Signal: Safety number updates
whispersystems.org
Signal: Safety number updates
1–10 of 18 posts
Re: Signal: Safety number updates
#2[deleted]
Re: Signal: Safety number updates
#3Enabling the advisory mode by default seems like a mistake, at least with the current UI. It is so unobtrusive that it carries a very distinct implication of "we've looked into this for you, and you don't need to worry about it", which is not the case. The iconography of the shield also implies this - it says "Signal is protecting you".
The message probably needs to be more explicit: "Voltairine de Cleyre isn't using the same safety numbers anymore. Probably this contact just has a new phone or reinstalled Signal, but you might want to confirm the new safety numbers with them.". And the accompanying icon should be an ! or ? or something.
Re: Signal: Safety number updates
#4Enabling the advisory mode by default seems like a mistake, at least with the current UI. It is so unobtrusive that it carries a very distinct implication of "we've looked into this for you, and you don't need to worry about it" , which is not the case. The iconography of the shield also implies this - it says "Signal is protecting you". The message probably needs to be more explicit: "Voltairine de Cleyre isn't usin…
Yeah, while a security conscious user would probably be curious about this and investigate, I think an average user would just ignore it.
I've been talking with people who haven't noticed when I change the disappearing messages on/off, which has the same appearance and displays in the same place as these advisory messages, so clearly some people are already ignoring them.
Re: Signal: Safety number updates
#5How do you view safety numbers on iOS?
Re: Signal: Safety number updates
#6These changes seem to bring it much closer to the implementation in WhatsApp, although WhatsApp defaults to accepting modified fingerprints.
Re: Signal: Safety number updates
#7How do you view safety numbers on iOS?
Answer: tap (not long press) the name in the conversation header.
Re: Signal: Safety number updates
#8Enabling the advisory mode by default seems like a mistake, at least with the current UI. It is so unobtrusive that it carries a very distinct implication of "we've looked into this for you, and you don't need to worry about it" , which is not the case. The iconography of the shield also implies this - it says "Signal is protecting you". The message probably needs to be more explicit: "Voltairine de Cleyre isn't usin…
I agree on both points. Muted red text and a broken/unlocked padlock would convey the intent a lot more clearly.
Re: Signal: Safety number updates
#9The problem is non security minded users probably won't take the time to verify the numbers in the first place. They should look into a method that verifies identities without user interaction. Possibly by having signal store users public keys after they verify their phone numbers or better yet provide users with signed certificates for verification purposes.
Re: Signal: Safety number updates
#10The problem is non security minded users probably won't take the time to verify the numbers in the first place. They should look into a method that verifies identities without user interaction. Possibly by having signal store users public keys after they verify their phone numbers or better yet provide users with signed certificates for verification purposes.
I can't think of a way to do that automatically in a way that can't be MITM'd.