3 ms·

I actually _do_ reverify safety numbers out-of-band every time they change.

threwawasy1228 8y ago
I would actually like to see some numbers or a survey on how many people actually do this. Anecdotally I don't think I know a single person who ever verifies safety numbers out of band. Of the approximately 50 people I use to talk on signal with regularly not including large group chats of people I don't know as well, not a single person has ever tried to reverify me nor have I tried to reverify any of them. Would be cool to see what the numbers are for reverifications.
- rabidrat 8y ago
  At some point, continued conversation is verification enough. The MITM isn't a catfish, and they are going to have a hard time keeping up the charade acting like someone you chat with regularly.
  - ryukafalz 8y ago
    It doesn’t have to be a human in the middle though - if you’re in a position to MITM, it’s much more scalable to put a bot in between that relays messages between one person and the person they intend to communicate with.
    - faho 8y ago
      In that case you can just ask if they got a new phone.
- hprotagonist 8y ago
  I normally don't do this in-person, but some kind of out of the loop approach is something i do every time. One time i got a postcard from a friend with their safety number on it and nothing else. I recognized their handwriting to complete the loop.
  - 0xb100db1ade 8y ago
    Would you mind elaborating? What you described sounded interesting
octorian 8y ago
And Signal does allow you to mark a safety number as "verified", which I think does put up an extra barrier. I don't think the article makes any mention of this.
jplayer01 8y ago
I feel like, unless I'm about to transmit some data that is absolutely crucial, the act of regular conversation through Signal is enough to verify the person. Unless I'm missing something?
- LUmBULtERA 8y ago
  If there is a MITM attack, regular conversation can still proceed between the people and someone could eavesdrop on the entire conversation.
newscracker 8y ago
I'm curious how you verify them out of band, because that would reveal your threat model and why or what for you take such pains (not arguing that out of band verification is useless or wrong). The following questions are not intended as attempts to poke a hole on the requirement for out of band verification. Do you meet in person and speak in whispers or show some code that's hidden from the view of others (and cameras)? Or do you use a voice call or SMS (both expressly designed to support surveillance)? Or do you use another end to end encrypted app or email (if yes, how do you verify the keys for that)?

I would actually like to see some numbers or a survey on how many people actually do this. Anecdotally I don't think I know a single person who ever verifies safety numbers out of band. Of the approximately 50 people I use to talk on signal with regularly not including large group chats of people I don't know as well, not a single person has ever tried to reverify me nor have I tried to reverify any of them. Would be cool to see what the numbers are for reverifications.

rabidrat 8y ago
At some point, continued conversation is verification enough. The MITM isn't a catfish, and they are going to have a hard time keeping up the charade acting like someone you chat with regularly.
- ryukafalz 8y ago
  It doesn’t have to be a human in the middle though - if you’re in a position to MITM, it’s much more scalable to put a bot in between that relays messages between one person and the person they intend to communicate with.
  - faho 8y ago
    In that case you can just ask if they got a new phone.
hprotagonist 8y ago
I normally don't do this in-person, but some kind of out of the loop approach is something i do every time. One time i got a postcard from a friend with their safety number on it and nothing else. I recognized their handwriting to complete the loop.
- 0xb100db1ade 8y ago
  Would you mind elaborating? What you described sounded interesting

octorian 8y ago

And Signal does allow you to mark a safety number as "verified", which I think does put up an extra barrier. I don't think the article makes any mention of this.

jplayer01 8y ago

I feel like, unless I'm about to transmit some data that is absolutely crucial, the act of regular conversation through Signal is enough to verify the person. Unless I'm missing something?

LUmBULtERA 8y ago
If there is a MITM attack, regular conversation can still proceed between the people and someone could eavesdrop on the entire conversation.

newscracker 8y ago

I'm curious how you verify them out of band, because that would reveal your threat model and why or what for you take such pains (not arguing that out of band verification is useless or wrong). The following questions are not intended as attempts to poke a hole on the requirement for out of band verification. Do you meet in person and speak in whispers or show some code that's hidden from the view of others (and cameras)? Or do you use a voice call or SMS (both expressly designed to support surveillance)? Or do you use another end to end encrypted app or email (if yes, how do you verify the keys for that)?