4 ms·

Not true. I own my domain, and I own it in a very specific juridical sense. It's not tangible, because domains aren't, but it's a lot more like owning a car th

by xorcist 11y ago

Not true. I own my domain, and I own it in a very specific juridical sense. It's not tangible, because domains aren't, but it's a lot more like owning a car than leasing a car. The ownership is stronger than for my phone number or my birth name, for example. While the term identity provider might not sound well, it is necessary for a system where you have multiple identities. And I think it's pretty well established that that is a requirement for the modern web.

icebraining 11y ago
Why is an IdP necessary for a system where you have multiple identities? Why can oneself provide the identity one wishes to use for the communication with the other party? I do agree that Persona with a personal domain is a much better system, but why should it be necessary to have one to avoid being tied to a third-party IdP?
- WorldMaker 11y ago
  You don't trust your email provider? Today your email provider is already implicitly your underlying IdP for almost every website you visit that uses that email (if it has a "Forgot Password" button that sends you an email, your email provider is your IdP). All Persona attempts to do is make that implicit assumption an explicit part of that email's identity, and even tries to make it somewhat more secure than sending random tokens via often insecure/semi-secure SMTP channels, as most "Forgot Password" systems do. Ultimately yes, if you want to sign in to a website with your email address you typically have to trust your email provider. This is true on the web almost universally with or without Persona. Why is any IdP required by Persona? Identity protection and reuse across browsers are two big reasons. If I want to say that I am/use the email "wm@example.com", Persona tries to verify that I actually have access to that email (can sign in to my email provider, or can do the classic click a random token link in an email cycle if my email provider isn't supported).
  - drdaeman 11y ago
    > You don't trust your email provider? It's a luxury those days, with email providers snooping over messages to show your advertisements and all sort of TLAs snooping just because they feel so. There is some buzz about end-to-end encryption out there for a reason, and the reason is a lot of people don't trust their email providers. But I reasonably do. I'm hosting my email myself, on the hardware I own, located on my own premises. Although I may get hacked - one can't be ever sure they won't - most modern systems are too complex for any single human to grasp and sometimes bad things just happen. But I don't trust my domain registrar and the network. DNS may get poisoned/spoofed, network may be tapped and traffic redirected, registry or nameservers may get hacked or subpoenae'd (ok, I'm not a criminal, but who has a protection from powerful authorities if they suddenly decide they want you?) and whatever else.
  - drdaeman 11y ago
    By the way, neither identity protection nor reuse across browsers does not strictly require IdP. In a strict sense, you don't need a trusted third party to transfer data between your devices or have a means to recover a lost key. If you have everything you need to prove your identity claims, you can decide how you handle those on your own, and whenever you want some TTP assistance or not. And if you decide you do, the requirements are a lot more relaxed. With Persona you trust a very specific third party - some email provider. You trust it to behave and you trust it to serve and stay so for as long as you need your identity. However, if - for example - you have an identity asserted by a keypair - you have way more possibilities, ranging from a key backup in a tamper-resistant HSM in a safe vault behind a blast-resistant doors in your basement, or setting up a secret sharing scheme where 3 out of 6 your close friends must get together to help you recover a lost key, to just uploading your key to Dropbox and not giving a damn. Isn't that a good thing? And if the key's completely lost - it's the same as if the email provider's gone - you'll have to either give up or recover your accounts using some other ways (talking to a support and figuring out what would be a good replacement proof).
    - WorldMaker 11y ago
      «By the way, neither identity protection nor reuse across browsers does not strictly require IdP.» Technically correct, but it makes it a lot easier at a practical level, especially for non-technical users. Users have trouble remembering passwords, key management is seemingly beyond most users. So too are systems like the "web of trust" model of key identification much to complicated (and onerous and time consuming) for the average user. IdP is the best bet we have of at least somewhat decentralizing trust decisions in a way that is user friendly. «With Persona you trust a very specific third party - some email provider. You trust it to behave and you trust it to serve and stay so for as long as you need your identity.» This is not a requirement of Persona. You can use any email you like with Persona and it's not a platform requirement that user accounts in a system be one-to-one with email addresses. It's certainly possible a site using Persona can very easily tie multiple identifying emails to your account. It may not be likely that a lot of sites would do it, as one email, one person is a rather generally accepted identity world at the moment, but it's also not far