Path: csiph.com!weretis.net!feeder6.news.weretis.net!i2pn.org!i2pn2.org!.POSTED!not-for-mail From: Anonymous Newsgroups: rocksolid.programming Subject: None Date: Thu, 31 Dec 2020 04:20:05 -0800 Organization: i2pn2 (i2pn.org) Message-ID: References: Content-Type: text/plain; charset=UTF-8 Injection-Info: i2pn2.org; posting-account="def2"; logging-data="2072"; mail-complaints-to="usenet@i2pn2.org" Xref: csiph.com rocksolid.programming:214 >>f1407c66ccddbbe4ee >Either way and the user must trust the code of >course. If it's a matter of trust, maybe javascript is >the easiest way. the easiest way to code, yes. it might be easier for users to trust a standalone client than to switch on js in general (especially true for the users that might be interested in this kind of identity management I think). >If you allow the js, you can sign, if you don't it's just a feature you don't use. Yes, js is certainly a way to do it. Of course, we could also do both in parallel. >Also, another idea: >rslight currently adds a hash to all outgoing messages >built from the the message and header, and the site >key. This is sort of a signature that shows the post is >really from this site. Adding the username is very >simple to do, plus all rslight users have a key in using this for identity management would make it dependent on the server(s). using pgp would be independent of the servers: server admins could not spoof signatures, and it would not matter where the message was obtained, any signature could also be checked locally as well (on the users box). >Then there would need to be trusted communication >between nodes to share this trust. I think we'd like to >do this for other features/reasons also, so it could be >useful. I agree this could be useful. Could be done with signatures as well, or secret keys (server addresses). -- Posted on def2