3 ms·
If someone manages to determine the secret ID then it fails. What about signing a combination of part of the message (likely some hash) and the user ID. This
by PurpleBoxDragon 9y ago
If someone manages to determine the secret ID then it fails. What about signing a combination of part of the message (likely some hash) and the user ID. This would create a secret ID, but one which if stolen can be shown to be false since trying to recreate the signature with their ID and the message would fail. Hash collisions between different messages are still a concern, but aren't their known solutions to that problem that can be implemented in combination?
- aldoushuxley001 9y agoCan't you just use a whitelist of allowable characters?