(This is probably a basic question, and may be a duplicate; if so, just let me know.)
Suppose there are two clients
B, and some server
C establish an HTTPS tunnel, and
C sends a response to
B. And suppose
B records the response, and sends it to
Averify that the alleged response from
Cwas actually sent by
This is essentially equivalent to "Are HTTPS responses non-repudiable?". As far as I am aware, HTTPS only provides a secure channel, but does not provide digitally signed traffic.
I'm tentatively planning to create a social network add-on which would allow users to flag other users who have sent them offensive material via private messages. I would hypothetically run a web service which would receive flag requests, and in order to avoid spam flags, I would need some way for the flagger to voluntarily send me a minimum but sufficient amount of information to verify that the private message actually exists.
In this scheme, I am
A, the flagger is
B, and the social network is
Is there any sane way to do this, without compromising the flagger's security?