4 ms·

I was thinking the other day about a digital signature for limited character tweets. Provided I’m not a cryptography expert and you should explore my ideas wit

I was thinking the other day about a digital signature for limited character tweets. Provided I’m not a cryptography expert and you should explore my ideas with caution, why not even just sign every tweet with an ed25519 signature? It’s on 64 bytes tacked onto the message and easy to verify...

andy_ppp 6y ago
Or put the tweets onto a blockchain...
- rudolph9 6y ago
  I mean you could but seems unnecessary. Putting tweets on a blockchain would make it very difficult to delete them or edit them but offer no more certainty than a regular tweet that includes a signature verifiable with a known public key of mine. I just don’t don’t want someone impersonating me on any one of the many random website I have a profile where anyone with access to the db can write whatever they want under my name.
acid__ 6y ago
How do you plan on managing the signing keys?
- rudolph9 6y ago
  Hardware security module
  - acid__ 6y ago
    Seems like it would be a nice feature for security-minded folks, and would probably be pretty difficult to roll out to regular consumers. Does Mastodon have something like this? Sounds like something their userbase would appreciate.
    - rudolph9 6y ago
      You could literally dump the signature in at the end of the utf-8 tweet. A tweet can contain about 500 bytes, the signature is 64 bytes; encode it using utf8 characters and you got plenty of room room for a message and a signature I’m honestly surprised this isn’t common already in the crypto space and kinda wonder if I’m missing something
      - acid__ 6y ago
        For sure, the hard part isn't building it, it's getting people to actually use it. The amount of effort involved of actually acquiring and transporting a hardware security key is well beyond what most "normal" people are willing to do. Plus, reading your example in a different comment, it's completely jarring to someone who isn't used to reading things in that format.
        rudolph9 6y ago
        I get why everyday users don’t use it but why doesn’t an org like coinbase? Yes the quick and dirty poc I built in 5 minutes is a bit jarring but it could easily be adjusted so the beginning of the tweet reads like it normally would and the end is the cryptographic signature nearly separated from the main message.
rudolph9 6y ago
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 hi hacker news -----BEGIN PGP SIGNATURE----- iIIEARYKACoWIQSiJQKEVJeJondn78BXE/NAGxPd0QUCXw/JqwwcZm9vQGJhci5j b20ACgkQVxPzQBsT3dGf1gEAwMzbCxEaEJzRjJwFe90TRrXZiIe4KD9cZ64CHZEz eKEA/3W0ZIx6TOASPrzuTLytBK8OsL9FFAVWMUGTyLJSSh8O =ORB6 -----END PGP SIGNATURE-----
- rudolph9 6y ago
  pubkey: https://gist.github.com/rudolph9/bd672dc6d50a51a7d3f5352a918ae021 https://gist.github.com/rudolph9/bd672dc6d50a51a7d3f5352a918... A little more cumbersome than I imagined but proves that the contents of a tweet can contain a message and a digital signature.
  - rudolph9 6y ago
    I think I may have just re-invented keybase.io haha.

andy_ppp 6y ago

Or put the tweets onto a blockchain...

rudolph9 6y ago
I mean you could but seems unnecessary. Putting tweets on a blockchain would make it very difficult to delete them or edit them but offer no more certainty than a regular tweet that includes a signature verifiable with a known public key of mine. I just don’t don’t want someone impersonating me on any one of the many random website I have a profile where anyone with access to the db can write whatever they want under my name.

acid__ 6y ago

How do you plan on managing the signing keys?

rudolph9 6y ago
Hardware security module
- acid__ 6y ago
  Seems like it would be a nice feature for security-minded folks, and would probably be pretty difficult to roll out to regular consumers. Does Mastodon have something like this? Sounds like something their userbase would appreciate.
  - rudolph9 6y ago
    You could literally dump the signature in at the end of the utf-8 tweet. A tweet can contain about 500 bytes, the signature is 64 bytes; encode it using utf8 characters and you got plenty of room room for a message and a signature I’m honestly surprised this isn’t common already in the crypto space and kinda wonder if I’m missing something
    - acid__ 6y ago
      For sure, the hard part isn't building it, it's getting people to actually use it. The amount of effort involved of actually acquiring and transporting a hardware security key is well beyond what most "normal" people are willing to do. Plus, reading your example in a different comment, it's completely jarring to someone who isn't used to reading things in that format.
      - rudolph9 6y ago
        I get why everyday users don’t use it but why doesn’t an org like coinbase? Yes the quick and dirty poc I built in 5 minutes is a bit jarring but it could easily be adjusted so the beginning of the tweet reads like it normally would and the end is the cryptographic signature nearly separated from the main message.

rudolph9 6y ago

rudolph9 6y ago
pubkey: https://gist.github.com/rudolph9/bd672dc6d50a51a7d3f5352a918ae021 https://gist.github.com/rudolph9/bd672dc6d50a51a7d3f5352a918... A little more cumbersome than I imagined but proves that the contents of a tweet can contain a message and a digital signature.
- rudolph9 6y ago
  I think I may have just re-invented keybase.io haha.