@paranormal_distribution@fosstodon.org
Post #1479760
2026-02-18 14:10 UTC
@dotfox @mullvadnet But I'm guessing the verification called home to let someone know which app/service you verified with, or is someone making an authorication service that doesn't need that? If so, which one?
Replies (1)
-
@dotfox@mastodon.social 2026-02-18 14:59
@paranormal_distribution No one. The presenter asks the verifier to publish their constraints — the trusted root authorities and the current revocation list (one way hashed). The presenter then forges two proofs locally: "I hold a valid capability delegated to me only" and "no intermediate delegator in my chain is revoked, and the delegation chain starts from a trusted root". The verifier checks both proofs against the published roots — no callback, no identity disclosure, no phone-home.