4 ms·

What are the answers to those questions for encrypting the last mile?

• Thorrez 8y ago
  Having a user verify that a piece of infrastructure is correct (aka not a spoofed cell tower) is a much easier problem than having a user verify that a different user is correct (necessary for fully verified e2e). If all the user needs to verify is the infrastructure, then something like https's certificates could work, but it could be simpler because it would be managed entirely by one organization. So more concretely, your sim card could contain some root CAs that it trusts.
  • mikeash 8y ago
    Couldn’t those root CAs also be used to handle end-to-end encryption for your 2FA codes?
    • Thorrez 8y ago
      Yeah I think you're right, a form of end-to-end wouldn't be too hard. But it would only protect against passive attacks by your provider. It wouldn't protect against active attacks by your provider. Your provider could issue itself a new cert for you and your correspondent and then intercept the messages. It's certainly an improvement over what we have now though.