Hacker News Reader

It's more fake because you download the app, look up your friend's number "1-555-333-2222", and your client trusts their server to actually return your friend instead of a MITM. Some asterisks there, but basically it's far from trustless.

View on HN

Isn't this what the "safety number" in Signal is for? Obviously you are still trusting many other things there (the client software, OS, hardware, whatever out of band method you use to compare the numbers, etc.), but I thought the safety number pretty much addresses the MITM concern specifically, if you bother to check it.

Right, the issue is that nobody checks it and they don't really tell users upfront why they need to. It also notifies you if the number changes later, but seems like that can happen for benign reasons too, so it might go ignored. WhatsApp and Telegram are similar.

Someone could orient an E2EE app around these trusted identities, but it'd probably not be very popular.

Reply on news.ycombinator.com