My signal app simply started crashing on my LineageOS powered phone. Pretty much at the same time the PIN update was rolled out. The app never starts, it always crashes on startup.
Signal PINs
161–170 of 199 posts
Re: Signal PINs
#162Earlier quoted context omitted.
> "don't ask me again, I won't lose this" This option should be labelled according to the reality rather than people's wishful thinking "Don't ask me again, when I lose this I am OK with losing the account and messages" There's probably a pithier way to express that we could get into the common lexicon as I foresee it being useful in many places. Maybe we can just label it "Yolo!" ?
I mean, for a start the messages are stored locally, it doesn't protect the messages server-side, because they are never stored on the server. All the pin does is keep the server-side data, i.e. your address book and conversation information, safe. Secondly, outside of encryption, it should not be Signal's job to enforce whether a logged-in user of a phone can see that user's content . It is the operating system's jo…
Well most mobiles don't offer multi user and phones are often loaned temporarily to other people. For example for kids to play on.
Re: Signal PINs
#163Earlier quoted context omitted.
Still stupid, shouldn't they ask if I want that functionality? Not like it's going to be hard to brute force a user's PIN. They should explain what the pins is BEFORE they ask. What it looks like is you are going to be locked out of signal if you make a mistake. Not like the average signal user is watching the whisper systems blog.
> Still stupid, shouldn't they ask if I want that functionality? It's kind of a difficult thing to ask. "Do you want this app to work like every other app in the world in the ways you've come to expect?" If people were to simply reinstall Signal and find that all of their contacts were gone, all of their groups were gone, all of their block lists were gone, etc... they'd almost certainly be surprised. It's not a beha…
I think calling it a PIN and asking for it so frequently is part of the problem. It certainly induces me to use a shorter one than I would otherwise like (since I keep having to enter it so often _right_ at the time I am trying to use the app).
Asking for it once at the time of a new registration, install, or a restore/reinstall would be far more preferable to me. Treating it more like a "filevault" key or an "encryption phrase/password", would certainly encourage me to use a much longer key and just put it into a password manager (and/or write it down and put it somewhere physically safe).
Re: Signal PINs
#164Sigh. What about fixing backups so that I don't need this? There is always something absolutely odd with Signal. The obtuse insistence in creating it's own vault makes it annoying to use to share media and to make backups. Down to the built-in unusable camera app. I have almost everything duplicated in/out of signal because of this. Huge space waste. What's the threat model? Under the assumption that I can root the p…
I just had to restore backups on my phone (previous got broken) and it's such a disaster of usability that it makes use of GPG easy.
1.) You only get to see the backup password ONCE. They create it for you, it's a giant bunch of numbers written in columns. They show you that the FIRST time you enable backups, which might be years away from the time you need them.
2.) After they dump the backup, they just throw it in a preset folder on Android flash. You need to find a way to get it off the device yourself (good luck if the device broke). No help with transferring to another device, no Android beam support, nothing.
3.) After you somehow manage to get the file to another device, there's no help at restoring it either. You need to put it EXACTLY in the right directory. They don't tell you which. Even after that, the app will not pick up the backup. There's no "Restore backup" button or option. You need to KNOW that you have to destroy all existing app settings by clearing data and then it'll attempt a restore.
4.) When it attempts to restore, it presents you an input field that's flat text entry and is NOT organized in original columns. You need to guess the order of columns in which you need to enter the 30+ digits. If you fail... well, try again!
5.) If you switch from iOS to Android then you're SOL because iOS people don't deserve to have their conversations preserved.
It feels like the authors of the app never had any meaningful conversations they'd like to remember in the future. It feels like the same mindset which made some security people implement nonsensical policies like "you need to change to a new 16 char password every week without duplication for a year" on Active Directory. A mind set which thinks that badgering you for PIN every week accomplishes anything but a wish to install WhatsApp. A mindset, which does significantly more harm to security than good. A mindset, which bogged proliferation of encrypted communication for years until corporations took it away. And that's sad.
Re: Signal PINs
#165Earlier quoted context omitted.
You can use a long alphanumeric string as your 'PIN', and on iOS at least, you can insert that PIN via a password manager.
Hmm, because they use the word PIN (personal identification number) I set a 6 number PIN, I feel a bit stupid about that now. But then this means that my messages are in another place than my phone? A bit unclear from what the app told me...
> But then this means that my messages are in another place than my phone?
No, only supporting data: "Your profile, settings, and contacts will restore when you reinstall Signal."
Re: Signal PINs
#166Earlier quoted context omitted.
You are the exception, the overwhelming majority of users don't use a password manager. I agree that an advanced option to disable PIN reminder prompts would be nice, but I understand and respect the Signal team for focusing on more important things. I can live with a 5 second prompt every 2 weeks.
You can respect Signal team, and still don't deny that this forced habit-building is UX anti-pattern. Which doesn't make sense anyway, because majority will not accept increased discomfort it creates, and minority which values security more do use pw managers.
Is it though? I use a password manager. I recently found out that I had saved the PIN for my Signal account into it, but since it was never integrated with Signal I immediately changed it when I needed Signal later and I even forgot I had set up a PIN.
Sure, that doesn't mean there is/was no better way to make this change. To provide more options for users, etc.
I'm simply saying that the PIN prompt worked for me over the last months (I successfully memorized it), and now with the new UI it prompted me to fill it with Keepass for Android. (And that's how I found the old PIN in Keepass.)
Re: Signal PINs
#167My signal app simply started crashing on my LineageOS powered phone. Pretty much at the same time the PIN update was rolled out. The app never starts, it always crashes on startup.
if you have the same issue waiting for signal 4.60. might be the way to go. Should be due to release soonish according to github issues.
Re: Signal PINs
#168Re: Signal PINs
#169Curious: So this PIN has to be stored on the Signal server?
Now lets assume most average (non-technical) users will simply type in/re-use their smartphone pin (most of the people i know will do this.)
Would this mean if there's a data breach in the 'Signal cloud', their Pins have now leaked onto the internet?
Doesn't seem like a great idea to store peoples Pin codes in a cloud... would probably be better if they'd just called it a 'Signal password'. People would not think about entering their smartphone PIN code that way.
Re: Signal PINs
#170Curious: So this PIN has to be stored on the Signal server? Now lets assume most average (non-technical) users will simply type in/re-use their smartphone pin (most of the people i know will do this.) Would this mean if there's a data breach in the 'Signal cloud', their Pins have now leaked onto the internet? Doesn't seem like a great idea to store peoples Pin codes in a cloud... would probably be better if they'd ju…
Read the article before commenting.