4 ms·
You have to be careful. To be more sure you'd need another means to verify their authenticity (for example a SSL certificate). And preferably use a SSL certific
by wladimir 16y ago
You have to be careful. To be more sure you'd need another means to verify their authenticity (for example a SSL certificate).
And preferably use a SSL certificate to authenticate yourself as well instead of a user/password pair.
Sure, most websites still live in the 90's where it concerns security, but with P2P it suddenly starts to become much more important to have proper authentication for both sides :)
- eli 16y agoIt's not really a decentralized system if it relies on a central signing authority. I'm not sure what problem this solves.
- wladimir 16y agoSSH also checks public keys, without relying on any central signing authority. You could generalize this to SSL easily. You do need to be able to publicize your public key somehow with as little risk of MiTM as possible, but every secure communication method has this problem. Tor solves this by making a hash of the public key part of the URL. Of course, there might be more user-friendly solutions.