Signal has gone from merely annoying me to create a PIN, to outright refusing to let me use the app if I don’t create one. 😠 
Apparently 0000 is no good.
I really liked Signal. And it bums me out that I’m going to have to stop using it. @moxie, this was the wrong decision.
Look, I’m totally ok with the idea of setting a password or a PIN if it’s only going to be used to authenticate myself to the service. But Signal has made it clear that they intend to use this for data backup, using Intel SGX. And I don’t want that at all.
Worse, since I made up a PIN just to make their stupid modal dialog go away, I’ve already forgotten it.
Just had a conversation with Moxie. His proposed workaround is “pick a high entropy passphrase, like a BIP39 seed phrase, and then forget it.”
He assured me that I would never get locked out of my entire account because of this, unless I selected “Registration Lock” in Settings. So that’s nice.
Contacts data will still be sent to the server, but it won’t be recoverable ever.
Contacts data will still be sent to the server, but it won’t be recoverable ever.
He also promised that if this system is ever extended to the point where it will ever backup message content, any such backup will be opt-in.
I asked him if the “high entropy seed” workaround could be made into a normal option activated by a setting — so people don’t have to go out of their way to generate a BIP39 passphrase (!) — and he says he’ll look into doing this.
I still have a LOT of issues with this approach, mostly because I’m concerned about the long term. But those are best left for a blog post rather than a Twitter rant.
