Additionally keep static qr codes for offline out-of-band verification?

[testbird]

@adbenitez

probably it is easier to just use the email, in the end you want to use the email to send the message to the other peer, and it is easier to just use the email, than implementing a way to connect offline

I really don’t think the QR+hidden-system-emails mechanism has been easier to implement. The introduction of hidden system messages even introduces additional security risks. And that mechanism has for sure nothing to do with the widely recognized out-of-band key verification, and calling it key verification is misleading.

Deltachat’s current QR-contact-setup protocol is highly controversial. It’s rather a chained remote key installing mechanism. (QR verfication · Issue #168 · deltachat/deltachat-core · GitHub)

But implementing a real two-way out-of-band (offline) verification should actually not be hard, given that all the necessary parts for the one-way out-of-band transmission are already there. See this thread:

Release the basic QR-Code "contact scanning" feature independently

@r10s, who wanted to have this discussed here: Two things to improve for releasing a basic version of the current QR-Code “contact scanning” feature from the current “lab code”: Show the own QR-Code during QR scanning. Keep the scanner running after a successful scan, to allow further scans (by the other side to let both sides add the OOB contact data, or scan further contacts in a group meetings). Advantages: solves usability issues with current code have a basic, classic “two-way” contac…