Hacker News Reader

Comment by publiush | Hacker News Reader

> Between "there's no guarantee that the message viewed by a user was actually written by the poster" and "You absolutely cannot fake a message being cryptographically signed without providing a broken verification function" you moved the goalposts so hard it gave me whiplash and I'm afraid I can't continue this discussion due to my concussion.

I think it might be wise to review what signing means to understand that I didn't "move the goalposts" at all [1], but thanks for the discussion, as I merit it will help a lot of people to better understand the power of cryptography as I'm guessing it's a new field here as of yet.

Happy New Year!

[1] https://en.wikipedia.org/wiki/Digital_signature

View on HN

No, they're absolutely right. You can steal a person's computer. You can get them drunk and ask them to hand over their keys. There are a dozen ways off the top of my head that you can have a message that's not written by the supposed poster without a broken cryptographic function.

As always, there's a relevant XKCD https://xkcd.com/538/

This is solved with key management and security as opposed to with the fact on whether or not the technology has merit. Now, we're really moving goalposts. ;)

Sure, but you're ignoring flaws in the security to make a stronger marketing message for your site. Yes, there is nothing you can do about this, it's not under your purview. But nevertheless you can't make so strong a claim as to say that a message can't be faked without a broken verification function. It simply can't be faked in one particular way.

If Person B published a message under Person A's name, that is, to the non-crypto world, a faked post. They're not going to be impressed by your argument that actually it isn't faked, it's real, Person B just had access to Person A's computer.

Again, this is a security issue and doesn't in any way reduce the proven efficacy of cryptography. It's pedantic at best, and I am going to stop replying to your comments.

Happy new year.

That's fine, I'm not looking to debate, I'm trying to help. You're here presumably looking for input on your new project, but you're not taking any of it, and getting very defensive whenever anyone offers anything other than praise.

I'm not making a comment out of pedantry, I'm telling you how I expect this is going to be seen by regular users. People on the whole are not interested in whether or not some particular security system is theoretically perfect, they're interested in whether or not it actually provides the security that they interpret it to promise. And they will interpret your claims as meaning that messages cannot come from anyone other than the signed user, which is going to be a problem the first time that assumption fails. And it will fail, because people aren't good at keeping secrets secret.

Reply on news.ycombinator.com