Meredith Whittaker reaffirms that Signal would leave UK if forced by privacy bill::Meredith Whittaker, the president of the Signal Foundation, the organization that maintains the Signal messaging app, spoke about the U.K.'s controversial new privacy bill at TC Disrupt 2023.

  • hedgehog@ttrpg.network
    link
    fedilink
    English
    arrow-up
    4
    ·
    1 year ago

    Why are you recommending people disable their Signal PINs? Best practice as far as I’m aware is to set a secure passphrase (rather than a 4 digit PIN) and to enable Registration Lock.

    This article is the only one I was able to find with a recommendation that you opt out of setting a PIN, and even there they recognize that if you set a secure passphrase instead of a PIN, you aren’t reliant on SGX’s security anymore.

    That article also doesn’t talk about how having a PIN is required to enable Registration Lock. Since Signal is dependent on phone numbers, disabling Registration Lock makes you vulnerable to account hijacking attacks. I would personally be more concerned about my contacts having their accounts hijacked - with the only indication of this on my end being that their Safety Number changed - than by them using a 4 digit PIN; if I were to recommend anything, it would be for them to use a secure passphrase (like an EFF dice-generated passphrase or a 12-word BIP39 phrase) and enable Registration Lock.