4 ms·
Making the public key of the remote available to JS wouldnt help because if you can't trust the identity of the remote server or integrity of the connection the
by nly 9y ago
Making the public key of the remote available to JS wouldnt help because if you can't trust the identity of the remote server or integrity of the connection then you can't trust the javascript.
Tor hidden services are secure because of the lack of human meaningful names.
See: https://en.wikipedia.org/wiki/Zooko%27s_triangle https://en.wikipedia.org/wiki/Zooko%27s_triangle
- kernelPan1c 9y agoYes, since you can't trust the JS, doing this would be an attempt at security through obfuscation. I mostly just think it's strange that these keys aren't accessible. If there were ever a mismatch detected, the server could at least know with certainty that there's a bad actor on the connection. Thanks for Zooko's Traingle wiki. Hadn't seen that one before.