Conversation

Notices

1. Embed this notice
   silverpill (silverpill@mitra.social)'s status on Saturday, 09-Aug-2025 07:10:59 JST silverpill

   in reply to

   • marius

   @mariusor The key can also be embedded within another object like a Note and be identified by a fragment ID.

   I ended up scanning all submitted activities and their embedded objects for anything that has publicKeyPem or publicKeyMultibase properties. If a key is found, the activity is rejected.

   • Embed this notice
     marius (mariusor@metalhead.club)'s status on Saturday, 09-Aug-2025 07:11:01 JST marius

     There are some implementation details in my storage layers that would prevent this problem from happening, I think. The main one being that the only way to change the public key of an actor is to update the actor itself, the key does not exist as a stand alone object that could be overwritten maliciously.

     There might be some corner cases, but I'll try to come up with some tests.