Indeed, and as the docs (https://magic-wormhole.readthedocs.io/en/latest/welcome.html#design https://magic-wormhole.readthedocs.io/en/latest/welcome.html...) ex

Indeed, and as the docs (https://magic-wormhole.readthedocs.io/en/latest/welcome.html#design https://magic-wormhole.readthedocs.io/en/latest/welcome.html...) explain, you'd likely notice an active attack, and the paranoid can choose any arbitrarily-longer code: > PAKE effectively trades off interaction against offline attacks. The only way for a network attacker to learn the shared key is to perform a man-in-the-middle attack during the initial connection attempt, and to correctly guess the code being used by both sides. Their chance of doing this is inversely proportional to the entropy of the wormhole code. The default is to use a 16-bit code (use –code-length= to change this), so for each use of the tool, an attacker gets a 1-in-65536 chance of success. As such, users can expect to see many error messages before the attacker has a reasonable chance of success. (It does strike me, however, that if a 'mailbox server' becomes heavily used, with many pending-but-incompleted wormholes, then an attacker making random guesses might manage to receive someone's random file, instead of the real intended-recipient. Perhaps the sending-side should optionally require an interactive sender-ack, after showing for confirmation a receiver-generated unique secret? In any case: using a longer code, and/or using a private mailbox, could each help eradicate such risks.)