Signal is finally bringing its secure messaging to the masses

Re:Signal is finally bringing its secure messaging to the ma... by tialaramex on Friday February 14, 2020 @02:15PM (#22329367)

If you have and use Signal you can tell it not to let somebody else hijack Signal along with your phone number. You set a PIN, and then it pesters you for the PIN periodically to check you didn't go "Oh I'll just type some random digits and then moan later when I'm locked out, that'll be fine".

So long as you keep entering the correct PIN periodically, Signal won't let anybody register with your phone number without knowing the PIN you've shown you remember.

If you quit using Signal, after a while there haven't been any correct PIN entries for too long and anyone can claim that phone number again (and if they want, set a new PIN).

[ Parent | on HN ]

Re:Signal is finally bringing its secure messaging to the ma... by elagost on Friday February 14, 2020 @03:39PM (#22330164)

Anecdata: just set my mom's new iPhone up today, and re-registering Signal required she set up the registration lock PIN. I don't personally use that feature yet but interesting that it was mandatory.

[ Parent | on HN ]

Re:Signal is finally bringing its secure messaging to the ma... by interestica on Friday February 14, 2020 @03:03PM (#22329845)

That introduces the problem of someone getting a new phone number. If the previous user had it tied to pin+signal it means that the number is essentially blacklisted.

[ Parent | on HN ]

Re:Signal is finally bringing its secure messaging to the ma... by tialaramex on Friday February 14, 2020 @03:13PM (#22329926)

If you get a new phone number the week after a prolific phone user lost it, I'm guessing that would be super annoying already?

"Hello? No, this isn't Dave, he got a different number. No I don't know what it is. No this isn't a prank, please stop calling"

As a result I would imagine that unless the network is absolutely clean out of numbers (which they try hard to avoid) it will just never reuse numbers in such a short period. The only way somebody else has the number while the PIN is valid is that they're attacking you, which a PIN blocks.

So my guess would be that this ends up not being a problem in reality, it worried me right up until I read the expiry mechanism and then I went oh, that makes sense.

[ Parent | on HN ]

Re:Signal is finally bringing its secure messaging to the ma... by interestica on Friday February 14, 2020 @06:42PM (#22331592)

Ha! True. Well, a less prolific number may not get all the calls.

I've seen first hand how numbers can be reused fairly quickly (months). (This was in the Caribbean).

A 7 day pin expiry? I need to look at more details here because I can definitely go 7 days without using my phone. Or, I've travelled abroad and used a local SIM while my "home sim" was never in use for the duration of the stay. (But I kept the ID number on whatsapp/signal/telegram).

[ Parent | on HN ]

Re:Signal is finally bringing its secure messaging to the ma... by JeremyNT on Friday February 14, 2020 @03:13PM (#22329916)

The PIN lock expires after 7 days unless you re-auth, so this is only a temporary inconvenience.

[ Parent | on HN ]