CAcert Code Development list.

[Michael Tänzer <taenzermichi AT googlemail.com>]

Markus Warg schrieb:
>> In some sense we need to initiate the check.  So the user has to go to
>> the online system, log in, and then hit the button that says "I want
>> check X for domain Y"  At that point, the system generates the token,
>> stores it, and tell the user what it is.
>>
>> Right?
> 
> For DNS, WEB, WHOIS check we need to tell the user (because he has to
> put the code into an location where CACert can check). For mail ping we
> must not tell the user, because we want to check if he is the guy who
> got the mail.
> Thats why I would appreciate two different hashes (one per method,
> method 1=mail, method 2=web,dns,whois).

So generate a random number for the domain and store it in the database
then calculate sha1(random + methodID) should do the trick shouldn't it?
That way we only need to store one number and are able to email the user
hash1 tell him to put hash2 in the dns etc. and the user can choose what
he wants to do.

Cheers
Michael

Attachment: signature.asc
Description: OpenPGP digital signature