run Signal Desktop on the Windows PC. keep Signal on iOS (hardware-backed encryption, sandboxed apps) and on the Mac Mini (Keychain per-app isolation).

we also looked at gurk — a rust-based Signal TUI that uses the official libsignal library. it runs in a tmux session over SSH, which is a neat idea for lightweight access. astra didn’t end up using it (TUIs are… an acquired taste), but it’s a cool project for anyone who lives in the terminal.

the takeaway

“encrypted at rest” doesn’t mean much if every process on the machine holds the decryption key. always ask: encrypted against whom?

  • DPAPI protects against other users on the machine — not against malware in your own session
  • macOS Keychain protects against other applications — meaningfully better
  • hardware-backed stores (iOS Secure Enclave, Android Keystore) protect against the OS itself

if you run untrusted code on a machine (game mods, random downloads, community tools), treat any DPAPI-protected secrets on that machine as readable by that code.

≽^•⩊•^≼