2 added 866 characters in body
source | link

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, I just want to have a some reasonable assurance that the person posting the comment is in fact who they say they are. If a post is spam for example, I want to be able to hold the person accountable. At the same time I need the system to be low overhead for users. For example giving them a list of 100 one time phrases that would have to be pasted into an email or onto a website would be acceptable.

I am using node.js and was considering using a diffie-hellman key-exchange.

I know this is fuzzy and I'm not looking for answers per se, but rather a way to think about it, an example or starting point or ... ?

Edit #1 Thanks for the intelligent questions and thoughts.

Use case: Someone physically comes to me and with a thumb drive and I give them a set of one time ciphers. [206,99087,3,etc]. And yes, they have to agree to give me some information and be physically identified. Each time they comment or post (and perhaps post through email) I want one of those ciphers to be sent to me, and they are not reusable. When my application gets an email or a posted comment there is a high degree of certainty about the identity of the person. Little is at stake besides "reputation" so there is little incentive to break into the system, but it shouldn't be trivial.

Accountability means their reputation suffers or they are banned from using the application. Since this is based on their physical person rather than their disposable email person this is sufficient.

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, I just want to have a some reasonable assurance that the person posting the comment is in fact who they say they are. If a post is spam for example, I want to be able to hold the person accountable. At the same time I need the system to be low overhead for users. For example giving them a list of 100 one time phrases that would have to be pasted into an email or onto a website would be acceptable.

I am using node.js and was considering using a diffie-hellman key-exchange.

I know this is fuzzy and I'm not looking for answers per se, but rather a way to think about it, an example or starting point or ... ?

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, I just want to have a some reasonable assurance that the person posting the comment is in fact who they say they are. If a post is spam for example, I want to be able to hold the person accountable. At the same time I need the system to be low overhead for users. For example giving them a list of 100 one time phrases that would have to be pasted into an email or onto a website would be acceptable.

I am using node.js and was considering using a diffie-hellman key-exchange.

I know this is fuzzy and I'm not looking for answers per se, but rather a way to think about it, an example or starting point or ... ?

Edit #1 Thanks for the intelligent questions and thoughts.

Use case: Someone physically comes to me and with a thumb drive and I give them a set of one time ciphers. [206,99087,3,etc]. And yes, they have to agree to give me some information and be physically identified. Each time they comment or post (and perhaps post through email) I want one of those ciphers to be sent to me, and they are not reusable. When my application gets an email or a posted comment there is a high degree of certainty about the identity of the person. Little is at stake besides "reputation" so there is little incentive to break into the system, but it shouldn't be trivial.

Accountability means their reputation suffers or they are banned from using the application. Since this is based on their physical person rather than their disposable email person this is sufficient.

1
source | link

Recommendation for identity system

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, I just want to have a some reasonable assurance that the person posting the comment is in fact who they say they are. If a post is spam for example, I want to be able to hold the person accountable. At the same time I need the system to be low overhead for users. For example giving them a list of 100 one time phrases that would have to be pasted into an email or onto a website would be acceptable.

I am using node.js and was considering using a diffie-hellman key-exchange.

I know this is fuzzy and I'm not looking for answers per se, but rather a way to think about it, an example or starting point or ... ?