Signal PINs

#1

Post by aendruk » Tue, May 19, 2020, 8:23 PM UTC

Signal PINs
signal.org

Re: Signal PINs

#2

Post by aendruk » Tue, May 19, 2020, 8:32 PM UTC

Don't miss:

> PINs will also help facilitate new features like addressing that isn’t based exclusively on phone numbers

Re: Signal PINs

#3

Post by secfirstmd » Tue, May 19, 2020, 8:39 PM UTC

"As we move to support additional features the Signal community has asked for – like addressing that isn’t based on phone numbers"

This is awesome. So important for people at risk like the human rights defenders, journalists, legal, LGBTIQ people we work with. Great to see Signal looking at this.

Re: Signal PINs

#4

Post by LukeShu » Tue, May 19, 2020, 8:52 PM UTC

That's kinda weird timing. Signal's been asking me for a PIN for about 2 weeks now. Did Aurora screw up and give me an early version? Or did they just roll this out to users weeks ahead of publishing an announcement?

Re: Signal PINs

#5

Post by zeveb » Tue, May 19, 2020, 8:55 PM UTC

This really worries me: now the safety of my data hinges on Intel's remote attestation and a password I can remember.

Re: Signal PINs

#6

Post by s0ss » Tue, May 19, 2020, 8:57 PM UTC

This is all well and good. But the forced/unsilenceable pin reminders seems a bit obtuse to me.

https://support.signal.org/hc/en-us/articles/360007059792-Si...

"Can I turn off these reminders?

    It is important to memorize your PIN, and the reminders cannot be disabled. We cannot recover your PIN if you forget it.
    You will see the reminders less frequently if you consistently enter your PIN correctly. The reminders will become more frequent if multiple attempts are necessary."

Re: Signal PINs

#7

Post by MattGaiser » Tue, May 19, 2020, 8:58 PM UTC

zeveb wrote: post #5

This really worries me: now the safety of my data hinges on Intel's remote attestation and a password I can remember.

> and a password I can remember.

This is going to be the reality of any data system which you want to have complete control over. I suppose it could also be a complex key you instead keep on your drive, but that has risks as well.

Re: Signal PINs

#8

Post by AdmiralAsshat » Tue, May 19, 2020, 8:58 PM UTC

I've already got a passphrase on my Signal app. Why do I also need a PIN on top of that?

If it's supposed to be an easier alternative to a passphrase, then okay, but stop showing me the freaking notification to setup a PIN...

Re: Signal PINs

#9

Post by atestu » Tue, May 19, 2020, 8:59 PM UTC

s0ss wrote: post #6

This is all well and good. But the forced/unsilenceable pin reminders seems a bit obtuse to me. https://support.signal.org/hc/en-us/articles/360007059792-Si... "Can I turn off these reminders? It is important to memorize your PIN, and the reminders cannot be disabled. We cannot recover your PIN if you forget it. You will see the reminders less frequently if you consistently enter your PIN correctly. The reminders wil…

I agree. Shouldn't you put your PIN in a password manager anyway?

Why call it a PIN and not a password to begin with? Is there a difference I'm missing?

Re: Signal PINs

#10

Post by genpfault » Tue, May 19, 2020, 8:59 PM UTC

LukeShu wrote: post #4

That's kinda weird timing. Signal's been asking me for a PIN for about 2 weeks now. Did Aurora screw up and give me an early version? Or did they just roll this out to users weeks ahead of publishing an announcement?

> Signal's been asking me for a PIN for about 2 weeks now.

And my copy started preventing me from using it entirely yesterday with a full-screen un-dismissable popup[1] :(

[1]: https://i.redd.it/4sip5dcw9iy41.png [2]

[2]: https://www.reddit.com/r/signal/comments/giw4if/the_signal_p...