fetched that the replacement for the "Forgot Password" button in a hypothetical universe where Persona is the only option is a "Associate another email address to your account" button. «However, if - for example - you have an identity asserted by a keypair» But what good is this assertion? How do I as an application provider trust your assertion? At bare face value an "identity asserted by a keypair" is a fingerprint, a boring hexadecimal hash. I don't know very many people that associate themselves as "fe:02:aa:45:c3:d0". You could self-assert an email address or a name/pseudonym, fine, but as an application provider I can't make any assumptions about the contents of that email address or name/pseudonym and the only trust I have in it is "your word". You could use web of trust assertions, but again we get into the bootstrapping issue of "web of trust is hard" and "users don't want to have to do it". The same goes for all of your hypothetical key management: yes, you can manage a key on your own cognizance in any number of ways. Ultimately, most people just don't want to. On the flipside, Persona too has more options in this space for IdP management and key management than maybe you've given it thought: There's a Mailinator-based IdP that will sign any key request from Persona for pseudonymous identities (while even maintaining the application provider assertion that the email is valid and accessible to that user). There's the ability to do IdP delegation from a domain, using a file on my website to choose which IdP I trust right now, which can easily change over time. (Static HTTP sites on custom domains are cheap as free, including Github Pages as one option.) There are more ideas out there and you can reasonably approximate whatever half-finished idea you have for your own key management system with Persona given a little bit of time and elbow grease.
drdaeman 11y ago
Maybe you do (as long as you pay, of course). Legal protection gives you recourse, but doesn't protect you from malicious adversaries. Shall something bad happen - you'll lose your identity and will have to seek it back in a court. It's a sort of insurance. Also, that juridical sense isn't international. There are countries that seize or undelegate domains they can reach at whim. There are countries that block other zone domains, mandating Internet traffic filtering within a country. Legal sense doesn't mean a thing against rogue governments. To put it security: I really don't want to trust any other entity but myself to be a source my identities, and find any concept of trusted authorities to be hazardous. Seriously, how come we designed the whole damned network that when I come to someone's place why I happen to need some landlord to confirm (why?) that I am who I am? Isn't this is only a matter between myself and whoever welcomes me on their site?
- xorcist 11y ago
  > Shall something bad happen - you'll lose your identity and will have to seek it back in a court. That's true for every way to prove identity. For most use cases, it's a feature that you can get it back in court. See also "identity theft". > that juridical sense isn't international. There are countries that seize or undelegate domains they can reach at whim. In a way it's very international. It has never happened in the history of the Internet that one top domain organization has undelegated domains under another top domain. It is true however that you are always subject to your country's laws. But this system is international in a way that none of your other identities are: You can easily get a domain in another country, and that ownership is exclusively managed by that country's laws. > I really don't want to trust any other entity but myself to be a source my identities, That doesn't make for very useful names. I may assert that I am Barrack Obama. You will most certainly not agree. That limits the usefulness of self-asserted identitites. See also "Zooko's Triangle".
  - drdaeman 11y ago
    > It has never happened in the history of the Internet that one top domain organization has undelegated domains under another top domain I also haven't heard of such thing. I have heard of few others, though. US had seized a few .com domains, and I doubt they cared about citizenship of registrar. Russian government had requested un-delegation of few .ru ones, and blocking any access (ISP-level) to many others across the world. Australian .oz ccTLD was moved to .oz.au. Yugoslavian .yu ccTLD is gone and doesn't exist anymore. It was once feared that .su would also begone, but it had survived for some weird reason, although - who knows - for how long? I think a few email accounts I had registered in early '00s are long gone, some with the very email providers. But I still have my old private key I've created a decade ago. That's what I know about the credentials. YMMV, of course, and - sure - I know a few peers who had lost their keys. > I may assert that I am Barrack Obama Sure, and while I suppose it's not your name, I bet there is not a single Mr. Obama in this world. Zooko's triange is fine, identity system doesn't need unique names - a natural one doesn't have those anyway. We don't require worldwide login (username) uniqueness, right? If for some reason we want to know it's real US President Obama who wrote a message or signed up on a site, we need an assertion on his identity from US Govt, don't see any issues with this. And, duh, I bet he has a few tamper-resistant tokens that hold some signed keys, to sign his mail and whatever. I would be very surprised if he doesn't.

