mandevil 19 hours ago

If you have done the out-of-band safety number verification, then impersonation attempts will give you a warning that their safety number has changed. I know this because I got that error when my wife replaced her cell phone.

I believe (though I haven't verified it myself) that even if you haven't verified the numbers using an out-of-band exchange mechanism, you will get a warning if the safety number as observed by their server changes. I believe they would need to know your Signal PIN to restore from backup, which means that even if you've set that it will give an alert, presuming basic security competence from the people you are conversing with.

Reply View 2 replies
  • AnonC 18 hours ago

    > If you have done the out-of-band safety number verification

    I personally have never seen anyone do this, even when they’re supposed to do it right from the very beginning. So practically this is of very little value to most of the user base.

    Reply View 0 replies
  • vel0city 16 hours ago

    You get notifications if the safety number gets changed from a device change either way. But doing the in person validation helps ensure that particular safety number you received was actually their safety number and not a MitM on first contact.

    Reply View 0 replies
godelski 18 hours ago

  > Impersonation
Yes, but with a canary. Would you rather not have a canary? The other person also receives a warning that the verification number has changed. It's not like the existence of a phone number is what creates the ability to hijack an account. And again, you can do registration locking so that solves that problem.

You can also do verification of your contacts. Best done in person where you can check the keys.

  > MITM attack
I don't think that means what you think it means. Who is in the middle? This is E2EE
Reply View 0 replies