• b3nsn0w@pricefield.org
    link
    fedilink
    arrow-up
    6
    ·
    1 year ago

    i think this could be resolved by assigning a color to each user based on a hash. maybe people would try to find collisions there (i.e. specifically find usernames that get the same color as you), but if you do something like color_index = hmac(user_address, client_nonce) % color_count where client_nonce is unique to each client, it would be impossible to manipulate usernames to get a collision or even a higher chance at it.

    • hyazinthe@feddit.de
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      The full user adress should suffice for the hash, because there is only one hyacinth@feddit.de, for example.

      Also, do you really need a hash? Isn’t there a simpler alternative, developing an app?

      • b3nsn0w@pricefield.org
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        yeah, the point is that if hyazinthe@feddit.de hashes to, say, blue, they can try to find a similar-looking username that also hashes to blue, therefore helping with the impersonation. if you hash a client nonce that’s different for everyone, you may hash to blue on my screen but green on yours, and there will be no relation between who hashes to which color on your screen or mine. the impersonator will have no way to guess if their name would match colors on either of our screens, and if we have, say, 25, colors, it will be a static 4% chance no matter what they do.

        • hyazinthe@feddit.de
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Ah, I understand. But couldn’t you just implement the unpredictable colors, you are trying to achive client-side, without hashing, say random order of colors?