My intention was not to be confrontational. But such posts spreading misinformation aren't really thoughtful and shouldn't be tolerated. The standard method to

My intention was not to be confrontational. But such posts spreading misinformation aren't really thoughtful and shouldn't be tolerated. The standard method to detect MITM attacks from server side is with public key fingerprints. Sure, that feature could be backdoored too, I've seen that in a real life product. But that's only half of the equation: you need FOSS client with reproducible builds to ensure the feature actually works. After that, the users can verify their E2EE is working the way it should. Fingerprints alone aren't enough. As I point out in the long post, use Signal that allows this.