Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal PINs

signal.org

Post reply on HN
Print view View original

151–160 of 199 posts

Re: Signal PINs

#151

Post by fidelramos »

tfehring wrote: post #148
moxie wrote: post #112

Earlier quoted context omitted.

Right now if you re-install Signal on your device, you lose all your messages. That's already a very bad user experience, but imagine how much worse it would be if you lost your entire address book in that moment as well. Right now that's not a problem because your social graph is in the address book on your phone, and isn't managed by Signal. This is one of the primary reasons that Signal uses phone numbers for addr…

I can see why the ability to store a social graph and other metadata on Signal's servers would be a useful feature for users who don't want to tie their Signal data to their phone number and/or a plaintext social graph, and it would make sense to give users the opportunity to opt into that functionality. But for those of us whose social graph is our phone's contact list, having it forced upon us is a significant step…

I think you are overreacting. Other, more popular messaging apps, also have prompts and yet they are used by hundreds of million of people.

In my opinion as power users we forget what regular users want and need, and are not willing to give up a little of what we like. But think of the benefits (phoneless sign ups and much much better private groups, to begin with) and tell me they don't outweigh the cons (a PIN prompt once every 2 weeks, in the marginal case).

Re: Signal PINs

#152

Post by thekyle »

KCUOJJQJ wrote: post #96
dessant wrote: post #66

Earlier quoted context omitted.

I think they've messed up badly with this update. I have several friends who want to get rid of Signal because they could not access their messages until they've set up a PIN. Imagine needing to configure and remember a PIN on the spot when you need to urgently read your messages.

Can the pin be 1111? I use a similar pin for the app Threema. Better than nothing I guess and easy to remember. (Also, after restarting the device I have to enter a complicated password.) Edit: Now I see. Signal wants to save data in the cloud. My Threema PIN is just for my device.

I don't think so. They blocked common pins like 1234, 1111, 0000, etc.

Re: Signal PINs

#153

Post by RedComet »

fidelramos wrote: post #150
CraftThatBlock wrote: post #94

Earlier quoted context omitted.

I don't need a habit, I have a password manager.

You are the exception, the overwhelming majority of users don't use a password manager. I agree that an advanced option to disable PIN reminder prompts would be nice, but I understand and respect the Signal team for focusing on more important things. I can live with a 5 second prompt every 2 weeks.

The overwhelming majority of users don't use Signal, either.

Re: Signal PINs

#154

Post by apayan »

moxie wrote: post #112
ludocode wrote: post #15

I'm extremely disappointed about how this Signal PIN rollout has been handled. Signal refused to let me view my received messages until I created a PIN. I filed a bug report about it [1]. I don't know if I was just caught in an A/B test or what because it hasn't happened to all of my Signal-using friends but it happened to me. I don't understand why it isn't just optional. They claim they want to protect my Signal da…

Right now if you re-install Signal on your device, you lose all your messages. That's already a very bad user experience, but imagine how much worse it would be if you lost your entire address book in that moment as well. Right now that's not a problem because your social graph is in the address book on your phone, and isn't managed by Signal. This is one of the primary reasons that Signal uses phone numbers for addr…

moxie, I want to thank you and the entire team at Signal for all that you're doing to further e2e crypto and making mass surveillance more difficult for nefarious actors around the world. You're making everyone's communications safer.

Re: Signal PINs

#155

Post by sliken »

moxie wrote: post #112
ludocode wrote: post #15

I'm extremely disappointed about how this Signal PIN rollout has been handled. Signal refused to let me view my received messages until I created a PIN. I filed a bug report about it [1]. I don't know if I was just caught in an A/B test or what because it hasn't happened to all of my Signal-using friends but it happened to me. I don't understand why it isn't just optional. They claim they want to protect my Signal da…

Right now if you re-install Signal on your device, you lose all your messages. That's already a very bad user experience, but imagine how much worse it would be if you lost your entire address book in that moment as well. Right now that's not a problem because your social graph is in the address book on your phone, and isn't managed by Signal. This is one of the primary reasons that Signal uses phone numbers for addr…

Currently signal is asking for a pin periodically to allow migration to a new device every few years when a user gets a new phone.

