Johnathan Corgan [ARCHIVE] on Nostr: 📅 Original date posted:2013-11-02 📝 Original message:On 11/01/2013 10:01 PM, ...

📅 Original date posted:2013-11-02
📝 Original message:On 11/01/2013 10:01 PM, bitcoingrant at gmx.com wrote:

> Server provides a token for the client to sign.

Anyone else concerned about signing an arbitrary string? Could be a
hash of $EVIL_DOCUMENT, no? I'd want to XOR the string with my own
randomly generated nonce, sign that, then pass the nonce and the
signature back to the server for verification.

--
Johnathan Corgan, Corgan Labs
SDR Training and Development Services
http://corganlabs.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: johnathan.vcf
Type: text/x-vcard
Size: 334 bytes
Desc: not available
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20131102/09685fb5/attachment.vcf>;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 230 bytes
Desc: OpenPGP digital signature
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20131102/09685fb5/attachment.sig>;