Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > rocksolid.programming > #214

None

Show all headers | View raw

>>f1407c66ccddbbe4ee
>Either way and the user must trust the code of
>course. If it's a matter of trust, maybe javascript is
>the easiest way. 

the easiest way to code, yes. it might be easier for users to trust a standalone client than to switch on js in general (especially true for the users that might be interested in this kind of identity management I think).

>If you allow the js, you can sign, if you don't it's just a feature you don't use.

Yes, js is certainly a way to do it. Of course, we could also do both in parallel.

>Also, another idea:
>rslight currently adds a hash to all outgoing messages 
>built from the the message and header, and the site 
>key. This is sort of a signature that shows the post is 
>really from this site. Adding the username is very 
>simple to do, plus all rslight users have a key in

using this for identity management would make it dependent on the server(s).
using pgp would be independent of the servers: server admins could not spoof signatures, and it would not matter where the message was obtained, any signature could also be checked locally as well (on the users box).

>Then there would need to be trusted communication 
>between nodes to share this trust. I think we'd like to 
>do this for other features/reasons also, so it could be 
>useful.

I agree this could be useful. Could be done with signatures as well, or secret keys (server addresses).

-- 
Posted on def2

Back to rocksolid.programming | Previous | Next | Find similar | Unroll thread

Thread

None Anonymous <poster@anon.com> - 2020-12-31 04:20 -0800

csiph-web