#pin

I messed up WhatsApp’s PIN 3 times in a row, got worried that they’d wipe my data Switched to the password manager app, verified that I indeed didn’t input the correct code and which it is Switched back to WhatsApp, was immediately let in, no code to input … big fail, I’d say #privacy #whatsapp #pin

@xgranade@wandering.shop it kinda is an issue with #signal tho. they've been training users to fall for re-register #scams by constantly prompting users to re-enter your #PIN (and the PIN is only necessary because phone numbers are used for sign-up). #signal are good at #victimblaming whenever there's a security incident.

@pelle@veganism.social @xgranade@wandering.shop they've been training users to fall for re-register #scams by constantly prompting users to re-enter your #PIN (and the PIN is only necessary because phone numbers are used for sign-up). No, the PIN is required to reacquire the account if you lose all connected devices. If they used any other unique identifier as the account handle, the PINs would still be required.

@david_chisnall@infosec.exchange @xgranade@wandering.shop yes, exactly: #PIN is needed to reaqcuire your account — using your #phonenumber! — because without PIN, #signal account data would be vulnerable to #SIMswapattack, right?

@david_chisnall@infosec.exchange @xgranade@wandering.shop whatever #signal's reasons are for badgering users for a #PIN, it's clearly a design choice they made, because other secure messengers don't do this. and clearly this design choice has some harmful consequences, which i don't think it's fair of them to just #victimblame away.

@pelle@veganism.social @xgranade@wandering.shop whatever #signal's reasons are for badgering users for a #PIN, it's clearly a design choice they made, because other secure messengers don't do this. The choice is either: Periodically ask people to enter their PIN, orDeal with people complaining that they forgot their PIN and are locked out (or, ideally not possible):Provide an insecure way of recovering an account after you are locked out. The PIN entry UI looks nothing like an incoming message.