Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Signal basically trusts on first connection where you trust the Signal company to do something with an SMS to link your identity with your phone number. After that you have a fingerprint (they call it a "safety number") if you want to check to see if you are still talking to the same entity. It will warn you if the number changes.

So how different that is from Conversations depends on how much you trust the Signal company and the phone company. In either case you really have to check the fingerprint, just like with everything. The issue is inherent to secure communications and can not be avoided with any sort of improved user interface.



I see, so you can verify but it's not by default. What happens if you add a new device (e.g. a tablet so a new fingerprint, which is different from changing main device where the original fingerprint changes)? Is the new fingerprint accepted without user validation?

My point is that e2ee makes sense when you don't trust the server (here Signal company, or FB for whatsapp), so if most people don't check the fingerprints (and I assume it's the case), what's the real value of it?


This is a core difference between Signal and eg WhatsApp. The Signal UX clearly shows who’s verified, and the UX clearly earns you when the safety number changes. Additionally, the secondary device model (eg Signal Desktop) goes to great lengths not to break that. With WhatsApp, you’re trusting WhatsApp.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: