Hacker News Reader

If you lose your phone and pin, how much does someone have to bruteforce to recover your messages on a new phone?

Surely they'd have to do more work than iterate through a possibly as small as 4-digit key?

If I understand the settings correctly (just opened Signal on my phone to explore this), you can require the PIN for re-registering (like after losing a device) and set up a 7-day lockout for failed PIN entries (not sure the number of permitted failures before lockout). This would greatly reduce the speed of brute force, though could also be used for a nice denial of service.

Reply on news.ycombinator.com