3 ms·

I agree. Shouldn't you put your PIN in a password manager anyway? Why call it a PIN and not a password to begin with? Is there a difference I'm missing?

by atestu 6y ago

toomuchtodo 6y ago
Same reason iPhones support PINs. It’s easier for the user, and provides some level of protection versus nothing. If it’s not user friendly, the user will defer to convenience over security. Signal PINs do support alphanumeric strings FYI. If you have a password manager, use a string. If not, a PIN works just fine.
- emerongi 6y ago
  It seems alphanumeric PINs are allowed now. At least on iOS, I do get the option to change the PIN to an alphanumeric one. The whole PIN thing has changed quite a bit in the past 6 months or so.
j-james 6y ago
My understanding is it's designed around making short passwords more secure by trying to limit brute force attacks. Seems interesting. https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/
novok 6y ago
You can use a long alphanumeric string as your 'PIN', and on iOS at least, you can insert that PIN via a password manager.
- teekert 6y ago
  Hmm, because they use the word PIN (personal identification number) I set a 6 number PIN, I feel a bit stupid about that now. But then this means that my messages are in another place than my phone? A bit unclear from what the app told me...
  - DavideNL 6y ago
    > But then this means that my messages are in another place than my phone? No, only supporting data: "Your profile, settings, and contacts will restore when you reinstall Signal."
tialaramex 6y ago
Newer products seem to be tending to label something a PIN if it isn't stored by a third party, because this means it can't get stolen, and as a result it's safe to choose relatively weak human memorable secrets that would be unsuitable as a traditional "password" that we're all using password managers to store instead. For example a Yubico Security Key can use a PIN. So I could use that as second factor for my Facebook. No matter how lazy, incompetent or even malevolent Facebook is, they never see that PIN, they just get a bitflag in which the Security Key promises it confirmed my identity before authenticating. If they insisted and I allowed them to, they could verify it's a real Yubico brand product (in reality Facebook don't do that) and maybe trust the bitflag on that basis, but even then they aren't learning what PIN I set, how long it is, anything useful. You probably don't want to store such PINs in a Password Manager, although it's unlikely to be a big security problem to do so, they are intended to be human memorable unlike a "good" modern password.

I agree. Shouldn't you put your PIN in a password manager anyway? Why call it a PIN and not a password to begin with? Is there a difference I'm missing?

by atestu 6y ago

I agree. Shouldn't you put your PIN in a password manager anyway? Why call it a PIN and not a password to begin with? Is there a difference I'm missing?

toomuchtodo 6y ago

Same reason iPhones support PINs. It’s easier for the user, and provides some level of protection versus nothing. If it’s not user friendly, the user will defer to convenience over security. Signal PINs do support alphanumeric strings FYI. If you have a password manager, use a string. If not, a PIN works just fine.

emerongi 6y ago
It seems alphanumeric PINs are allowed now. At least on iOS, I do get the option to change the PIN to an alphanumeric one. The whole PIN thing has changed quite a bit in the past 6 months or so.

j-james 6y ago

My understanding is it's designed around making short passwords more secure by trying to limit brute force attacks. Seems interesting. https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/

novok 6y ago

You can use a long alphanumeric string as your 'PIN', and on iOS at least, you can insert that PIN via a password manager.

teekert 6y ago
Hmm, because they use the word PIN (personal identification number) I set a 6 number PIN, I feel a bit stupid about that now. But then this means that my messages are in another place than my phone? A bit unclear from what the app told me...
- DavideNL 6y ago
  > But then this means that my messages are in another place than my phone? No, only supporting data: "Your profile, settings, and contacts will restore when you reinstall Signal."

tialaramex 6y ago

Newer products seem to be tending to label something a PIN if it isn't stored by a third party, because this means it can't get stolen, and as a result it's safe to choose relatively weak human memorable secrets that would be unsuitable as a traditional "password" that we're all using password managers to store instead. For example a Yubico Security Key can use a PIN. So I could use that as second factor for my Facebook. No matter how lazy, incompetent or even malevolent Facebook is, they never see that PIN, they just get a bitflag in which the Security Key promises it confirmed my identity before authenticating. If they insisted and I allowed them to, they could verify it's a real Yubico brand product (in reality Facebook don't do that) and maybe trust the bitflag on that basis, but even then they aren't learning what PIN I set, how long it is, anything useful. You probably don't want to store such PINs in a Password Manager, although it's unlikely to be a big security problem to do so, they are intended to be human memorable unlike a "good" modern password.