6 ms·
> Note that the only alternative is to trust a third party to identify people to you. No, the proper alternative is blocking or discouraging sensitive communic
by corty 5y ago
> Note that the only alternative is to trust a third party to identify people to you.
No, the proper alternative is blocking or discouraging sensitive communication until an in-person verification has taken place.
Also, you are always trusting a third party. You have to trust the Signal people (maybe), you have to trust Intel and their SGX (lol, look for some papers on those) and you have to trust your phone vendor. Proper security educates people about whom the are currently having to trust. Spinning it like no third party needs to be trusted for Signal to operate is dishonest.
- tialaramex 5y agoEarlier you claimed that users will just ignore safety measures, and now you say that of course they'll obey them. > You have to trust the Signal people (maybe), you have to trust Intel and their SGX You don't have to trust either. SGX only gets involved if you are willing to trust it in exchange for having quality-of-life features which are optional. The sort of person who never verifies Safety Numbers probably should take that deal, the sort of person who needs Safety Numbers to protect them from the Secret Police should consider carefully. The most important thing SGX is doing for you is making guesses expensive. If your Signal PIN is a 4-digit number then SGX's expensive guesses make it impractical for an adversary to just try all the combinations, but if your Signal PIN is 12 random alphanumerics then that's too many guesses to be practical anyway even without SGX.