4 ms·

Maybe I'm missing the point, and if so please correct me, but when I add new people to signal we do so in person and there's a QR code where one can "verify" th

Maybe I'm missing the point, and if so please correct me, but when I add new people to signal we do so in person and there's a QR code where one can "verify" the person. It obviously links the verified user with their phone, so theoretically someone could steal their phone and pretend to be them I guess. But it is making them a "verified" user, it's just up to me to verify.

AmericanChopper 7y ago
The safety number is essentially equivalent to a self-signed certificate. You can use it to consistently identify a key holder, but it doesn’t offer you any way to identify who that key holder is. If you want to trust a self-signed cert, then figuring up whether you should or not is entirely up to you. This is the problem that CAs address with CA signed X.509 certificates. If you want to validate identity as a service, then the only options you really have available are a central authority, or a web of trust. Both of which have serious downsides, and neither of which are offered by Signal.
- iudqnolq 7y ago
  That's a generally correct statement, but the comment you replied to mentioned a specific case for which it's false. If you can reduce the trust problem by requiring every person to verify out-of-band the identity of every one of their contacts, it becomes a lot simpler. For some Signal users, such as the person you replied to, this appear to be the case.
  - AmericanChopper 7y ago
    Marking a safety code as trusted in signal is not different in any way to adding a self-signed TLS certificate to the trust store on your computer. You can perform exactly the same out of band verification of the self-signed cert. Signal does not have a single feature that verifies the identity of your contacts, they don’t pretend to have such a feature, and frankly I’d say it’s dangerous to assert that they do. How you do that is 100% your own problem to solve. The only thing it does is provide you with a trust store to use to keep track of which contacts you have personally decided to trust.
    - iudqnolq 7y ago
      I agree completely. I merely wanted to point out that your reply that the problem is really hard was in reply to a person who solved the trust problem using the tools signal provides by having a simple problem (will always meet people in person first) and doing some work (verifying safety numbers).

AmericanChopper 7y ago

The safety number is essentially equivalent to a self-signed certificate. You can use it to consistently identify a key holder, but it doesn’t offer you any way to identify who that key holder is. If you want to trust a self-signed cert, then figuring up whether you should or not is entirely up to you. This is the problem that CAs address with CA signed X.509 certificates. If you want to validate identity as a service, then the only options you really have available are a central authority, or a web of trust. Both of which have serious downsides, and neither of which are offered by Signal.

iudqnolq 7y ago
That's a generally correct statement, but the comment you replied to mentioned a specific case for which it's false. If you can reduce the trust problem by requiring every person to verify out-of-band the identity of every one of their contacts, it becomes a lot simpler. For some Signal users, such as the person you replied to, this appear to be the case.
- AmericanChopper 7y ago
  Marking a safety code as trusted in signal is not different in any way to adding a self-signed TLS certificate to the trust store on your computer. You can perform exactly the same out of band verification of the self-signed cert. Signal does not have a single feature that verifies the identity of your contacts, they don’t pretend to have such a feature, and frankly I’d say it’s dangerous to assert that they do. How you do that is 100% your own problem to solve. The only thing it does is provide you with a trust store to use to keep track of which contacts you have personally decided to trust.
  - iudqnolq 7y ago
    I agree completely. I merely wanted to point out that your reply that the problem is really hard was in reply to a person who solved the trust problem using the tools signal provides by having a simple problem (will always meet people in person first) and doing some work (verifying safety numbers).