A mistake in the process used by the Signal Desktop application to encrypt locally stored messages leaves them wide open to an attacker.

Researchers have developed a proof-of-concept side-channel attack that allows them to pull encryption keys from a single decryption for a modern version of OpenSSL.