being able to correlate a single transaction like you describe is an extremely bold claim. Maybe now its not so terribly difficult, but once NXT transactions start to pop it will definitely be impossible.
IMHO you've just made a bolder claim than I did.
And of course a light client ALWAYS has to trust the node operator. This is the case whether or not you use either SSL or TOR (or not use either/both of them). So just take this argument away.
Why is that?
Like I said before, depending on tor for a home user is just not feasable.
Have you read that it took just 2 hours to implement support for Tor in my client and all that the end user has to do is ticking a checkbox? Why is this not feasable?
I find it extremely hard to believe that you see the SSL correlation such a risk yet completely ignore TOR correlation that is possible unless, like I said previously, the user takes EXTREME steps, nearing on the impossible. Without these drastic extreme steps, eventually tor is correlated. It just takes time.
The SSL correlation is not my main problem with SSL.
My main problem is that the way I would attack privacy and security of NTX is like this:
1.) Set up and run lots of NRS nodes.
2.) Protect it by SSL and make sure I myself stay anonymous.
3.) Encourage NXT user to use the nodes under my management, because they are more secure than others due to SSL.
4.) I'd end up with a substantial amount of the NXT client<->NRS communication under my control.
No, this is not an accusation that this is what you are trying to do. I'm personally very grateful for what you do for NXT.
However, I would like to prevent that the general perception is that SSL has a real security/privacy benefit for client<->NRS communication.
But whatever, just ignore the dev. Hint, you might want to do a little research about tor correlation, before you depend on it yourself though. In fact, unless you go do your research on it, Im going to assume that not only do you not care about it for yourself, but you also dont care about it for others. IMO this is not exactly the way things should be done, but, oh well, you guys in the committee are supposed to be the experts, after all.
- You are not being ignored. You previously failed to follow-up on InfCom comments and questions. If you had answered my last post in the InfCom thread regarding the SSL for the Wiki with just "but what about the username/password" pairs, which I previously missed, you'd had me in your boat within 5 seconds.
- You seem to have the idea that InfCom consists of five infrastructure gods/super-heros. This is not the case. We are as good and qualified as everyone else. This is why we ask you to make your case. And this also means that we are not above you or anyone else in the NXT community, so there is really no reason to play the "but whatever, just ignore the dev/average user/small investor/whatever" card.
- Regarding me not caring, I'll keep my mouth shut on this. Just note please, that committees are not there to run NXT and decide for the NXT community. It's the job of everyone, so if you think Tor stinks, please do the research yourself and make your case. The issue I've created for it is here: https://bitbucket.org/nxtinfrastructure/committee/issue/33/tor-enabled-capable-nxt-clients It needs feedback.
For the user who was asking about wildcard SSL (I think it was xyzzyx) the cost to do it anonymosly is fairly high, almost 500 euro. So unless someone knows that rapidssl/comodo/someoneElse will allow purchase with either anonymous or with known-to-be-not-real ID (startssl is very strict about real names, address, TN, etc) then thats the way to go.
Wouldn't it be possible to let someone like rickyjames make the order for the (non-anonymous) SSL certificate?
