3 ms·
It's like with any of these things that leave the hard problem of identity entirely to the user. You don't have to verify the safety number but if you don't you
by upofadown 6y ago
It's like with any of these things that leave the hard problem of identity entirely to the user. You don't have to verify the safety number but if you don't you implicitly trust Signal not to intercept your communications. A valid choice, but these sorts of issues should be made clearer to the user. Just tell the user that if you want effective end to end communications there are certain things you have to do. A truth in advertising thing.
- greggyb 6y agoForgive me if I misunderstand, but I thought Signal's protocol prevented anyone, including Signal from intercepting messages, as these are encrypted end-to-end. The threat model is that someone else is impersonating your correspondent. This is not message interception but identity verification. Your communication with whoever is on the other end is secure within Signal, but your correspondent may do whatever they wish with the messages.
- lmm 6y agoIf you haven't verified the identity of the other end then Signal could be MITMing you the whole time.