FellowTraveller claimed here that :
OT cannot lie on your receipt. It cannot change your balance or forge any of your transactions. (Bitcoin also is like this, but it's still worth mentioning.) Combined with an auditing protocol, this makes it possible to run low-trust servers.
Can anyone elaborate on this? What prevents the operator of an OT server from changing balances and forging transactions?
It is not possible for the OT server to forge your signature because you retain the private key. Sure, it could issue fakes but anyone actually checking the signature would immediately see that it is incorrect and reject the transaction.
Whenever you perform a transaction on OT, you must submit the signed transaction. After the server verifies your signed transaction, which includes your current balance, the server countersigns it, and this becomes your receipt.
The server is unable to forge your balance, and unable to forge any transactions, because the server is unable to forge your signature on the receipt.
(This "last signed receipt" actually constitutes your account. Your "account" is nothing more than the last receipt itself, signed by both you and the OT server, agreeing to a certain balance.)
