On Sat, 29 Dec 2007 12:45:26 +0100
Magnus Hagander <magnus@hagander.net> wrote:
> That is exactly my point. The server can never know if the client has
> actually verified anything. It can provide the client with the *means*
> to verify things, but it can't enforce it.
I know this is probably obvious to most people in this discussion and I
don't mean to impugn Magnus just because I am latching onto his message
to make this point but I suspect that this discussion would go a lot
smoother if it branches into two completely different discussions about
two completely different issues;
- 1: How does the client assure that the postmaster is legit- 2: How does the postmaster assure that the client is
legit
Does anyone think that there is one answer to both?
--
D'Arcy J.M. Cain <darcy@druid.net> | Democracy is three wolves
http://www.druid.net/darcy/ | and a sheep voting on
+1 416 425 1212 (DoD#0082) (eNTP) | what's for dinner.