Signal Introduces Automatic Key Verification to Prevent Man-in-the-Middle Attacks

New Security Feature for Encrypted Chats

Signal has rolled out Automatic Key Verification, a new security feature designed to enhance the integrity of encrypted conversations. This system provides users with an automated method to confirm that their chats have not been intercepted or tampered with.

How Automatic Key Verification Works

The feature operates as part of a 'key transparency' system, leveraging Cloudflare and Trail of Bits as independent third-party auditors. These auditors work alongside user and connection verifications to ensure the global consistency and transparency of the association between a phone number or username and its public encryption key. This process offers the same assurance as manual safety number verification but without requiring in-person meetings or secondary communication channels.

Protection Against Key Swaps

According to Signal software engineer Katherine Yen, this system protects against scenarios where a key could be swapped without the key owner's knowledge. This includes situations where a malicious party might compromise Signal and associate a different key with a user's connection. The continuous verification by users, their connections, and third-party auditors ensures the consistency of keys across the Signal ecosystem.

User Control and Previous Safeguards

Users can enable Automatic Key Verification through Signal's privacy settings. They also have the option to disable it and continue using manual safety number verification if they prefer not to rely on the automatic system or independent auditors. This new feature complements Signal's existing safety number system. In May, Signal also introduced warning messages and in-app confirmations to protect users against phishing and social engineering attempts, following attacks attributed to Russian state-sponsored hackers.