<![CDATA[This is a good thread.]]>RE: https://mastodon.world/@signalapp/116478659183004819

This is a good thread. I like how carefully they take responsibility for where they could have done better, and at the same time very clearly state what isn't a problem with Signal.

]]>https://forum.fedi.dk/topic/89a461a2-75ec-4f0a-a4c2-025f0fb290c6/this-is-a-good-thread.RSS for NodeWed, 15 Jul 2026 21:51:15 GMTMon, 27 Apr 2026 21:51:45 GMT60<![CDATA[Reply to This is a good thread. on Tue, 07 Jul 2026 22:53:38 GMT]]>@pelle @david_chisnall @xgranade

i'm genuinely surprised that an organisation (signal) that is normally so alert and aware of such issues is making this error

is it a case of an overly powerful product owner pushing this past dissenting voices?

if so then the president/ceo of @signalapp needs to hear from us

]]>https://forum.fedi.dk/post/https://mathstodon.xyz/users/rzeta0/statuses/116881150334330177https://forum.fedi.dk/post/https://mathstodon.xyz/users/rzeta0/statuses/116881150334330177Tue, 07 Jul 2026 22:53:38 GMT<![CDATA[Reply to This is a good thread. on Tue, 07 Jul 2026 16:41:55 GMT]]>@pelle @xgranade

Signal has a weird blind spot for security usability. A year or so ago I wrote down a list of half a dozen simple things they could do to improve it. And none of these were particularly difficult things but they’ve never been a priority.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/david_chisnall/statuses/116879688714485392https://forum.fedi.dk/post/https://infosec.exchange/users/david_chisnall/statuses/116879688714485392Tue, 07 Jul 2026 16:41:55 GMT<![CDATA[Reply to This is a good thread. on Tue, 07 Jul 2026 15:48:00 GMT]]>@david_chisnall @xgranade
has now decided to use official release notifications that look almost indistiguishable from a regular chat, just to train users even harder to fall for phishing attacks. πŸ˜‘

]]>https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116879476687818409https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116879476687818409Tue, 07 Jul 2026 15:48:00 GMT<![CDATA[Reply to This is a good thread. on Wed, 29 Apr 2026 01:52:45 GMT]]>@pelle @david_chisnall @xgranade The prompt appears less over time. I get it once per month.

]]>https://forum.fedi.dk/post/https://ioc.exchange/users/Avitus/statuses/116485492901341096https://forum.fedi.dk/post/https://ioc.exchange/users/Avitus/statuses/116485492901341096Wed, 29 Apr 2026 01:52:45 GMT<![CDATA[Reply to This is a good thread. on Tue, 28 Apr 2026 14:04:10 GMT]]>@david_chisnall @xgranade
yea, i guess it's a trade-off, but repeated nagging pop-ups asking for your PIN unrelated to any user action within the app is perhaps not the best way of to teach users to never give out the PIN.

]]>https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116482706669377615https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116482706669377615Tue, 28 Apr 2026 14:04:10 GMT<![CDATA[Reply to This is a good thread. on Tue, 28 Apr 2026 13:03:06 GMT]]>@pelle @xgranade

whatever 's reasons are for badgering users for a , it's clearly a design choice they made, because other secure messengers don't do this.

The choice is either:

  • Periodically ask people to enter their PIN, or
  • Deal with people complaining that they forgot their PIN and are locked out (or, ideally not possible):
  • Provide an insecure way of recovering an account after you are locked out.

The PIN entry UI looks nothing like an incoming message.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/david_chisnall/statuses/116482466576356379https://forum.fedi.dk/post/https://infosec.exchange/users/david_chisnall/statuses/116482466576356379Tue, 28 Apr 2026 13:03:06 GMT<![CDATA[Reply to This is a good thread. on Tue, 28 Apr 2026 12:30:29 GMT]]>@david_chisnall @xgranade
whatever 's reasons are for badgering users for a , it's clearly a design choice they made, because other secure messengers don't do this.

and clearly this design choice has some harmful consequences, which i don't think it's fair of them to just away.

]]>https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116482338323179344https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116482338323179344Tue, 28 Apr 2026 12:30:29 GMT<![CDATA[Reply to This is a good thread. on Tue, 28 Apr 2026 12:04:10 GMT]]>@pelle @xgranade

Without the phone number, you'd still need a mechanism for authenticating new devices, which would be a password or a PIN. With the phone number, the first step is there for you and the PIN is defence in depth, without it you still have the same problem.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/david_chisnall/statuses/116482234785310252https://forum.fedi.dk/post/https://infosec.exchange/users/david_chisnall/statuses/116482234785310252Tue, 28 Apr 2026 12:04:10 GMT<![CDATA[Reply to This is a good thread. on Tue, 28 Apr 2026 11:12:54 GMT]]>@david_chisnall @xgranade
yes, exactly: is needed to reaqcuire your account β€” using your ! β€” because without PIN, account data would be vulnerable to , right?

]]>https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116482033197325434https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116482033197325434Tue, 28 Apr 2026 11:12:54 GMT<![CDATA[Reply to This is a good thread. on Tue, 28 Apr 2026 09:12:08 GMT]]>@pelle @xgranade

they've been training users to fall for re-register by constantly prompting users to re-enter your (and the PIN is only necessary because phone numbers are used for sign-up).

No, the PIN is required to reacquire the account if you lose all connected devices. If they used any other unique identifier as the account handle, the PINs would still be required.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/david_chisnall/statuses/116481558329497157https://forum.fedi.dk/post/https://infosec.exchange/users/david_chisnall/statuses/116481558329497157Tue, 28 Apr 2026 09:12:08 GMT<![CDATA[Reply to This is a good thread. on Tue, 28 Apr 2026 08:55:18 GMT]]>@xgranade
it kinda is an issue with tho.

they've been training users to fall for re-register by constantly prompting users to re-enter your (and the PIN is only necessary because phone numbers are used for sign-up).

are good at whenever there's a security incident.

]]>https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116481492164809362https://forum.fedi.dk/post/https://veganism.social/users/pelle/statuses/116481492164809362Tue, 28 Apr 2026 08:55:18 GMT<![CDATA[Reply to This is a good thread. on Mon, 27 Apr 2026 21:55:03 GMT]]>Like, it's both very true that a phishing attack against Signal users isn't a vulnerability with Signal, and that given the high value of Signal accounts, they can and should do more to proactively resist phishing attacks. They don't let either one of those truths overshadow the other, and good on 'em.

]]>https://forum.fedi.dk/post/https://wandering.shop/users/xgranade/statuses/116478895960746288https://forum.fedi.dk/post/https://wandering.shop/users/xgranade/statuses/116478895960746288Mon, 27 Apr 2026 21:55:03 GMT