Hacker News Reader

That is incorrect. You are talking about a design chouce in WhatsApp which is explicitly not a problem in Signal.

Yes, this happens automatically in whatsapp. In Signal, you will be prompted to confirm the new key.

Still, _it is possible to trigger this process for a third party_, and then to MITM the key exchange.

Actually, in Signal more recently now you don't even get to confirm the new key, it just says "hey, the key changed" in the conversation text and keeps going.

I'm not exactly comfortable with this now - it seems like someone may be able to spam messages to hide the key change.

If you manually verify safety numbers and mark your contact as verified, it will hard-stop you and require confirmation if your contact's identity key changes afterwards.

Reply on news.ycombinator.com