3 ms·

Don't miss: > PINs will also help facilitate new features like addressing that isn’t based exclusively on phone numbers

• ohhnoodont 6y ago
  Does this mean we will finally be able to use Signal without a phone number?
  • sneak 6y ago
    They’ve been planning that for a long while. It requires first an e2e sync though, for contact lists, which is what the clientside secret (PIN) enables.
• ojizero 6y ago
  I dunno but for example Wire does implement addressing without giving phone number optionally if you sign in with an email and a password, which makes me less convinced of the necessity of forced PINs in this style to enable such cases (which should be optional in the first place). Same thing with syncing across devices which requires you opt in to add email/password combo to enable those features.
  • moxie 6y ago
    They store your social graph in plaintext on their servers.
    • ojizero 6y ago
      The point I was trying to make was more on how Wire made the whole password situation optional, I am aware of the conversation name and creation date being stored but that's an issue depending on the threat model for each user. The main issue I see is with the intrusiveness of how Signal PINs are handled by the UI, this will only work to alienate users or encourage writing simple PINs that make them weak to use! It would've been much better had it been treated as a fully opt in feature and PINs treated more as passwords, without the constant bombardment of reminders to input it. This can be placed behind a "sync" option for example and enabling it opens a dialogue explaining the need for password, from there it's up to the user to enable sync and in doing so they have to set a password like normal services. That's just my 2 cents ¯\_(ツ)_/¯