4 ms·

Why is this obvious? I don't know much about crypto but I'd imagine it's possible for an protocol to not reveal the identity of the authenticating party. For e

by kanox 7y ago

Why is this obvious? I don't know much about crypto but I'd imagine it's possible for an protocol to not reveal the identity of the authenticating party. For example a server can send a challenge which requires knowledge of the private key to solve but does not reveal anything from the client on failure. If the server has multiple authorized_keys it could just send multiple challenges and accept a reply for any of them. Am I missing something? This seems like a nice privacy feature.

vore 7y ago
If you don't know the identity of the authenticating party, how does the authenticating party log in to their account?
- saagarjha 7y ago
  They tell you which account they want to log in as, which isn't necessarily their global identity they'd like to share with you.
  - kanox 7y ago
    Exactly: you wouldn't be able to ssh git@github.com/repo/proj but rather have to use user@github.com/proj/repo and this would be better.