[messaging] Exposing MITM attacks socially engineered through group chat introductions

[carlo von lynX]

On Sun, Feb 01, 2015 at 02:53:24AM +0100, Jeff Burdges wrote:
> Anyways, the problem with the current situation is : If we do not identify a “fingerprint” that’s safe to publish, then users imagine they can publish the identity key, the public key, or both.  
> 
> This is not an academic discussion, multiple savvy users have told me they assumed they could publish both. 

I wouldn't expect the minority of existing PGP users to
be relevant. Would anyone else have the impulse to publish 
a series of apparently random characters anywhere.

Is there any reason at all why this data is being displayed 
by the UIs? I don't see any use for it anywhere. Manual keying 
works by exchanging armors, no need to ever look at fingerprints.


-- 
  E-mail is public! Talk to me in private using Tor.
  torify telnet loupsycedyglgamf.onion		DON'T SEND ME
          irc://loupsycedyglgamf.onion:67/lynX  PRIVATE EMAIL
         http://loupsycedyglgamf.onion/LynX/    OR FACEBOOGLE