Hi, I think Ismail was trying to answer your first question when he described the private indices in the CONIKS key directories. What these private indices do, in other words, is obfuscate the usernames in the directory, so an attacker who breaks into the server cannot see the usernames registered at the compromised key server. As for your second question, we haven't fully fleshed out the mechanism you found. But if you want to use Tor Messenger for your Twitter account, you will have to register your legitimate Twitter name with the key server. Our idea is that you will receive some kind of email with a confirmation link to prove that you own the Twitter account. This, by no means, means that Tor Messenger now has access to your full account. But Tor Messenger does need to confirm that you own the Twitter name you're registering to prevent an attacker from trying to impersonate you. It's also important to note that CONIKS uses additional crypto mechanisms to ensure that all data (including the public keys) associated with names registered with CONIKS key servers isn't stored in plain. I hope this helps! Best, Marcela
|
_______________________________________________ tor-dev mailing list tor-dev@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev