Under normal circumstances I wouldn’t expect any privacy between processes on a desktop OS under the same UID.
If you use Chrome’s password manager on Windows your password database is unlocked with your password upon login and is available to every process you run.
There’s only so much you can do, as an app, to protect against OS deficiencies.
The desktop app on Windows is a sacrifice of security for convenience.
Signal should change this, but it’s typical of the traditional desktop OS security model in which applications running under the user’s account are considered trustworthy. Security-oriented software like Signal should take a more hardened approach, but this is not some glaring security hole.
With even email clients and web browsers running arbitrary and untrusted remote code on a regular basis, that model needs serious reconsideration.
This xkcd shouldn’t still be insightful. https://xkcd.com/1200/
Maybe its time to rethink desktop security. I realize that there is credential manager on windows, keychain on mac, and similar on gnu/linux; even with that it seems for a lot of services “all” you need to do is steal a cookie and all of a sudden you are someone else.
fuck no. It’s imbossible to be productive on an android or ios phone, where the os is hostile to you actually using it the way you want.
For an example of rethinking desktop security, see wayland in linux, and how ll accessibility programs now
don’tcannot possibly work.
End-to-end encryption stops being secure… at the end… Who would’ve thought
What a useless app decrypts messages on my own screen when I log in with my passwords & other protections/protocols just for me to read them?
No, ty, I’ll decrypt everything in my mind only, securely under a tinfoil protection device.
