All of my Signal/Telegram/WhatsApp contacts are unverified in the app itself, but almost all of them are de facto verified by other means; we plan meeting up at bars and I know who I'm chatting with because the person I expect shows up. Or we send emails or communications via other means and the conversations match.
I don't need to verify the code because everything else about the communication matches.
Re:Why is no one signing their emails?
by oarsinsync on Wednesday March 13, 2019 @12:37PM
(#19380422)
None of that ensures you have message privacy. If you haven't verified the key, you have no assurance that the connection hasn't been MITM'd.
What's worse is that Whatsapp doesn't tell you if they changed the key, so there is no protection against MITM.
Re:Why is no one signing their emails?
by oarsinsync on Friday March 15, 2019 @07:43AM
(#19398725)
You need to enable security notifications, and you will be notified of key changes.
> Turn on this setting to receive notifications when a contact's security code has changed. Your messages and calls are encrypted regardless of this setting.
WhatsApp used to. Did they stop?
I don't use Whatsapp, so I don't actually have first-hand knowledge. Now that I think about it, it may be that I was told that it automatically regenerates the key more often than they need to, which would have the same effect.
Re:Why is no one signing their emails?
by oarsinsync on Friday March 15, 2019 @07:44AM
(#19398731)
I don't believe this is true. Every time I've asked about a key change, it has been because someone either got a new phone, reinstalled the app, or reset their phone.
I'd prefer to verify all of my contacts but, given my security model, this is good enough and a huge step up from email.