42 ms·
With "actor" you mean "user"? Every user has their own private key?
by Timja 4y ago
With "actor" you mean "user"?
Every user has their own private key?
- easrng 4y agoSure an actor is basically a user, there's usually an "instance actor" though too that does some other things but I don't think having one is required. Every actor has a private key but it's kept on the server, it's basically an implementation detail.
- Timja 4y agoStrange that users have private keys. Is that kinda forward-looking, so that at some point those keys could be moved to the users themselves? So they can keep their identity, even if the owner of their instance becomes malicious?
- half-kh-hacker 4y agono lol
- Timja 4y agoThen why?
- oever 4y agoThe private key is used in HTTP Signatures for authentication. The signature does not cover the body of the http request and is not stored or published. The http post contains an http headers that signs just a few other header fields. The signature is only valid for a short time. There is an example here: <https://blog.joinmastodon.org/2018/06/how-to-implement-a-basic-activitypub-server/ https://blog.joinmastodon.org/2018/06/how-to-implement-a-bas...>