&gt; it&#x27;s difficult and we&#x27;re exceedingly bad at it<p>We&#x27;re bad at it, because we can&#x27;t tell the difference between a &quot;QR code is a hash of the public key&quot;, and a &quot;QR code is something WhatsApp tells us represents this other person.&quot;<p>Why not just use pictures of puppies? <i>Pick the puppy you&#x27;ve seen represent this person before, and be suspicious if the puppy&#x27;s changed! Try talking to them in person about the puppy icon used for them and make sure they match!</i> That is actually <i>more secure</i> than the QR code, even if it still doesn&#x27;t protect you from WhatsApp.<p>The reason we&#x27;re talking about QR codes is because they <i>seem</i> more secure than puppies; to make someone think that this QR code is actually security measure! While this attack may be &quot;foiled&quot; by E2E cryptosystems, it&#x27;s important to note the big fucking trapdoor that means WhatsApp isn&#x27;t actually providing E2E protection.<p>Conflating <i>this simple fact</i> with the overarching boogeyman of &quot;validating software&quot; does the discussion a disservice.