3 ms·
Isn't the point of something like this PIN that the only thing stored on the cloud is an encrypted blob that they don't have the keys to? That way it doesn't ma
by novok 6y ago
Isn't the point of something like this PIN that the only thing stored on the cloud is an encrypted blob that they don't have the keys to? That way it doesn't matter if SGX or similar breaks or not, since the encryption is only happening on your devices. The PIN is the key.
- saurik 6y agoThe PIN is a very short key, so the only real protection is that Intel SGX (which notably gets broken every year, and so this doesn't actually work) is preventing people from getting access to the encrypted data to brute force the key; the enclave then enforces some limit on the number of attempts (and maybe some rate limit on the speed of attempts).
- RL_Quine 6y agoThe client allows them to be alphanumeric, but the default is 4 numbers. The irritating behaviour of repeatedly asking for it to be entered at awkward times means people will just set it to 1337 and call it a day.
- Skunkleton 6y agoI used my debit card PIN, so I should be fine right?
- deleted 6y ago[deleted]
- jacobush 6y agoBank level encryption. Yep, fine.
- mos_basik 6y agoI haven't even opened Signal since hearing about this update, so I don't know how irritating the prompts are, but I did see this in the blog: >Because Signal doesn’t have access to your keys – or your data – your PIN isn’t recoverable if you forget it, so our apps help you remember your PIN with periodic reminders. Don’t worry, these reminders get less frequent over time. Having read that, I doubt I'll get too irritated at the reminders and eventually they'll go away. You have a point that anyone who hasn't read the update blog will have no similar hope and might use something easy. I guess I'd hope the Signal user base is more security conscious than that. For instance, I know my PIN is going to be alphanumeric and immediately stored my password database.
- novok 6y agoYou can fill it in with your password manager at every prompt? There is a large segment of people who don't like complicated passwords and will not use a password manager, so the PIN scheme w/ advanced options and password manager integration is the way to thread that needle.