5 ms·
>How do you get+trust the other's key? Snail mail + several other out of band methods. Or you can exchange a one time pad, physically.
by Sunset 10y ago
>How do you get+trust the other's key?
Snail mail + several other out of band methods. Or you can exchange a one time pad, physically.
- cvwright 10y agoThis also raises the question: With a walled garden like Signal/Wire/etc, how do you get+trust the other's key? Their convenience comes at a cost.
- maxerickson 10y agoThere are mechanisms to use out of band communication to verify a key: https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-verify-the-safety-number https://github.com/WhisperSystems/Signal-iOS/wiki/FAQ#can-i-... https://support.wire.com/hc/en-us/articles/207692235-How-can-I-compare-key-fingerprints- https://support.wire.com/hc/en-us/articles/207692235-How-can...
- cvwright 10y agoYup, and I've done these. But you can do similar things with PGP public keys, too.
- maxerickson 10y agoI don't understand. You've verified a Signal key but still felt the need to ask the question With a walled garden like Signal/Wire/etc, how do you get+trust the other's key? What cost were you talking about then?
- cvwright 10y agoSorry if my earlier comment came off as rude. I was just trying to say that the walled gardens aren't really that much better than plain old PGP, and in practice they tend to lull people into a false sense of security. I think too many people are way too trusting of shiny new apps with a pretty UI. If you don't do the extra work of verifying the key, you're effectively letting the service provider act as your one and only CA. If you can verify a Signal key fingerprint, you can verify a PGP public key fingerprint.
- maxerickson 10y agoI didn't think it was rude, it just contradicted your other comment. I still don't see what cost you were speaking about. Mistakes with PGP are at least as likely as mistakes with the shiny easy to use GUI.
- x0x0 10y agoOne idea: send them a signal (hi, this you?) then immediately dial their number and confirm.
- skierscott 10y agoIdeally dual channel. Send them a message on their mobile phone, call on the home phone (if they have one).