search

zoom / zoom-e2e-whitepaper

Zoom Cryptography Whitepaper
Other
549 stars 36 forks source link

Local key security that don't have hardware based keychain #42

Closed kiranszone closed 4 years ago

kiranszone commented 4 years ago

How are you planning to handle devices that don't have hardware based key chains, but only depend software based keychains ? There are certain Android devices and Windows systems that store keys on the file system.

maxtaco commented 4 years ago

Store the key on the regular file system then.

kiranszone commented 4 years ago

regular file system is not secure.

maxtaco commented 4 years ago

I understand, but what can you do? Not allow E2E on the device? I think we need to do the best we can.

kiranszone commented 4 years ago

you can provide additional options to secure it. I have seen apps using pbkdf2 for providing additional security.

kiranszone commented 4 years ago

I know it's not great user experience to enter additional password or reuse password. it provides an option for the end client to protect. I have seen lots of mobile malwares targeting keys that are on the file systems.