<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div apple-content-edited="true"><br> </div> <br><div><blockquote type="cite"><div><div><ol><li>Cracking the usable key verification problem. This move brings WhatsApp to the same level of security as iMessage (or better, given the forward security), but WhatsApp/Facebook could still do a switcheroo on people's keys. TextSecure never really figured this out IMO - it still expects people to manually compare long strings of hex.<br></li></ol></div></div></blockquote></div>On this point in particular, projects like SafeSlinger attempt to reduce the complexity of hex, but the inconvenience of synchronous communication for out-of-band verification remains. Does out-of-band become worthwhile if we give unobtrusive verification nudges in our UX's to the tune of "When you can see or hear Alice, tap here to verify her for good"?<div><br></div><div><div>Cheers,</div><div>Mike</div><div><br></div><div>Michael W. Farb</div><div>Research Programmer, Carnegie Mellon University CyLab</div><div>M 412-965-4725 - <a href="http://www.cylab.cmu.edu/safeslinger">www.cylab.cmu.edu/safeslinger</a></div></div></body></html>