Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>what would be the alternative

Alice getting a warning about key mismatch and a prompt for redelivery (or not) of the pending message. Bob-with-new-phone does not get to read Alice's messages to Bob without Alice at least having the ability to verify that Bob indeed changed phones. Yes, 99% of users will click "redeliver" without checking, but the ones for whom secrecy matters won't.

I think this is how Signal does it, and it is the only security conscious way to do it.



Yes, I personally prefer that too. But I understand if facebook decided this is too much to ask for their users.


Yeah, I've seen this behaviour with Signal. It's UI is somewhat confusing thou, it took me a while to understand that I needed to re-generate keys so what I could "fix" my conversation. There was no redelivery of the messages that couldn't be decrypted thou.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: