Security codes ("safety numbers" on Signal) are supposed to provide you with a means to detect malicious MITM attacks. Since most users don't check their contacts' numbers out-of-band -- or even verify their own codes regularly -- it's kind of a probabilistic mechanism. In theory these checks should dissuade attacks on the system, but in practice does it? This post illustrates one of the many reasons the solution is…
Yes, a system with so many false positives will be ignored by users. Warnings should only occur if a genuine problem is detected. Ideally we'd all use an append-only merkle log ala certificate transparency to lookup public keys. This is much harder to MITM, and you can do lookups over onion routing to make it even harder. Of course, if your identifiers have PII (like phone numbers in Signal and Whatsapp) this is not…
I'd love to hear what you think about a log a few colleagues and I have designed. We've tried to get to the essence of transparency logging. It's a minimalistic design, and it doesn't require trusting the log operator.
www.sigsum.org