• 0xD@infosec.pub
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    3
    ·
    2 months ago

    That doesn’t really do anything. Attackers need local access to the device to get the database itself. Chances are, they’ll get the key right with it.

    • HappyTimeHarry@lemm.ee
      link
      fedilink
      English
      arrow-up
      7
      ·
      2 months ago

      Molly encrypts it using a passphrase instead of a locally stored key for exactly that reason.

      • 0xD@infosec.pub
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        The passphrase or the unencrypted database are still open in memory. Though that is, of course, a more complicated attack but they could simply read it through the app itself.

        • HappyTimeHarry@lemm.ee
          link
          fedilink
          English
          arrow-up
          2
          ·
          2 months ago

          You can set it to wipe them from memory on different conditions, including instantly if youre that paranoid, sure its still possible. Its an optional feature most people wont use, but its pretty well thought out.