News for hackers. Stuff that matters.
Re:Twilio incident: What Signal users need to know by awinter-py on Monday August 15, 2022 @05:53PM (#32475937)
the recommended fix here is to add a PIN + enable registration lock

IIRC signal PIN was very controversial back in the day because they were 1) forcing users to do it and 2) forcing them to opt in to some data collection as part of creating a PIN. Signal backed down on requiring a PIN, but now it's unclear from their settings page whether setting a PIN will share data as well. The marketing copy on my droid device says:

> PINs keep information stored with signal encrypted so only you can access it. your profile, settings and contacts will restore when you reinstall

For a company with relatively good cred, this is a shady way of saying 'we will upload your contacts and encrypt it with a short string'

Re:Twilio incident: What Signal users need to know by dvzk on Monday August 15, 2022 @10:10PM (#32478447)
From my 5-minute reading of the Signal source code it seems that disabling the PIN results in the generation of a random 256-bit master key for cloud storage encryption:

https://github.com/signalapp/Signal-iOS/blob/main/SignalServ...

The primary developer has stated previously that cloud storage is still used even with the PIN disabled:

https://community.signalusers.org/t/beta-feedback-for-the-up...

Re:Twilio incident: What Signal users need to know by uneventual on Monday August 15, 2022 @07:09PM (#32476741)
They do some monkey business with sgx to make brute forcing harder but yeah it's worrisome.

https://blog.cryptographyengineering.com/2020/07/10/a-few-th...

https://signal.org/blog/secure-value-recovery/