TL;DR
BitMessage doesn’t have a built-in way to *guarantee* the identity of someone sending you messages. You need to independently verify their key fingerprint (a long string of characters) through another secure channel, like meeting them in person or using a trusted third party. This guide explains how to check keys and what risks are involved.
Checking Sender Keys
- Understand Key Fingerprints: Every BitMessage user has a unique key pair (public and private). The public key is used for sending encrypted messages *to* them. A key fingerprint is a short, human-readable representation of the full public key. It’s like a digital ID.
- Where to find it: In your BitMessage client, you can usually see the key fingerprint associated with each address in your address book or when receiving messages from new senders.
- Get the Fingerprint Independently: This is the most important step! You *must* obtain the sender’s key fingerprint through a channel you trust.
- In-person verification: The best method. Ask them to show you their BitMessage client and verify the fingerprint matches what they tell you.
- Trusted Third Party: If meeting in person isn’t possible, use a trusted friend or service (if one exists) to relay the key fingerprint.
- Avoid online methods: Do *not* rely on receiving the fingerprint via email, social media, or any other channel that could be compromised.
- Compare Fingerprints: Carefully compare the fingerprint you received independently with the one displayed in your BitMessage client.
- Double-check: Look for even small differences. A single incorrect character means you’re not talking to who you think you are.
- Add Address (If Verified): If the fingerprints match, add the sender’s address to your address book.
- This tells BitMessage that you trust messages from this address.
What if I can’t verify?
If you cannot independently verify the key fingerprint, treat all messages from that sender as potentially untrustworthy.
Risks of Not Verifying
- Man-in-the-Middle Attacks: Someone could intercept your communications and replace their key with their own. You’d be sending encrypted messages to them instead of the intended recipient.
- Impersonation: An attacker could pretend to be someone else and send you malicious or misleading information.
Checking Existing Addresses
If you’ve already added addresses, it’s a good idea to periodically re-verify their fingerprints.
Advanced: Key Revocation (Limited Support)
BitMessage has limited support for key revocation. If a key is compromised, the sender can publish a revocation message. However, this relies on you receiving and processing that message before sending further communications. It’s not a foolproof system.