Hacker News Reader

Comment by hprotagonist | Hacker News Reader

I actually _do_ reverify safety numbers out-of-band every time they change.

I would actually like to see some numbers or a survey on how many people actually do this. Anecdotally I don't think I know a single person who ever verifies safety numbers out of band. Of the approximately 50 people I use to talk on signal with regularly not including large group chats of people I don't know as well, not a single person has ever tried to reverify me nor have I tried to reverify any of them.

Would be cool to see what the numbers are for reverifications.

At some point, continued conversation is verification enough. The MITM isn't a catfish, and they are going to have a hard time keeping up the charade acting like someone you chat with regularly.

It doesn’t have to be a human in the middle though - if you’re in a position to MITM, it’s much more scalable to put a bot in between that relays messages between one person and the person they intend to communicate with.

In that case you can just ask if they got a new phone.

I normally don't do this in-person, but some kind of out of the loop approach is something i do every time.

One time i got a postcard from a friend with their safety number on it and nothing else. I recognized their handwriting to complete the loop.

Would you mind elaborating?

What you described sounded interesting

And Signal does allow you to mark a safety number as "verified", which I think does put up an extra barrier. I don't think the article makes any mention of this.

I'm curious how you verify them out of band, because that would reveal your threat model and why or what for you take such pains (not arguing that out of band verification is useless or wrong).

The following questions are not intended as attempts to poke a hole on the requirement for out of band verification. Do you meet in person and speak in whispers or show some code that's hidden from the view of others (and cameras)? Or do you use a voice call or SMS (both expressly designed to support surveillance)? Or do you use another end to end encrypted app or email (if yes, how do you verify the keys for that)?

I feel like, unless I'm about to transmit some data that is absolutely crucial, the act of regular conversation through Signal is enough to verify the person. Unless I'm missing something?

If there is a MITM attack, regular conversation can still proceed between the people and someone could eavesdrop on the entire conversation.

Reply on news.ycombinator.com