4 ms·
To maybe clarify what dasil003 means, state-of-the-art encryption for this requires that everyone has a pair of keys, one of which they keep a secret - their Pr
by Sylos 9y ago
To maybe clarify what dasil003 means, state-of-the-art encryption for this requires that everyone has a pair of keys, one of which they keep a secret - their Private Key, and one of which they tell all of their friends, acquaintances, everyone who might ever want to communicate with them - their Public Key.
And then if you want to talk to them, you encrypt your message with their Public Key. Then only they can decrypt it with their Private Key (assuming no one else their Private Key).
But if a hacker / NSA agent / script kiddo pretends to be your friend and tells you their Public Key, then they'll be able to decrypt your messages with their Private Key. You might never know that they aren't your friend.
You'll have to ensure that you actually have the Public Key of your friend by some other method. For example meet them in person to exchange Public Keys, or read it out over the phone, if you know what their voice sounds like on the phone.
- pitaj 9y agoOk so the issue is authentification of the identities. This doesn't seem to be a solved problem in any space, even HTTPS is vulnerable to this kind of attack. It could be decentralized through pluggable identity authorities which provide the public key transfer via a secure channel. Essentially you'd use the same protocol and select what servers (WhatsApp, Signal, maybe some sort of immutable ledger elsewhere) to use.
- cortesoft 9y agoIt is solved, but the solutions all involve a mutally trusted third party.