I'm not claiming some grand level of knowledge here. I also cannot enumerate all risks. The difference is that I know that I don't know, and the danger that poses towards cognitive biases when it comes to false confidence, and a lack of effective risk management. I'm a professional an adjacent field, mid way into pivoting into cybersecurity, I used to think the same way, that's why I'm so passionate here. It's painful to see arguments and thought processes counter to the fundamentals of security & safety that I've been learning the past few years. So, yeah, I'm gonna call it out and try and inform.

All that crap said:

And you are right, the problem gets moved. However, that's the point, that's how standardization works, and how it's supposed to work. It's a force multiplier, it smooths out the implementation. Moving the problem to the OS level means that EVERYONE benefits from advanced in Windows/Macos/Linux. Automatically.

It's not signal's responsibility, it shouldn't be unless that's a problem they specifically aim to solve. They have the tools available to them already, electron has a standardized API for this, secureStorage. Which handles the OS interop for them.

I'm not arguing that signal needs to roll their own here. The expectation is that they, at least, utilize the OS provided features made available to their software.