4 ms·
What is the user supposed to do when they get notified of a "safety number changed" message? How do they verify they've not just been MITM? Honest question...
by throw7 10y ago
What is the user supposed to do when they get notified of a "safety number changed" message? How do they verify they've not just been MITM? Honest question... I don't use whatsapp or signal at all.
- sloanesturz 10y agoYou have to physically compare the numbers on the two phones (in real life), or send the numbers through a different trusted channel (PGP, USPS, Carrier Pigeon, etc).
- ivanhoe 10y agoIt's up to you to confirm what's going on using another channel (say call them on phone and see what's going on, compare the numbers). It's the same thing ssh does when server keys change for instance. To me it's a reasonable way to handle such situation.
- jlgaddis 10y ago(Re-)verify the safety number out-of-band, like you hopefully did initially.
- Freestyler_3 10y agoYou can aks the other party to resend you a message from before (one that doesn't matter). Ie. Can you confirm this is you: send me a message from 5 messages back using the quote function. (you know what is said 5 mssgs back so you can pick a non sensitive one, and they can do the same to you) edit: nvm, if this is man in the middle then that doesn't matter because you still exchange with each other and its not a hijack. Sorry, I made a mistake.
- subliminalpanda 10y agoI would simply ask if they got a new phone or re-installed WhatsApp. A few would inquisitively ask "Yes, how did you know?", then I would explain them to them the notification I got.
- pbalau 10y agoThis can be triggered by the other side changing phones/devices. How do you explain this to the stupids?