3 ms·
> Should I not talk to them any more until I verify those in person? It depends on your threat model. If you're a journalist talking to sources, then you shou
by movedx 6y ago
> Should I not talk to them any more until I verify those in person?
It depends on your threat model.
If you're a journalist talking to sources, then you should probably put down the phone and reach out through some other equally secure channel to confirm they're the ones who have changed their safety number (and even then, at this kind of level I'd have an "under duress" safe word.)
If you're like me and you're browsing Hacker News in your underwear shouting at people's posts because they're wrong about Go, you're probably OK to assume your mate just changed their phone.
- tareqak 6y agoI have most of my Signal contacts also belong to a group on Signal. When I see the message for a contact’s verification number changing, I ask the contact in the Signal group if they got a new phone.
- codethief 6y agoWhat prevents an attacker (who obtained access to your contact's phone number or is acting as a MITM) to forge a message (pretending to be your contact) in that Signal group, saying that yes, "he" indeed got a new phone? Or are you hoping that the attacker is only attacking your personal conversation with your contact, not your contact's other conversations?
- tareqak 6y agoI know it's not sufficiently secure. For me, it's about educating other Signal users about the significance of the message that pops up. Almost all of the people on my Signal contact list use Signal because I asked them to do so.