Hacker News Reader

Comment by rudolph9 | Hacker News Reader

I was thinking the other day about a digital signature for limited character tweets.

Provided I’m not a cryptography expert and you should explore my ideas with caution, why not even just sign every tweet with an ed25519 signature? It’s on 64 bytes tacked onto the message and easy to verify...

View on HN

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

hi hacker news -----BEGIN PGP SIGNATURE-----

iIIEARYKACoWIQSiJQKEVJeJondn78BXE/NAGxPd0QUCXw/JqwwcZm9vQGJhci5j b20ACgkQVxPzQBsT3dGf1gEAwMzbCxEaEJzRjJwFe90TRrXZiIe4KD9cZ64CHZEz eKEA/3W0ZIx6TOASPrzuTLytBK8OsL9FFAVWMUGTyLJSSh8O =ORB6 -----END PGP SIGNATURE-----

pubkey: https://gist.github.com/rudolph9/bd672dc6d50a51a7d3f5352a918...

A little more cumbersome than I imagined but proves that the contents of a tweet can contain a message and a digital signature.

I think I may have just re-invented keybase.io haha.

How do you plan on managing the signing keys?

Hardware security module

Seems like it would be a nice feature for security-minded folks, and would probably be pretty difficult to roll out to regular consumers. Does Mastodon have something like this? Sounds like something their userbase would appreciate.

You could literally dump the signature in at the end of the utf-8 tweet. A tweet can contain about 500 bytes, the signature is 64 bytes; encode it using utf8 characters and you got plenty of room room for a message and a signature

I’m honestly surprised this isn’t common already in the crypto space and kinda wonder if I’m missing something

For sure, the hard part isn't building it, it's getting people to actually use it. The amount of effort involved of actually acquiring and transporting a hardware security key is well beyond what most "normal" people are willing to do.

Plus, reading your example in a different comment, it's completely jarring to someone who isn't used to reading things in that format.

I get why everyday users don’t use it but why doesn’t an org like coinbase? Yes the quick and dirty poc I built in 5 minutes is a bit jarring but it could easily be adjusted so the beginning of the tweet reads like it normally would and the end is the cryptographic signature nearly separated from the main message.

Or put the tweets onto a blockchain...

I mean you could but seems unnecessary.

Putting tweets on a blockchain would make it very difficult to delete them or edit them but offer no more certainty than a regular tweet that includes a signature verifiable with a known public key of mine.

I just don’t don’t want someone impersonating me on any one of the many random website I have a profile where anyone with access to the db can write whatever they want under my name.

Reply on news.ycombinator.com