Hacker News Reader

Or just attach a lock that needs a combo (ex: 3,7,15) instead of a key to open it, then tell her the combination after she gets it and the risk of theft is zero.

The problem specifically says they are communicating using the internet, so why not?

"Hey, I sent you a box. It's locked with a combo lock. Call me when you get it: I want to be talking to you when you see the surprise! I'll tell you the combo on the phone!"

View on HN

The situation is actually a bit tricky. If they met over the internet, there's no way to guarantee the absence of a Man-in-the-Middle who has been allowing the romance to proceed without interference, but who tampers with the messages which give the address to which the ring must be sent (and who fakes the message which says the box has been received.)

The only way to avoid this possibility (of a man in the middle attack) is to be "introduced" by a third party you already trust. See e.g. https://en.wikipedia.org/wiki/Needham–Schroeder_protocol

In the absence of a trusted third party, you could be talking to anybody, through any number of lurking intermediaries. If you've got a trusted third party then the problem, as posed, is moot.

All of the other solutions are vulnerable to MITM as well, though.

Can't believe I didn't think of that before I got to the double padlock solution.

Reply on news.ycombinator.com