News for hackers. Stuff that matters.
Re:Signal PINs by aendruk on Tuesday May 19, 2020 @04:32PM (#23239826)
Don't miss:

> PINs will also help facilitate new features like addressing that isn’t based exclusively on phone numbers

Re:Signal PINs by ojizero on Tuesday May 19, 2020 @05:54PM (#23240750)
I dunno but for example Wire does implement addressing without giving phone number optionally if you sign in with an email and a password, which makes me less convinced of the necessity of forced PINs in this style to enable such cases (which should be optional in the first place). Same thing with syncing across devices which requires you opt in to add email/password combo to enable those features.
Re:Signal PINs by moxie on Tuesday May 19, 2020 @08:27PM (#23242015)
They store your social graph in plaintext on their servers.
Re:Signal PINs by ojizero on Wednesday May 20, 2020 @06:13AM (#23245156)
The point I was trying to make was more on how Wire made the whole password situation optional, I am aware of the conversation name and creation date being stored but that's an issue depending on the threat model for each user.

The main issue I see is with the intrusiveness of how Signal PINs are handled by the UI, this will only work to alienate users or encourage writing simple PINs that make them weak to use! It would've been much better had it been treated as a fully opt in feature and PINs treated more as passwords, without the constant bombardment of reminders to input it.

This can be placed behind a "sync" option for example and enabling it opens a dialogue explaining the need for password, from there it's up to the user to enable sync and in doing so they have to set a password like normal services.

That's just my 2 cents ¯\_(ツ)_/¯

Re:Signal PINs by ohhnoodont on Tuesday May 19, 2020 @05:00PM (#23240138)
Does this mean we will finally be able to use Signal without a phone number?
Re:Signal PINs by sneak on Tuesday May 19, 2020 @05:11PM (#23240244)
They’ve been planning that for a long while. It requires first an e2e sync though, for contact lists, which is what the clientside secret (PIN) enables.