2 ms·
Email is a plaintext protocol, so having a number in an email really just means that you saw the email, not that you know Peggy's password.
by windows_tips 8y ago
Email is a plaintext protocol, so having a number in an email really just means that you saw the email, not that you know Peggy's password.
- jasode 8y agoRight. It's not irrefutable proof beyond all standards of doubt but it's "enough proof" to Vimeo/verifier that Peggy controls that email account. Whatever arbitrary threshold of proof it is, it's in in the eye of the beholder (the verifier). It's up to Vimeo to arbitrarily decide that getting a matching number is "verifying" Peggy's email account. Instead of the "proof" aspect, the email example is highlighting what the "zero knowledge" refers to. Whether Peggy's account is compromised or wiretapped by man-in-the-middle attacks, Vimeo/verifier still has zero knowledge of her email account's password.
- windows_tips 8y agoIf Peggy has to use the password since recieving the email, vimeo could put bounds on the password length, at least.