4 ms·
On forging the identity of someone else, the author did mention it and the workaround is pretty simple (using a secret ID for each user): > There are some cave
by ohitsdom 9y ago
On forging the identity of someone else, the author did mention it and the workaround is pretty simple (using a secret ID for each user):
> There are some caveats to this method of course. For example, if a user knew of the script they could theoretically insert their own zero-width characters and accuse someone else. A better solution would be to insert a unique user ID that is not publicly available instead of the username.
- PurpleBoxDragon 9y agoIf someone manages to determine the secret ID then it fails. What about signing a combination of part of the message (likely some hash) and the user ID. This would create a secret ID, but one which if stolen can be shown to be false since trying to recreate the signature with their ID and the message would fail. Hash collisions between different messages are still a concern, but aren't their known solutions to that problem that can be implemented in combination?
- aldoushuxley001 9y agoCan't you just use a whitelist of allowable characters?