• Jason2357@lemmy.ca
    link
    fedilink
    arrow-up
    10
    ·
    4 days ago

    Out of band key exchange is great -as long as people can physically meet and exchange QR codes. In reality, they are often sent via less secure means. As always, the humans are the weakest security link.

    • HotCoffee@lemm.ee
      link
      fedilink
      arrow-up
      4
      ·
      4 days ago

      Fair point, it always feels dirty to send invite-link through WhatsApp, the dominant messenger in EU.

      How would one go to solve the invite problem? How does Signal handle this?

      • Jason2357@lemmy.ca
        link
        fedilink
        arrow-up
        1
        ·
        1 day ago

        Phone number and trust-on-first-use for most people, with out-of-band fingerprint verification for the paranoid. It really depends on the threat model and the security practices/awareness of your colleagues, but a link shared on some social media or lower-security chat network is more vulnerable to a man-in-the-middle attack than a phone number for your average Joe. There are a lot of ways a person could get a manipulated invite link.