3 ms·
> If Google or any of the other services had their own > client that properly integrated with back-end services > like key exchange, key signing, etc. you w
by jmillikin 13y ago
> If Google or any of the other services had their own
> client that properly integrated with back-end services
> like key exchange, key signing, etc. you would not have
> to understand and implement identity verification yourself.
If key exchange and verification were handled by a third-party service, then a compromise of that service would threaten the security of all communications. To be secure, key exchange and verification must be handled offline at the level of individual users.
Pre-acquisition Skype was not a secure communications system, any more than iMessage or Hangouts are today. If you believe it was, then you have not spent sufficient time considering how to compromise such a system.
- Zigurd 13y agoApart from meeting in person and exchanging keys, what other way do people have of finding someone else's public key? Securing that is what key signing and web-of-trust are for. Also, Skype in unlike iMessage or Hangouts in that messages traversed nodes that could capture and attack traffic. Skype had security requirements these other services did not have. A modern, verifiable service could be built that, to end users, resembled Skype in simplicity. Or, for that matter, Hangouts could open source their client and enable verifiable security that, to the end-user, would be no more complicated than using Hangouts is currently.