Re: HTTP Signature CG report

I'm talking about the ID for the activity itself. The Activity is
attributedTo example.com/users/foo, but it purports to shares an id (
example.com/posts/123) with a legitimate post made by example.com/users/bar.
There is no way a receiving server can tell that example.com/posts/123 is
"supposed to" be bar's ID to sign, instead of foo's.

On Wed, Feb 7, 2024 at 11:43 AM Dmitri Zagidulin <dzagidulin@gmail.com>
wrote:

> > If clients have custody of keys, then `foo@example.com` could wait for `
> bar@example.com` to make a post, and then sign an activity with the same
> ID (e.g. "example.com/posts/102930")
>
> Wait, that's not how client signing works tho. The whole point of client
> signing is that nobody else can sign with the same ID (cause they don't
> have your keys).
>
>
>