💾 Archived View for bbs.geminispace.org › u › jeang3nie › 1684 captured on 2023-07-22 at 18:02:23. Gemini links have been rewritten to link to archived content
-=-=-=-=-=-=-
Re: "Verification of Sender Certificate"
There is a potential flaw in this scheme for getting the user's hash, and since I don't want to type it all back in again I'll direct you to this other conversation where I elaborate on it a bit.
— bbs.geminispace.org/s/discuss/1679
2023-06-08 · 6 weeks ago
Thanks @jeang3nie for your clarifications and that there still is work to be done on cert verification (empty message loop etc.)
Verification of Sender Certificate — Greetings, maybe I oversaw this in the spec, but if a client connects with a TOFU / self-signed certificate for chuck@norris.com is there any verification done to ensure that the client is not spoofing the sender address? I could think of something like a back-connection to a kind of "misfin MX" record (well SRV record would be perfect for that) and checking if the presented client certificate is signed by the norris.com server certificate.