  We conducted an online study with $n = 235$ Signal users on their
understanding and usage of PINs in Signal. In our study, we observe a split in
PIN management and composition strategies between users who can explain the
purpose of the Signal PINs (56%; enthusiasts) and users who cannot (44%; casual
users). Encouraging adoption of PINs by Signal appears quite successful: only
14% opted-out of setting a PIN entirely. Among those who did set a PIN, most
enthusiasts had long, complex alphanumeric PINs generated by and saved in a
password manager. Meanwhile more casual Signal users mostly relied on short
numeric-only PINs. Our results suggest that better communication about the
purpose of the Signal PIN could help more casual users understand the features
PINs enable (such as that it is not simply a personal identification number).
This communication could encourage a stronger security posture.
