Unlike WhatsApp, for instance, Signal does not automatically create a backup of all messages.

They suggest a name such as “account recovery password”, which would describe the purpose and show users that they are not limited in their choice of characters.Ĭlearer communication with users could also help to avoid unpleasant surprises. Security could benefit from optimised user communication: It could be helpful, for instance, to not talk about a PIN as this encourages users to enter a short series of numbers, the authors of the study say. “Many of the users who switched to Signal in early 2021 due to a change in the WhatsApp terms of use presumably do not belong to this group.” “The communication from Signal appears to mainly work for users who seek information about the functioning of the app in forums and blogs,” says Philipp Markert from the Mobile Security Research Group at HGI. The 57 per cent of respondents who did actually know the purpose of the PIN often used complex alphanumeric passwords, which they saved in a password manager.Ĭommunication not suitable for new target groups They also often assigned short PINs that only consisted of numbers. Among the remaining respondents, 43 per cent were unable to state correctly what Signal uses the PIN for. The main reason that most of them gave was that this was too laborious.

Many people do not know what the PIN is forġ4 per cent of respondents had not used a PIN in Signal. The data is available in advance as a freely accessible preprint. It takes place from 8 to 10 August as a virtual conference. The results of the online survey are being presented at the USENIX Symposium on Usable Privacy and Security by Daniel Bailey and Philipp Markert from HGI together with the US researcher Adam Aviv. The researchers collected data from 235 Signal users, mainly from Germany, the USA and the United Kingdom, from the beginning of September to the beginning of November 2020. However, almost half of the respondents assumed that there was another purpose, such as that the PIN would be used to unlock the app. Signal uses the PIN for an encrypted cloud backup of contact details, settings and profile information as well as – on request – to authenticate the user when they first log in. This was shown in a survey by the Horst Görtz Institute for IT Security (HGI) at Ruhr-Universität Bochum and the George Washington University. However, many users are unclear what benefit this offers. Users can set up a PIN for the messaging app Signal.

Signal security