# Shared Half-Secret

**URL:** <https://www.ruby-forum.com/t/shared-half-secret/165815>\
**Category:** Ruby\
**Created:** [April 17, 2009, 7:49pm UTC](https://www.ruby-forum.com/t/shared-half-secret/165815 "2009-04-17T19:49:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bbazzarrakk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/47e85d/32.png) [@bbazzarrakk](https://www.ruby-forum.com/u/bbazzarrakk)\
**Post date:** [April 17, 2009, 7:49pm UTC](https://www.ruby-forum.com/t/shared-half-secret/165815/1 "2009-04-17T19:49:25Z")

</div>

I have a program A (totally private) that talks to a program B (open  
source). I would like to introduce some way to ensure B only listens  
to the real A to avoid things like man-in-the-middle attacks.

Any good ideas about how I might accomplish this? Thanks.

James Edward G. II

---

<div class="post-metadata">

**Author:** ![bbazzarrakk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/47e85d/32.png) [@bbazzarrakk](https://www.ruby-forum.com/u/bbazzarrakk)\
**Post date:** [April 17, 2009, 7:57pm UTC](https://www.ruby-forum.com/t/shared-half-secret/165815/2 "2009-04-17T19:57:02Z")

</div>

On Sat, Apr 18, 2009 at 02:48:32AM +0900, James G. wrote:

> I have a program A (totally private) that talks to a program B (open  
> source). I would like to introduce some way to ensure B only listens to  
> the real A to avoid things like man-in-the-middle attacks.

SSL socket with certificate validation perhaps?

---

<div class="post-metadata">

**Author:** ![bbazzarrakk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/47e85d/32.png) [@bbazzarrakk](https://www.ruby-forum.com/u/bbazzarrakk)\
**Post date:** [April 17, 2009, 8:02pm UTC](https://www.ruby-forum.com/t/shared-half-secret/165815/3 "2009-04-17T20:02:21Z")

</div>

On Apr 17, 2009, at 12:55 PM, Aaron P. wrote:

> On Sat, Apr 18, 2009 at 02:48:32AM +0900, James G. wrote:
> 
> > I have a program A (totally private) that talks to a program B (open  
> > source). I would like to introduce some way to ensure B only  
> > listens to  
> > the real A to avoid things like man-in-the-middle attacks.
> 
> SSL socket with certificate validation perhaps?

Yeah, it does look like that’s all I really need. Great, I like  
simple. Thanks for the idea.

James Edward G. II