5 ms·
I did say "exchange secrets" for a reason -- that secret may be a key for later use (e.g. for data dumps), or actual information. What I'm trying to understand
by ihnorton 10y ago
I did say "exchange secrets" for a reason -- that secret may be a key for later use (e.g. for data dumps), or actual information.
What I'm trying to understand is whether the (relatively new) feasibility of interactive video channels allows for building roughly the same level of trust as would be provided by in-person key exchange. I'm basing this on the understanding, possibly incorrect, that encryption with a public key allows for creating a secure communication channel, but not necessarily a trusted one. The hypothesis is that the capability to conduct interactive video provides a way to verify identity and establish trust at roughly the same level as would be provided by in-person exchange (again, assuming 1-1 trust, and excluding TLA threat models).
- mcbits 10y agoI might trust a video chat today to verify an identity, but only because it would be a relatively new method. Definitely not in a few years if it ever took off. It's already possible to forge a talking head and fall back on "sorry, bad connection out here in the field" to hide glitches.
- cortesoft 10y agoYou are forgetting a key part of the 'trust' thing; you have no way of knowing if someone is man in the middle attacking your video chat. Example: Alice wants to video chat with Bob to exchange the secret key and verify identity. Mallory sets up a MITM attack, and gives her own public key to both Alice and Bob. Alice and Bob think they are securely talking with each other, but they are actually securely talking with Mal, who decrypts the video, watches it, then forwards it on to the other person. This is why you can't have a secure communication channel without trust; you don't know if your secure communication is being intercepted, read, and then passed on.