3 ms·
Curious: So this PIN has to be stored on the Signal server? Now lets assume most average (non-technical) users will simply type in/re-use their smartphone pin
by DavideNL 6y ago
Curious: So this PIN has to be stored on the Signal server?
Now lets assume most average (non-technical) users will simply type in/re-use their smartphone pin (most of the people i know will do this.)
Would this mean if there's a data breach in the 'Signal cloud', their Pins have now leaked onto the internet?
Doesn't seem like a great idea to store peoples Pin codes in a cloud... would probably be better if they'd just called it a 'Signal password'. People would not think about entering their smartphone PIN code that way.
- zorked 6y agoRead the article before commenting.
- DavideNL 6y agoI did. I assume you are referring to "your PIN isn’t recoverable if you forget it". There's a difference between "not recoverable to a Signal user" and "nobody is able to brute force it if they get access to the cloud data". So what i'm curious about is, how can this be? If you have lost your device (and thus all the keys stored in the signal app/phone), how can they store just a single pin while at the same time being able to prevent it to be recovered/brute forced (since it only has to be 4 digits)?
- ikawe 6y ago> Signal PINs are based on [Secure Value Recovery], which we previewed in December, to allow supporting data like your profile, settings, and who you’ve blocked to be securely recovered should you lose or switch devices. [Secure Value Recovery] https://signal.org/blog/secure-value-recovery/ https://signal.org/blog/secure-value-recovery/ > All of this adds up to a secure enclave that limits the number of recovery attempts that are possible against a value synchronized across nodes in hardware-encrypted RAM.