5

This is about saving images sent through the Signal messaging app. I'm using latest iOS, but answers for Android users also welcome.

I have images created and sent via encrypted chat. I will put them in an encrypted container on my Macbook, but need an unexposed way to transfer them.

They aren't in the global gallery of my iPhone and I don't want them to be, to avoid any situation where they might be synced into iCloud. So I can't use the "Save" contextual menu on the image, and need to avoid iCloud sync and Dropbox.

What is the best path to get these images onto my Macbook without exposing them to a cloud system?

The app has a sharing feature you can use on images, that brings up the global dialog. Is there an obvious app that I can send the images to that will be accessible from macOS?

Thanks, figured this was a need many people would have when using Signal on a phone that otherwise isn't set up for extreme privacy (i.e. never enabling iCloud photo sync at all)

| improve this question | | | | |
  • Have you tried the Signal Desktop Client? I think it may solve your problem. – MiaoHatola Mar 22 '17 at 7:10
  • Thank you! Why not have this as an answer? I didn't realize this was possible but it works great as long as I've signed into the Chrome app BEFORE sending the images (since it can't see history). Will use this from now on, but keep my answer for anyone in a situation where they want to transfer to a laptop that isn't signed into desktop client yet. – jerclarke Mar 22 '17 at 14:58
  • I don't feel comfortable answering without trying the answer first :) – MiaoHatola Mar 22 '17 at 15:03
  • Great, added a second answer (first was about AirDrop) with desktop client as the solution for any photos taken after it is set up. – jerclarke Mar 22 '17 at 15:06
2

As @MiaoHatola pointed out in a comment, the obvious solution is to use the Signal Desktop Client (Chrome App) which allows you to be signed in and receive messages simultaneously on your phone and laptop.

If you have set up the desktop client as a second device (scanning QR code to set up keys) then you'll be able to see all images sent to your phone from there. When you click on an image, there is a download button and it lets you choose the location, which is ideal as you can send the image directly to an encrypted container.

Note that the other solution employing AirDrop is still needed in several common scenarios:

  • Desktop client was not been set up yet when images were sent, so AirDrop is needed to retrieve such older content.
  • Desktop client is undesirable for any reason (shared laptop, insufficiently trusted system etc.)

Using the desktop client has several important benefits:

  • Target location can be controlled so the file never sits unencrypted on disk.
  • No need to set up iOS/iCloud to enable AirDrop.
  • Obviously works with Android/Windows unlike AirDrop which requires a full Apple/macOS/iOS workflow.
| improve this answer | | | | |
0

So far, the best solution (IF you didn't have the Desktop Client set up before the image was sent, and thus you can't get it that way) seems to be Airdrop. If both your iOS and macOS are up to date as of 2017 this is possible.

In Signal

  • Open the image.
  • Hold on the image to show contextual menu.
  • Select "Share".
  • In the modal that comes up there is an AirDrop section at the top.
  • If both your phone and laptop are set up for AirDrop you will see yourself in the AirDrop section.
  • Click your avatar to send the image.
  • Notification appears on your laptop.
  • Image is in ~/Downloads/

This seems like a relatively secure method and AFAIK AirDrop sends the file without passing through external servers (it requires both Bluetooth and WiFi to function).

You will want to move the image into a secure container ASAP of course, and disable Time Machine beforehand to avoid the images in ~/Downloads/ from being copied into backups.

Unfortunately there doesn't seem to be a setting for AirDrop's target location, otherwise the procedure would be to open your secure container, set the AirDrop location to it, perform AirDrop from Signal, reset target of AirDrop and close the encrypted container.

| improve this answer | | | | |
-2

In the most recent wikileaks dump, it was confirmed that signal was compromised and unreliable

http://www.slate.com/blogs/future_tense/2017/03/08/wikileaks_says_the_cia_can_bypass_signal_what_does_that_mean.html

so however you want i guess

| improve this answer | | | | |
  • 5
    From the link you provided: "The CIA/WikiLeaks story today is about getting malware onto phones, none of the exploits are in Signal or break Signal Protocol encryption. The story isn't about Signal or WhatsApp...". Also, when providing links, please try to add the relevant text from the link in your answer, in case the link is broken. – MiaoHatola Mar 22 '17 at 6:47
  • 1
    ^ agree. Unhelpful FUD is how I'd describe this reply. Lets assume I have a non-rooted phone and have some perspective about what an app like Signal can conceivably offer. Same goes for whatever other app might be a part of the solution (though a FOSS app like Signal with scrutiny of backdoors would be preferable). – jerclarke Mar 22 '17 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.