Isn't any encrypted communication without some form of identification susceptible to man in the middle attacks?
Real Users never know what they want, but they always know when your program doesn't deliver it.