DEV Community

Discussion on: End-to-End Encrypted Chat with the Web Crypto API

Collapse
 
shierve profile image
Sergi Canal

You could verify the public key fingerprint if you wanted to make sure. It is impossible as far as I know to be able to verify identity without each participant getting a certificate with their public key from some sort of CA.

Collapse
 
yoursunny profile image
Junxiao Shi

My buddy made an Android app that lets users scan each other's QR code that encodes the public key. Basically MITM is not preventable without an out of band channel.