Check who you’re calling

The whole system is based on one assumption: that the public key you’re using is indeed that of the person you’re communicating with. Otherwise, the man-in-the-middle attack rears its head again.

The role of the server

Messaging services distribute public keys via their servers. This is convenient, but it creates a dependency: a malicious server could give you its own key instead of Bob’s.

Alice  <--(Eve's key, presented as Bob's)--  [S]

Everything would appear to be working normally.

The fingerprint

The solution is an out-of-channel verification. Every conversation has a fingerprint — a number or a QR code derived from the two public keys.

If Alice and Bob see the same fingerprint, no key has been substituted. Comparing it requires another channel: meeting in person, phoning each other, or showing each other their screens. The server cannot falsify a face-to-face conversation.

Key change

When someone re-installs the app or changes their phone, their keys change and the app alerts them that the fingerprint has changed.

This message is almost always harmless. But it is exactly what you would also see during an attack, and that is precisely why it is displayed.

The right thing to do: if the conversation is sensitive and the alert appears without explanation, ask for confirmation by another means before continuing.

An honest limitation

Hardly anyone compares fingerprints. In practice, therefore, the system relies on trust in the operator — with the crucial difference that a substitution can be detected by those who carry out checks.

This is the same reasoning behind Certificate Transparency: making fraud detectable, if not preventable. An operator who substitutes keys on a large scale runs the risk that a single vigilant user will spot it and make it public.