4 ms·

Apple could mitigate most of the security concerns listed in this thread by listing the trusted devices which you're encrypting against. This solves the "extra

by grrowl 13y ago

Apple could mitigate most of the security concerns listed in this thread by listing the trusted devices which you're encrypting against. This solves the "extra encryption key" angle. You'd still have to trust your recipient to be just as mindful of this as you to prevent the vulnerability in the other direction though.

lloeki 13y ago
> by listing the trusted devices which you're encrypting against More precisely, on a user device: list the contact devices and key fingerprints. Adding a contact's device: on first exchange show fingerprint and ask for trust then pin the pubkey. Warn should the key change. What remains is for parties to exchange fingerprints in a peer to peer side channel (possibly even physically via bluetooth/qr-code).