3 ms·
I'm not sure about the details of the protocol (maybe someone can check?), but the client software can probably distrust certain trusted verifiers or even use a
by ivan_gammel 2y ago
I'm not sure about the details of the protocol (maybe someone can check?), but the client software can probably distrust certain trusted verifiers or even use a public list of such revocations. If this opportunity is exploited by malicious actors, there must be a simple and fast escalation path to revoke verification (you complain to verifier, then to maintainers of revocation list).
- steveklabnik 2y ago> the client software can probably distrust certain trusted verifiers Any client can do whatever they want with the information, that's right. > or even use a public list of such revocations. Revocation is deletion, so it's hard to enumerate revocations.
- ivan_gammel 2y ago> Revocation is deletion, so it's hard to enumerate revocations. In decentralized design it is not. A server can continue to list verified accounts, a 3rd party revocation list may mention some of them, a client will show only accounts not in the list as verified.