5 ms·
As i understand it you have to be careful with signing short messages with no metadata or context.. reply to some tweet with > this is a great idea and sign o
by justinsaccount 6y ago
As i understand it you have to be careful with signing short messages with no metadata or context.. reply to some tweet with
> this is a great idea
and sign only that text.. now there's a signature of "this is a great idea". I believe the signature has the creation time, but there's nothing to tie it to the message you are replying to.
- thephyber 6y agoWhat is lost here by doing so? If someone tries to imitate your Twitter account: - they could clone your signed messages, but *you* wrote them. - they could use a new PGP key to sign their messages, but they aren't claiming your PGP identity - modern cryptographic algos have many resistance properties so your stated scenario is not a weakness
- vimax 6y agoSuch a short signed message could be used out of context in the future. Bob somewhere else is talking about a different idea, and I claim to be Alice and send Alice's signed "this is a great idea" message. The signature checks out, and it seems to be in response to what Bob is talking about, so Bob would assume Alice think his idea is great. You want to make sure that whatever you signed can't be used against you out of context. It would be safer to sign a message like "date> {today's date}, re> {parent message hash}, this a great idea"
- mirimir 6y agoBack in the day, I used to PGP sign Usenet messages. I used a news reader where I could specify message ID. So I signed text that included the date and message ID.
- kbenson 6y agoI guess you could make sure each signed tweet starts with a YYYY-mm-dd HH::MM::SS (TZ) line by itself. At least then a reused old message would look weird because the time would be wrong, and easily visible (but also easily ignored in the common case, which is probably what is wanted).
- deleted 6y ago[deleted]