3 ms·
Wouldn't MiTM be relatively easy for a state actor or even well-coordinated non-state actors? At least, if I was a state, I'd have backdoors in as many open sou
by afpx 1y ago
Wouldn't MiTM be relatively easy for a state actor or even well-coordinated non-state actors? At least, if I was a state, I'd have backdoors in as many open source projects as I could and agents in the orginzations in the supply chain.
It's a crazy world when the person in charge of the US military is more paranoid about their own government than random people they don't even know.
If you go back far enough in the Twitter archives, you can see where Jack Dorsey basically tells everyone to switch to Signal to communicate with him. Was that the point when they all started colluding on Signal?
- XorNot 1y agoWith Signal? Sort of. Signal has countermeasures for this but no one knows how to use them - it's very much a trust on first use system. Fine for regular people, not at all fine when you're target number one for every foreign intelligence service on the planet.
- victorbjorklund 1y agowhich countermeasures require active involvement from the user? (honest question because I am curious)
- firesteelrain 1y agoYou do need a PIN to secure the communications on either end. I assume it’s used in the salting process
- XorNot 1y agoYou need to verify safety codes on someone's device to actually verify they control the device with the Signal account you're communicating too, rather then it just being relayed by a false account somewhere due to a MITM attack.
- klabb3 1y agoOr even the infamous and highly sophisticated reporter-in-the-middle attack, where the victim is drunk and rambling, has no idea how to verify public keys in order to actually use the e2ee correctly, then fat-finger adds people by nickname from a contact list that’s full of personal connections.