3 ms·

I was considering trying to implement this in an imageboard engine project, with the idea being that instead of relying on IP addresses as a way to curb abuse w

I was considering trying to implement this in an imageboard engine project, with the idea being that instead of relying on IP addresses as a way to curb abuse without requiring users to make accounts, every user would instead cryptographically sign their posts and that would serve as a form of identity while still practically speaking being more anonymous than having to log IPs. But the reliance on Microsoft and Apple, and there being no documentation I could find about how this would work on Linux or a BSD, made it a no go for me. I wish it were possible to authenticate to web services as easily as just sharing a GPG or SSH public key to a server and signing a challenge to prove your identity, but there would probably be security and usability concerns with doing something like that.

easrng 4y ago
Why not just use tripcodes like the others?
aeontech 4y ago
You might find the new “Privacy Pass” draft specification interesting then: https://datatracker.ietf.org/doc/draft-ietf-privacypass-architecture/03/ https://datatracker.ietf.org/doc/draft-ietf-privacypass-arch... and "Rate Limited Tokens" extension https://datatracker.ietf.org/doc/draft-privacypass-rate-limit-tokens/02/ https://datatracker.ietf.org/doc/draft-privacypass-rate-limi... (authors are from Google, Fastly, Apple, Cloudflare) I thought I saw this on HN before, but apparently not - submitted for discussion now at https://news.ycombinator.com/item?id=31852145 https://news.ycombinator.com/item?id=31852145