Post #1705658
2026-04-26 08:45 UTC
@leavex whilst technically correct, I'd argue that there is a burden of care required by Signal or any other app. Why is pin verification required? Is a PIN an appropriate validation method? How is it that users could think that the phishing method be easily mistaken for a genuine request?
I've been a Signal user for some years, and I'm pretty digitally literature. It's not clear how PIN verification helps security, or why it is required when it's required.
Replies (2)
-
@leavex@mastodon.social 2026-04-26 09:04
@toychicken https://support.signal.org/hc/en-us/articles/360007059792-Signal-PIN 🤔
-
@ahltorp@mastodon.nu 2026-04-26 10:42
@toychicken @leavex Yes, it is not enough to claim that the mathematical level is uncompromised. Cryptography means so much more. Cryptography is about keeping something secret, untampered and/or trusted, not mathematical naval-gazing. Perhaps Signal did everything they could (though I doubt that), but it can’t be proven by just pointing to one part of their cryptographical protocols. (And this is not me saying that you shouldn’t use Signal)