user5157: Let's say you have person A who wants to pay person B.
A common way for B to communicate his/her address to A is by QR code or email or some such non secure method either of which could be substituted for another address in a man-in-the-middle attack, by person C. In other words C contrives a situation where they can replace B's address with their own, thereby making A pay C instead of B.
This would be even harder to prevent if A and B were continents apart. Not only would A not be able to see B or perhaps even talk to them, but they would also have some difficulty carrying out even basic checking.
Is there a way to stop a man-in-the-middle attack when communicating addresses in this sort of circumstance?

user7043: No. That is impossible if A and B have never communicated through a secure channel to exchange keys before, unless you are willing to trust another user, for example a user, D, you know and have safely exchanged keys before, that says it trust users B address, creating a web of trust or less preferable a certificate authority. This is a known and significant issue in public key exchange.

5157: <p>Let's say you have person A who wants to pay person B.</p>

<p>A common way for B to communicate his/her address to A is by QR code or email or some such non secure method either of which could be substituted for another address in a man-in-the-middle attack, by person C. In other words C contrives a situation where they can replace B's address with their own, thereby making A pay C instead of B.</p>

<p>This would be even harder to prevent if A and B were continents apart. Not only would A not be able to see B or perhaps even talk to them, but they would also have some difficulty carrying out even basic checking.</p>

<p>Is there a way to stop a man-in-the-middle attack when communicating addresses in this sort of circumstance?</p>
 7043: <p>No. That is impossible if A and B have never communicated through a secure channel to exchange keys before, unless you are willing to trust another user, for example a user, D, you know and have safely exchanged keys before, that says it trust users B address, creating <a href="http://en.wikipedia.org/wiki/Web_of_trust" rel="nofollow">a web of trust</a> or less preferable a <a href="http://en.wikipedia.org/wiki/Certificate_authority" rel="nofollow">certificate authority</a>. This is a known and significant issue in public key exchange.</p>
