6 ms·

This is all well and good. But the forced/unsilenceable pin reminders seems a bit obtuse to me. https://support.signal.org/hc/en-us/articles/360007059792-Sign

by s0ss 6y ago

This is all well and good. But the forced/unsilenceable pin reminders seems a bit obtuse to me. https://support.signal.org/hc/en-us/articles/360007059792-Signal-PINs https://support.signal.org/hc/en-us/articles/360007059792-Si... "Can I turn off these reminders? It is important to memorize your PIN, and the reminders cannot be disabled. We cannot recover your PIN if you forget it. You will see the reminders less frequently if you consistently enter your PIN correctly. The reminders will become more frequent if multiple attempts are necessary."

atestu 6y ago
I agree. Shouldn't you put your PIN in a password manager anyway? Why call it a PIN and not a password to begin with? Is there a difference I'm missing?
- toomuchtodo 6y ago
  Same reason iPhones support PINs. It’s easier for the user, and provides some level of protection versus nothing. If it’s not user friendly, the user will defer to convenience over security. Signal PINs do support alphanumeric strings FYI. If you have a password manager, use a string. If not, a PIN works just fine.
  - emerongi 6y ago
    It seems alphanumeric PINs are allowed now. At least on iOS, I do get the option to change the PIN to an alphanumeric one. The whole PIN thing has changed quite a bit in the past 6 months or so.
- j-james 6y ago
  My understanding is it's designed around making short passwords more secure by trying to limit brute force attacks. Seems interesting. https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
- novok 6y ago
  You can use a long alphanumeric string as your 'PIN', and on iOS at least, you can insert that PIN via a password manager.
  - teekert 6y ago
    Hmm, because they use the word PIN (personal identification number) I set a 6 number PIN, I feel a bit stupid about that now. But then this means that my messages are in another place than my phone? A bit unclear from what the app told me...
    - DavideNL 6y ago
      > But then this means that my messages are in another place than my phone? No, only supporting data: "Your profile, settings, and contacts will restore when you reinstall Signal."
- tialaramex 6y ago
  Newer products seem to be tending to label something a PIN if it isn't stored by a third party, because this means it can't get stolen, and as a result it's safe to choose relatively weak human memorable secrets that would be unsuitable as a traditional "password" that we're all using password managers to store instead. For example a Yubico Security Key can use a PIN. So I could use that as second factor for my Facebook. No matter how lazy, incompetent or even malevolent Facebook is, they never see that PIN, they just get a bitflag in which the Security Key promises it confirmed my identity before authenticating. If they insisted and I allowed them to, they could verify it's a real Yubico brand product (in reality Facebook don't do that) and maybe trust the bitflag on that basis, but even then they aren't learning what PIN I set, how long it is, anything useful. You probably don't want to store such PINs in a Password Manager, although it's unlikely to be a big security problem to do so, they are intended to be human memorable unlike a "good" modern password.
CraftThatBlock 6y ago
I know my PIN yet it asks me everytime I open the app. It's extremely annoying. I wouldn't mind once a month, but it seems like it's 1 a week (which doesn't seem true, I feel like it's more every 2-3 days for me). I just wish there was an option to ask less frequently.
- deleted 6y ago
  [deleted]
- pas 6y ago
  It asks you to make it a habit. > I just wish there was an option to ask less frequently. It asks you when you open Signal until you lock it again, no? (At least on Android.)
  - CraftThatBlock 6y ago
    I don't need a habit, I have a password manager.
    - fidelramos 6y ago
      You are the exception, the overwhelming majority of users don't use a password manager. I agree that an advanced option to disable PIN reminder prompts would be nice, but I understand and respect the Signal team for focusing on more important things. I can live with a 5 second prompt every 2 weeks.
      - RedComet 6y ago
        The overwhelming majority of users don't use Signal, either.
        fidelramos 6y ago
        Of course, no argument there. A lot of those people are missing some features, like proper group management. Before it was stickers, GIFs, video calls, etc. Some people always find something lacking, it's just an excuse. But for other people they are real concerns. Signal's challenge is to build features that other apps already have but in a way that respects their users' privacy. They make their share of mistakes but I'm deeply grateful for what they do and try not to lose sight of the important stuff.
ccktlmazeltov 6y ago
I actually like that it forces you to remember the PIN.
- sturmeh 6y ago
  That's lovely, but once you've remembered it? I'm never going to forget my mobile number, I don't need to keep calling myself to remember it.
  - barbegal 6y ago
    But the reason you don't forget it is probably because you recall it all the time. You definitely recall your phone number for purposes other than calling yourself. This has given me a good idea for a study: find people who have changed phone numbers and see how many of those people can remember them. Then plot the data by the last time they used that number.
    - mcny 6y ago
      Anecdotal but I for one have been using grand Central/Google voice as the number I share with others since about 2008 and I don't remember any of the numbers I've used for the actual cellular carrier.
quit32 6y ago
It is beyond comprehension that they think pin reminders being mandatory is ok. I have been a huge fan of signal from the beginning and this is single handily a deal breaker and has me looking for alternatives. How did they not learn from this when they tried it with the activation lock.
- elric 6y ago
  Indeed. It's stupid. And it's very much scaring off their less technical users. My aunt is nearly 80, she's been using signal for years, and the other day she sent me a very confused message about the PIN. She doesn't understand why it's suddenly there, and she doesn't want it there. Neither do I. And there's no way to turn it off? I won't be recommending signal anymore. It used to be a mostly secure drop-in replacement for the default SMS app, and it was truly stellar at that. But if it's going to become a pain to use, what's the point?
- rkagerer 6y ago
  Is there a reason more people don't use Wire? Its interface annoys me but I was under the impression it's E2E is pretty good and the source code is publicly available?

