3 ms·
The root problem is the requirement to verify that you are talking to who you think you are talking to. If you skip the identity verification stuff then you are
by upofadown 6y ago
The root problem is the requirement to verify that you are talking to who you think you are talking to. If you skip the identity verification stuff then you are inherently trusting a 3rd party. So if you are not exchanging your key fingerprints (safety numbers in Signal terms) then you are kidding yourself.
- secfirstmd 6y agoExactly. That's the root problem and it's a problem that won't easily go away UI/UX and useability vs Security. To be honest right now most people have voted with their useability thumbs.
- garrett_oh 6y agoEven without verifying safety numbers, you’re still better off on Signal then you would be on another platform that doesn’t even offer the option of verification. If you’re looking to MITM a conversation on Signal you can only guess whether or not the recipients have verified each other, whereas on a platform like iMessage you know they haven’t because it’s not an available option.
- mycall 6y agoSS7 spoofing is not a hard thing to do. Who knows if you really are initiating to +14055551212 who you think they are. I guess using multiple techs in serial could obfuscate the initiation correctly (voice, IM, Social Media, etc)
- yencabulator 6y agoPGPFone had a neat thing where it'd show each participant of a voice call a short string they'd read out loud, and then the crypto would use those for handshaking. MITM'ing voice, as part of a freeform conversation, especially between friends, is a lot harder.