Comment by anigbrowl
8 months ago
It's not that secure. If someone has a desktop signal client it has been possible to just access attachments via the file system; they were stored with obfuscated names but no encryption. They may have fixed this since I tested it ~6 months ago.
On desktop you can just read process memory and extract all the keys and tokens.