4 ms·
The app automatically distributes public keys, to my knowledge, and the QR code is merely a validation mechanism to ensure that no MITM is substituting keys. T
by osweiller 11y ago
The app automatically distributes public keys, to my knowledge, and the QR code is merely a validation mechanism to ensure that no MITM is substituting keys.
The EFF seems to think the QR code thing is the bee's knees. In practice, I would wager less than 0.1% of users will make use of that functionality. It's more of a placebo.
- tinus_hn 11y agoIf there is widespread snooping even a small percentage of users verifying their keys will expose it.
- osweiller 11y agoIf there was widespread snooping, it would imply either WhatsApp collaboration or compromise, in which case the app could show whatever they wanted it to show (or they could just upload all of the private keys, which they may very well do in any case). However I was talking about QR code versus the widely known fingerprint. The EFF seems to think the QR code is just a huge improvement, but I just don't think it will see any usage at all over the fingerprint, but instead it provides the illusion of security ala "look there's this complex thing...and some people must be validating it...so I'll just trust it."