"I have no idea what they're trying to accomplish:" Enthusiastic and Casual Signal
summary
Online study with n = 235 Signal users finds 56% enthusiasts who correctly say the PIN derives an encryption key for cloud backups and is hashed as an extra registration check, while 44% casuals mostly misunderstand it and pick short numeric codes. Only 14% opted-out of setting a PIN. Enthusiasts create long alphanumeric PINs saved in password managers; casuals use short numeric PINs via the keypad. An attacker who knows a PIN can both SIM-swap and decrypt backups.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:27Signal is Privacy Focused
- 0:45Device Transfer
- 2:14Signal PIN Usage
- 2:56Methodology Discussion
- 3:07RQ1: Understanding Signal PINS
- 3:51Enthusiast Quote
- 4:19Casual Quote
- 4:33Research Question 3
- 4:54RQ3: PIN Composition
- 5:10Conclusions: Toward Better Signal PINS
related talks
28mPasswordless zero-knowledge services
31mARE YOU SECURE?
28m"Something isn't secure, but I'm not sure how that translates into a problem"
05m“You still use the password after all” – Exploring FIDO2 Security Keys in a Small
14mPasswords. Are. Not. Hard!
25mPasswords Still? New Data on Consumer Authentication Habits
22mDetecting Compromise of Synced Passkeys
19mStay Cool! Understanding Thermal Attacks on Mobile-based User Authentication