The desktop app can also securely store keys locally, not on the server.The installation package can be signed and verified with a certificate. The app is not browser-based and is instead installed.In summary, the QRLjacking exploit is mitigated by Signal in the following manner: I think the desktop synchronizes with mobile on-demand. I do not believe the server is used to retain messages at all.At any time the user can remove the linked device, which becomes immediately known to the desktop. On the mobile, the linked device now shows up.The desktop app sends this message to the mobile (encrypted, of course). The desktop app app asks the user to name this desktop app, typically this is the name of the host it is running on.The mobile app sends an encrypted confirmation message to the desktop app, which the desktop app verifies using it's private key.The mobile app uses the QR code to download the desktop app's public key.The user lifts up his mobile device and scans the QR code with the signal app.Send the public key to the server under a UUID key.

The desktop uses its own public key to check with the server if it is linked to mobile.

Upon installation, the desktop app generates the pre-keys and sends them to the server.

The installation package can be signed and verified to be trusted. This makes it difficult to use in social engineering techniques. First thing to note is that it is a JavaScript app packaged using electron.

The user can chat with other Signal users using the end to end encrypted protocol, but what is more interesting to me is how they prevent QR vulnerability when linking to desktop.

Luckily, the code is here: īased on my analysis, here is what I think they do:

I am trying to figure out what is the secret sauce the Signal applies. The interesting thing is that Signal app does not appear to be vulnerable to QRLjacking exploit, despite the fact that they too link the desktop to mobile via QR code. It is a social engineering exploit that isn’t much different from getting users to reveal their passwords. In my research I came across the QRLjacking exploit. The assumption is that the mobile app is secure and the desktop app simply needs to link the session to mobile for convenience. I am trying to implement linking of the desktop app to the mobile counterpart for my project.

Signal messenger on desktop