Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

There's the interlock protocol that ensures that you'll only be talking with one other party instead of one other and one in the middle but still you don't know who you're talking to.

But it's impossible to identify someone out of nowhere. Even in physical life we need external information of a person or an organization we don't know to identify him.

So, we will always need some leads with which to cross-check the other party's identity. And given that, there are plenty of protocols to exchange symmetric keys securely.



But that's exactly the problem, that there is no way to securely verify over an insecure connection that the keys you've associated with A are actually A's keys.


That's really a non-problem since how could you ever know?

The only way to verify that A's keys are legit is to use a secure channel first. Then you can leverage that over any number of insecure channels later to reconnect with A.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: