How Trail of Bits helps verify the integrity of your Signal chats

Summary: Signal launched Automatic Key Verification, a key transparency feature that creates a globally consistent view of the public keys associated with each phone number so a compromised server cannot quietly substitute a false key. Trail of Bits built and operates one of the three auditors the system requires - alongside Signal and Cloudflare - and its from-scratch, open-source implementation signs Merkle tree heads so clients can confirm they see the same key set as everyone else, with a malicious server able to maintain a split view for at most one week before warnings appear.
What's compelling: The system's trust rests on three independent auditors, and clients require signatures from all of them within the last seven days - so a single compromised or unavailable auditor is enough to break verification for users.

Read the original at Trail of Bits Blog ↗