News for hackers. Stuff that matters.
Re:Signal PINs by saurik on Tuesday May 19, 2020 @05:25PM (#23240435)
The PIN is a very short key, so the only real protection is that Intel SGX (which notably gets broken every year, and so this doesn't actually work) is preventing people from getting access to the encrypted data to brute force the key; the enclave then enforces some limit on the number of attempts (and maybe some rate limit on the speed of attempts).
Re:Signal PINs by RL_Quine on Tuesday May 19, 2020 @05:27PM (#23240462)
The client allows them to be alphanumeric, but the default is 4 numbers. The irritating behaviour of repeatedly asking for it to be entered at awkward times means people will just set it to 1337 and call it a day.
Re:Signal PINs by mos_basik on Tuesday May 19, 2020 @06:45PM (#23241199)
I haven't even opened Signal since hearing about this update, so I don't know how irritating the prompts are, but I did see this in the blog:

>Because Signal doesn’t have access to your keys – or your data – your PIN isn’t recoverable if you forget it, so our apps help you remember your PIN with periodic reminders. Don’t worry, these reminders get less frequent over time.

Having read that, I doubt I'll get too irritated at the reminders and eventually they'll go away. You have a point that anyone who hasn't read the update blog will have no similar hope and might use something easy. I guess I'd hope the Signal user base is more security conscious than that. For instance, I know my PIN is going to be alphanumeric and immediately stored my password database.

Re:Signal PINs by novok on Tuesday May 19, 2020 @06:49PM (#23241235)
You can fill it in with your password manager at every prompt?

There is a large segment of people who don't like complicated passwords and will not use a password manager, so the PIN scheme w/ advanced options and password manager integration is the way to thread that needle.

Re:Signal PINs by Skunkleton on Tuesday May 19, 2020 @06:43PM (#23241184)
I used my debit card PIN, so I should be fine right?
Re:Signal PINs by jacobush on Tuesday May 19, 2020 @07:18PM (#23241475)
Bank level encryption. Yep, fine.