3 ms·
All of my Signal/Telegram/WhatsApp contacts are unverified in the app itself, but almost all of them are de facto verified by other means; we plan meeting up at
by Frondo 8y ago
All of my Signal/Telegram/WhatsApp contacts are unverified in the app itself, but almost all of them are de facto verified by other means; we plan meeting up at bars and I know who I'm chatting with because the person I expect shows up. Or we send emails or communications via other means and the conversations match.
I don't need to verify the code because everything else about the communication matches.
- oarsinsync 8y agoNone of that ensures you have message privacy. If you haven't verified the key, you have no assurance that the connection hasn't been MITM'd.
- lokedhs 8y agoWhat's worse is that Whatsapp doesn't tell you if they changed the key, so there is no protection against MITM.
- jjeaff 8y agoWhatsApp used to. Did they stop?
- lokedhs 8y agoI don't use Whatsapp, so I don't actually have first-hand knowledge. Now that I think about it, it may be that I was told that it automatically regenerates the key more often than they need to, which would have the same effect.
- oarsinsync 8y agoI don't believe this is true. Every time I've asked about a key change, it has been because someone either got a new phone, reinstalled the app, or reset their phone.
- hiq 8y agoIt's a setting which is off by default.
- oarsinsync 8y agoYou need to enable security notifications, and you will be notified of key changes. > Turn on this setting to receive notifications when a contact's security code has changed. Your messages and calls are encrypted regardless of this setting.