4 ms·
> That's something that's at least somewhat true of OTR and PGP too Well, OTR is just the protocol, implementations vary in how well they make you authenticate
by tveita 11y ago
> That's something that's at least somewhat true of OTR and PGP too
Well, OTR is just the protocol, implementations vary in how well they make you authenticate your conversation partner. And PGP will whine at you a lot if you haven't marked a key as trusted.
But somewhat agreed. A bad UI can ruin the security of otherwise solid crypto.
I just don't see how the security of Signal and WhatsApp are different. Assuming for a moment (very optimistically) that the user verifies the fingerprint and enables the alert for changed keys, they are using the same protocol with the same guarantees.
Are you factoring in some level of trust in their ability to write a secure client or run secure servers?
- Joof 11y agoIts probably only a half-step up, but signal's client (and server?) are open source. You could compile your own to avoid problems with the binary blob being different. Maybe you could run your own server to dish out keys, but that may be a stretch.