https://content.govdelivery.com/accounts/USDODDC3/bulletins/2e03518
Molly has at rest encryption with a password
This document is just using something that was a known issue with the desktop app of Signal for years. Doesn’t have any impact on Signal itself, or the mobile apps. Their position was essentially that the desktop filesystem should be encrypted and secured to be ACTUALLY secure. They fixed it after users got pissed off.
Here’s an article from 2018 about it: https://www.bleepingcomputer.com/news/security/signal-desktop-leaves-message-decryption-key-in-plain-sight/
Here’s an article after they fixed it: https://www.bleepingcomputer.com/news/security/signal-downplays-encryption-key-flaw-fixes-it-after-x-drama/
That is correct. However, I thought it was interesting