Post #2545430
2026-05-12 13:06 UTC
@qgustavor@urusai.social @signalapp@mastodon.world i think you've just demonstrated exactly why website-based verification is maybe not a good idea. something website-based requires you to first know the website.
if the two of us are talking, then my safety number changes and the new person who may be me says "hey no worries, it's still me, see my profile even says verified" and that verification points to talya.net, how do you know it's me who owns that domain? and how you know it wasn't talya.xyz before?
Replies (1)
-
@Yuvalne@433.world 2026-05-12 13:08
@qgustavor@urusai.social @signalapp@mastodon.world because if you don't trust people to check others' safety numbers, can you trust them to know they're looking at the correct website verification? or will they just see "verified" and trust it? heck, Signal specifically doesn't do verification for you. even if you scan the safety number QR, you still need to manually toggle verification. do we really think making this controlled by the other party makes things *more* safe?