by s0ss 6y ago

atestu 6y ago

I agree. Shouldn't you put your PIN in a password manager anyway? Why call it a PIN and not a password to begin with? Is there a difference I'm missing?

toomuchtodo 6y ago
Same reason iPhones support PINs. It’s easier for the user, and provides some level of protection versus nothing. If it’s not user friendly, the user will defer to convenience over security. Signal PINs do support alphanumeric strings FYI. If you have a password manager, use a string. If not, a PIN works just fine.
- emerongi 6y ago
  It seems alphanumeric PINs are allowed now. At least on iOS, I do get the option to change the PIN to an alphanumeric one. The whole PIN thing has changed quite a bit in the past 6 months or so.
j-james 6y ago
My understanding is it's designed around making short passwords more secure by trying to limit brute force attacks. Seems interesting. https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
novok 6y ago
You can use a long alphanumeric string as your 'PIN', and on iOS at least, you can insert that PIN via a password manager.
- teekert 6y ago
  Hmm, because they use the word PIN (personal identification number) I set a 6 number PIN, I feel a bit stupid about that now. But then this means that my messages are in another place than my phone? A bit unclear from what the app told me...
  - DavideNL 6y ago
    > But then this means that my messages are in another place than my phone? No, only supporting data: "Your profile, settings, and contacts will restore when you reinstall Signal."
tialaramex 6y ago
Newer products seem to be tending to label something a PIN if it isn't stored by a third party, because this means it can't get stolen, and as a result it's safe to choose relatively weak human memorable secrets that would be unsuitable as a traditional "password" that we're all using password managers to store instead. For example a Yubico Security Key can use a PIN. So I could use that as second factor for my Facebook. No matter how lazy, incompetent or even malevolent Facebook is, they never see that PIN, they just get a bitflag in which the Security Key promises it confirmed my identity before authenticating. If they insisted and I allowed them to, they could verify it's a real Yubico brand product (in reality Facebook don't do that) and maybe trust the bitflag on that basis, but even then they aren't learning what PIN I set, how long it is, anything useful. You probably don't want to store such PINs in a Password Manager, although it's unlikely to be a big security problem to do so, they are intended to be human memorable unlike a "good" modern password.

CraftThatBlock 6y ago

I know my PIN yet it asks me everytime I open the app. It's extremely annoying. I wouldn't mind once a month, but it seems like it's 1 a week (which doesn't seem true, I feel like it's more every 2-3 days for me). I just wish there was an option to ask less frequently.

deleted 6y ago
[deleted]
pas 6y ago
It asks you to make it a habit. > I just wish there was an option to ask less frequently. It asks you when you open Signal until you lock it again, no? (At least on Android.)
- CraftThatBlock 6y ago
  I don't need a habit, I have a password manager.
  - fidelramos 6y ago
    You are the exception, the overwhelming majority of users don't use a password manager. I agree that an advanced option to disable PIN reminder prompts would be nice, but I understand and respect the Signal team for focusing on more important things. I can live with a 5 second prompt every 2 weeks.
    - RedComet 6y ago
      The overwhelming majority of users don't use Signal, either.
      - fidelramos 6y ago
        Of course, no argument there. A lot of those people are missing some features, like proper group management. Before it was stickers, GIFs, video calls, etc. Some people always find something lacking, it's just an excuse. But for other people they are real concerns. Signal's challenge is to build features that other apps already have but in a way that respects their users' privacy. They make their share of mistakes but I'm deeply grateful for what they do and try not to lose sight of the important stuff.

ccktlmazeltov 6y ago

I actually like that it forces you to remember the PIN.

sturmeh 6y ago
That's lovely, but once you've remembered it? I'm never going to forget my mobile number, I don't need to keep calling myself to remember it.
- barbegal 6y ago
  But the reason you don't forget it is probably because you recall it all the time. You definitely recall your phone number for purposes other than calling yourself. This has given me a good idea for a study: find people who have changed phone numbers and see how many of those people can remember them. Then plot the data by the last time they used that number.
  - mcny 6y ago
    Anecdotal but I for one have been using grand Central/Google voice as the number I share with others since about 2008 and I don't remember any of the numbers I've used for the actual cellular carrier.

quit32 6y ago

It is beyond comprehension that they think pin reminders being mandatory is ok. I have been a huge fan of signal from the beginning and this is single handily a deal breaker and has me looking for alternatives. How did they not learn from this when they tried it with the activation lock.

elric 6y ago
Indeed. It's stupid. And it's very much scaring off their less technical users. My aunt is nearly 80, she's been using signal for years, and the other day she sent me a very confused message about the PIN. She doesn't understand why it's suddenly there, and she doesn't want it there. Neither do I. And there's no way to turn it off? I won't be recommending signal anymore. It used to be a mostly secure drop-in replacement for the default SMS app, and it was truly stellar at that. But if it's going to become a pain to use, what's the point?
rkagerer 6y ago
Is there a reason more people don't use Wire? Its interface annoys me but I was under the impression it's E2E is pretty good and the source code is publicly available?