3 ms·

I wasn't familiar with Delta Chat. "Delta Chat is a new chat app that sends messages via e-mails, encrypted if possible, with Autocrypt." [1] [1]:https://delt

• woodruffw 3y ago
  I wasn’t aware of Autocrypt before this, and its description on Wikipedia is not confidence inspiring[1]: “Key exchange is during the initial handshake and valid or invalid keys of peers may be replaced anytime later without any user interaction or verification. This makes it very easy to exchange new key(s) if a user loses access to the key but also makes the protocol much more susceptible to man-in-the-middle attacks than clean TOFU.” This is almost the exact opposite of the properties you’d normally expect in an attempt to provide encrypted emails, and offers neither recoverability nor even detectability for the legitimate parties. [1]: https://en.wikipedia.org/wiki/Autocrypt https://en.wikipedia.org/wiki/Autocrypt
  • tuuxi 3y ago
    ftr, Delta Chat implements not only Autocrypt but also "Counter MITM" to protect against active attacks, see https://countermitm.readthedocs.io/en/latest/ https://countermitm.readthedocs.io/en/latest/
    • woodruffw 3y ago
      Which active attacks? This is a large document; from a quick look, it doesn't explain whether it adds pre-shared key agreement, whether it's just pinning a TOFU'd key, or whether it's doing something entirely different.
• seabass-labrax 3y ago
  @dang might want to change the title for us confused souls