zlacker

> If I understand what you are saying and what Signal says, Signal anticipates this problem and provides a solution that is arguably optimal

Yep, this is what I meant when I said "This is where a technology called Intel SGX comes into play". :)

And you're right, SGX is better than nothing if you accept that people use insecure PINs. My argument mainly was that

- the UI is designed in the worst possible way and actually encourages people to choose a short insecure PIN instead of recommending a longer one. This means that security guarantees suddenly rest entirely on SGX.

- SGX requires the server code to be verified and published (which it wasn't until yesterday). Without verification, it's all pointless.

> uses a key derivation function to maximize the master key's entropy

Nitpick: Technically, the KDF is deterministic, so it cannot change the entropy and – as the article says – you could still brute-force short PINs (if it weren't for SGX).

> I'd love to hear from a security specialist regarding this scheme. I'm not one and I had only limited time to study the link above.

Have a look at link [1] in my previous comment. :)