4 ms·
I find the whole idea about calculating a hash from the shared key and then speaking it over the phone to verify that there isn't a MITM taking place very inter
by mike-cardwell 16y ago
I find the whole idea about calculating a hash from the shared key and then speaking it over the phone to verify that there isn't a MITM taking place very interesting.
Redphone for Android does this as well apparently but I've not tested it yet because it's US only - http://www.whispersys.com/ http://www.whispersys.com/
- tptacek 16y agoThis is how every web-of-trust and key-continuity scheme works; it's why you get a fingerprint the first time you connect to an SSH server, and why people publish their PGP fingerprints on their business cards.
- mike-cardwell 16y agoYeah, I understand why they've done it this way. I just thought it was a really clever idea to use the users actual voices and conversation to do the verification. It's interesting because you use the system its self to verify that the system is secure. Normally you have to use an alternative (already trusted) system to verify the fingerprint.
- caf 16y agoThe alternative in this case is hidden, but it's still there - you have to recognise the voice of the person you're talking to.
- mike-cardwell 16y agoYeah, I recognise this.