How does a new user verify he's getting the correct tangle from others in the network? Unlike blockchain protocol in which the user can rely on the growing chain to be sure he is not been fed with fake transactions, I'm not seeing an obvious way to verify this in IOTA protocol.
In IOTA, we rely on something similar to length as well. But we can't say how "long" a DAG is because there can be multiple paths to any transaction. Instead we use weight to say how many transactions reference another one.
(Learn more about weight)
As you said, in a blockchain, the longest chain is the correct chain:
In the tangle, the transactions that have more weight are the correct transactions:
The IOTA network is very young. There are only about 1-2 transactions per second being made. It would be easy for an attacker to make a lot of transactions and make an incorrect tangle to a correct tangle.
This is one reason why the Coordinator exists. It issues transactions (called milestones) that only reference the correct tangle:
With the coordinator, it's quiet simple : you must see the milestone transactions in your tangle. If you don't see them: your view of the tangle isn't synchronized. Milestone indexes are public, so you can check in real time from another source if your are sync.
Without the coordinator, things are more tricky. But, in the end, it's similar to the idea of the "longest chain win" in Bitcoin. Let's say that "the biggest branch of the tangle is the true one".
If you attach a transaction in the main branch: your transaction will quickly be confirmed by many other transactions (because the tip selection algorithm will "by design" increase the biggest branch faster - and note the dual formulation "due to tip selection algorithm: bad branches will die quickly" -).
If you attach a transaction to a "bad" branch : your transaction will never be confirmed and you need to re-attach it, hopefully on the main branch.
Bitcoin have similar "problem": if your transaction is included in a block that is not included in the longest blockchain, you have to wait for another block.