[Aachen]

That would actually be a better application than what they're doing here. In your scenario, you're trusting that Facebook's and that third-party app's servers aren't compromised. What Facebook is publishing here is Facebook verifying that Facebook isn't compromised or compelled.

Anyway this idea is out there and most typically done with PGP, using the standard tooling to sign whatever info (or key) you want people to be able to verify regardless of what platform you're on.

[palata]

> What Facebook is publishing here is Facebook verifying that Facebook isn't compromised or compelled.

I don't think so. Anyone could run a third-party audit record, right? At least I thought that was the whole point of it...

See https://news.ycombinator.com/item?id=35555910

[Aachen]

I think we're having the same argument in two places :). I would say let's centralize to here https://news.ycombinator.com/item?id=35564592 as I already replied there before seeing this reply.