30 ms·

GPG at least has the web of trust, with all its privacy problems. Most technologies just use "trust on first use".

• jimktrains2 12y ago
  That doesn't actually solve the problem though. It helps in theory, but it requires the user to understand what they're doing to a level most won't. There is also the cultural issue of just exchanging fingerprints. Only techies put them on business cards, and even then only some. It needs to be common action.
  • whyever 12y ago
    Well, at least they try to solve it. Another approach for verification is employed by Threema [1]: The server verifies email addresses and phone numbers, so if the address or number is in your contacts you can have more confidence, represented by an orange dot next to the contact. If you verify the fingerprint by scanning QR codes, you get a green dot. About fingerprints for the masses: I really like the visual fingerprints Peerio is using (basically bigger Github-style generated avatar icons). [1] https://threema.ch/en/faq https://threema.ch/en/faq