Molly for Android: A fork of Signal for Android with passphrase lock
I&#x27;m super curious if someone can explain the threat model here in more detail. Some of these mitigations seem reasonable, some reasonable-but-very-esoteric, some mostly unreasonable. But maybe I am misunderstanding.<p>Going through the feature list:<p>&gt; Protects database with passphrase encryption<p>Modern Android supports FDE, so this seems like it&#x27;s no gain for most cases. For users who don&#x27;t have FDE, I guess it makes sense as long as you aren&#x27;t concerned about evil maid attacks?<p>(FWIW, Signal&#x27;s philosophy—here and on RAM protections—seems to be that this is the province of the host OS. I agree!)<p>&gt; Locks down the app automatically after you go a certain time without unlocking your device<p>I don&#x27;t know what this means—is it the below (i.e. purging decryption keys from RAM on inactivity) or something else?<p>&gt; Securely shreds sensitive data from RAM<p>The threat model here seems to be malicious code that can read the device&#x27;s RAM.<p>I think it&#x27;s best to leave these kinds of mitigations to the host OS (i.e., if there is malicious code that can read your RAM, you&#x27;re _probably_ SOL), but I guess there are probably some attacks (e.g. hardware or local-device attacks) that can dump RAM or something? What are common examples?<p>&gt; Allows you to delete contacts and stop sharing your profile
&gt; Clears call notifications together with expiring messages
&gt; Disables debug logs