Instead of typing in a pin few days/weeks for years, why not just have an export feature that users can select. Have users fill out an encryption key, then 1 minute later when they grab their new phone they can type it in again.

Ideally this would work from the desktop client, a tablet client, and phone clients. So if my device dies, is stolen, or sold I can restore my history from any other signal client I run.

Or maybe use the IOS approach which allows users to cloud sync to keep history (if they want), or to turn it off, which is less convenient, but more secure.

Either approach would save 10s or 100s of pin entries, and still provide a good user experience when switching phones.

Re: Signal PINs

#156

Post by renewiltord »

I use both Signal and WhatsApp. Honestly, only use the former to communicate with my friends who insist on using Signal. Found this PIN nonsense annoying but who really cares. Ultimately, I have to contact these friends so I'll jump through their hoops till the hoops make my friends leave.

Re: Signal PINs

#157

Post by barbegal »

sturmeh wrote: post #138
ccktlmazeltov wrote: post #103

Earlier quoted context omitted.

I actually like that it forces you to remember the PIN.

That's lovely, but once you've remembered it? I'm never going to forget my mobile number, I don't need to keep calling myself to remember it.

But the reason you don't forget it is probably because you recall it all the time. You definitely recall your phone number for purposes other than calling yourself.

This has given me a good idea for a study: find people who have changed phone numbers and see how many of those people can remember them. Then plot the data by the last time they used that number.

Re: Signal PINs

#158

Post by bsdubernerd »

Sigh. What about fixing backups so that I don't need this?

There is always something absolutely odd with Signal. The obtuse insistence in creating it's own vault makes it annoying to use to share media and to make backups. Down to the built-in unusable camera app. I have almost everything duplicated in/out of signal because of this. Huge space waste. What's the threat model? Under the assumption that I can root the phone this is pointless. But if I trust the sandbox it's also pointless. Anonymizing file metadata in/out would have been more pragmatic, but pragmatism here is frowned upon.

Remote contact discovery: technically impressive. I would have gladly opted out though to remain anonymous to some contacts that have my number. Yeah, that's the real "privacy" bit which is worth 10 times this PIN debacle.

I'm still bound to use a phone number which I _don't_ really care about even just to use the desktop version (ahaha, desktop, yeah.. cough).

When I saw the PIN prompt for the first time I realized the money injection was giving its first fruits. I gave matrix a first good try. Finally I can choose from a plethora of clients, run my own server if needed.

The setup though is still not dumb-proof as signal (which is why I tolerated all the issues with signal so far), and the phone clients I've tried are not as polished.

That being said, when I mentioned PINs I managed to convert most my tech contacts to matrix within a week. The real question is whether the other ones will stay, jump over, or just go back to whatsapp (which they never removed).

Re: Signal PINs

#159

Post by genpfault »

thekyle wrote: post #152
KCUOJJQJ wrote: post #96

Earlier quoted context omitted.

Can the pin be 1111? I use a similar pin for the app Threema. Better than nothing I guess and easy to remember. (Also, after restarting the device I have to enter a complicated password.) Edit: Now I see. Signal wants to save data in the cloud. My Threema PIN is just for my device.

I don't think so. They blocked common pins like 1234, 1111, 0000, etc.

Alphanumeric PINs are all valid though, such as 'OOOO'.

Re: Signal PINs

#160

Post by brokenkebab »

fidelramos wrote: post #150
CraftThatBlock wrote: post #94

Earlier quoted context omitted.

I don't need a habit, I have a password manager.

You are the exception, the overwhelming majority of users don't use a password manager. I agree that an advanced option to disable PIN reminder prompts would be nice, but I understand and respect the Signal team for focusing on more important things. I can live with a 5 second prompt every 2 weeks.

You can respect Signal team, and still don't deny that this forced habit-building is UX anti-pattern. Which doesn't make sense anyway, because majority will not accept increased discomfort it creates, and minority which values security more do use pw managers.
Post reply on HN