Embed Notice

@tassoman Anyone can POST /inbox from anywhere. TLS only helps verify servers, not clients.

Public activities don’t have to be signed, because if we get an unsigned activity we can just refetch it from the origin server. In that case TLS helps.

Private activities can’t be fetched, so the only way to verify it is by a key. We fetch the actor and compare their RSA public key with the HTTP Signature.

What if key-pair is lost/stolen? ?

Yes, we have to plan for that. This is what Pleroma does:

1. Accounts are refetched every 24 hours. A last_refreshed_at is stored on the user. So if keys are stolen, re-roll them.
2. Upon getting an invalid signature, refetch the actor and try one more time before giving up.