Signal adds an extra layer of security to make sure you're actually chatting with the right person

Signal has unveiled an enhanced security feature called Automatic Key Verification (AKV) to ensure users are connecting with the intended individuals. This new layer of protection counters potential "man in the middle" attacks where malicious actors could intercept encrypted communications. AKV facilitates the automatic verification of cryptographic keys associated with a contact, requiring no manual intervention.

To utilize AKV, users simply tap on a contact's profile, proceed to the "View Safety Number" screen, and press "Verify automatically." If the verification is successful, a green checkmark appears, indicating the contact's public encryption key aligns with Signal's key transparency system. This verification process hinges on a novel ledger system maintained by Signal. The ledger records any alterations to a user's information, such as phone number or username, with each update generating a new iteration.

This ledger, accessible via an open-source key transparency server, is complemented by an index that aids users and Signal's auditors in validating the ledger's integrity. The index enables the search and verification of data associated with a user or contact. However, the accuracy of the data contained in the ledger remains uncertain, underscoring the need for human oversight.

Cloudflare and Trail of Bits, two reputable third-party auditors, scrutinize the index to ensure no unauthorized modifications. Upon approval, they sign the response, confirming the authenticity of the encryption keys shared between users. While AKV bolsters security, it necessitates regular user monitoring. Both parties must periodically check their own and the other party's ledger entries to detect any potential tampering.

In summary, Signal's AKV fortifies encryption and maintains trust in user connections, albeit requiring consistent user vigilance. Users must verify the safety number or QR code for each contact or rely on Signal's built-in safety number verification. For contacts lacking a phone number in the user's contact list, AKV remains unfeasible. Nevertheless, AKV represents a significant stride in bolstering Signal's commitment to user privacy and security.