by xorcist 11y ago

icebraining 11y ago

Why is an IdP necessary for a system where you have multiple identities? Why can oneself provide the identity one wishes to use for the communication with the other party? I do agree that Persona with a personal domain is a much better system, but why should it be necessary to have one to avoid being tied to a third-party IdP?

WorldMaker 11y ago
You don't trust your email provider? Today your email provider is already implicitly your underlying IdP for almost every website you visit that uses that email (if it has a "Forgot Password" button that sends you an email, your email provider is your IdP). All Persona attempts to do is make that implicit assumption an explicit part of that email's identity, and even tries to make it somewhat more secure than sending random tokens via often insecure/semi-secure SMTP channels, as most "Forgot Password" systems do. Ultimately yes, if you want to sign in to a website with your email address you typically have to trust your email provider. This is true on the web almost universally with or without Persona. Why is any IdP required by Persona? Identity protection and reuse across browsers are two big reasons. If I want to say that I am/use the email "wm@example.com", Persona tries to verify that I actually have access to that email (can sign in to my email provider, or can do the classic click a random token link in an email cycle if my email provider isn't supported).
- drdaeman 11y ago
  > You don't trust your email provider? It's a luxury those days, with email providers snooping over messages to show your advertisements and all sort of TLAs snooping just because they feel so. There is some buzz about end-to-end encryption out there for a reason, and the reason is a lot of people don't trust their email providers. But I reasonably do. I'm hosting my email myself, on the hardware I own, located on my own premises. Although I may get hacked - one can't be ever sure they won't - most modern systems are too complex for any single human to grasp and sometimes bad things just happen. But I don't trust my domain registrar and the network. DNS may get poisoned/spoofed, network may be tapped and traffic redirected, registry or nameservers may get hacked or subpoenae'd (ok, I'm not a criminal, but who has a protection from powerful authorities if they suddenly decide they want you?) and whatever else.
- drdaeman 11y ago
  By the way, neither identity protection nor reuse across browsers does not strictly require IdP. In a strict sense, you don't need a trusted third party to transfer data between your devices or have a means to recover a lost key. If you have everything you need to prove your identity claims, you can decide how you handle those on your own, and whenever you want some TTP assistance or not. And if you decide you do, the requirements are a lot more relaxed. With Persona you trust a very specific third party - some email provider. You trust it to behave and you trust it to serve and stay so for as long as you need your identity. However, if - for example - you have an identity asserted by a keypair - you have way more possibilities, ranging from a key backup in a tamper-resistant HSM in a safe vault behind a blast-resistant doors in your basement, or setting up a secret sharing scheme where 3 out of 6 your close friends must get together to help you recover a lost key, to just uploading your key to Dropbox and not giving a damn. Isn't that a good thing? And if the key's completely lost - it's the same as if the email provider's gone - you'll have to either give up or recover your accounts using some other ways (talking to a support and figuring out what would be a good replacement proof).
  - WorldMaker 11y ago
    «By the way, neither identity protection nor reuse across browsers does not strictly require IdP.» Technically correct, but it makes it a lot easier at a practical level, especially for non-technical users. Users have trouble remembering passwords, key management is seemingly beyond most users. So too are systems like the "web of trust" model of key identification much to complicated (and onerous and time consuming) for the average user. IdP is the best bet we have of at least somewhat decentralizing trust decisions in a way that is user friendly. «With Persona you trust a very specific third party - some email provider. You trust it to behave and you trust it to serve and stay so for as long as you need your identity.» This is not a requirement of Persona. You can use any email you like with Persona and it's not a platform requirement that user accounts in a system be one-to-one with email addresses. It's certainly possible a site using Persona can very easily tie multiple identifying emails to your account. It may not be likely that a lot of sites would do it, as one email, one person is a rather generally accepted identity world at the moment, but it's also not far fetched that the replacement for the "Forgot Password" button in a hypothetical universe where Persona is the only option is a "Associate another email address to your account" button. «However, if - for example - you have an identity asserted by a keypair» But what good is this assertion? How do I as an application provider trust your assertion? At bare face value an "identity asserted by a keypair" is a fingerprint, a boring hexadecimal hash. I don't know very many people that associate themselves as "fe:02:aa:45:c3:d0". You could self-assert an email address or a name/pseudonym, fine, but as an application provider I can't make any assumptions about the contents of that email address or name/pseudonym and the only trust I have in it is "your word". You could use web of trust assertions, but again we get into the bootstrapping issue of "web of trust is hard" and "users don't want to have to do it". The same goes for all of your hypothetical key management: yes, you can manage a key on your own cognizance in any number of ways. Ultimately, most people just don't want to. On the flipside, Persona too has more options in this space for IdP management and key management than maybe you've given it thought: There's a Mailinator-based IdP that will sign any key request from Persona for pseudonymous identities (while even maintaining the application provider assertion that the email is valid and accessible to that user). There's the ability to do IdP delegation from a domain, using a file on my website to choose which IdP I trust right now, which can easily change over time. (Static HTTP sites on custom domains are cheap as free, including Github Pages as one option.) There are more ideas out there and you can reasonably approximate whatever half-finished idea you have for your own key management system with Persona given a little bit of time and elbow grease.

drdaeman 11y ago

Maybe you do (as long as you pay, of course). Legal protection gives you recourse, but doesn't protect you from malicious adversaries. Shall something bad happen - you'll lose your identity and will have to seek it back in a court. It's a sort of insurance. Also, that juridical sense isn't international. There are countries that seize or undelegate domains they can reach at whim. There are countries that block other zone domains, mandating Internet traffic filtering within a country. Legal sense doesn't mean a thing against rogue governments. To put it security: I really don't want to trust any other entity but myself to be a source my identities, and find any concept of trusted authorities to be hazardous. Seriously, how come we designed the whole damned network that when I come to someone's place why I happen to need some landlord to confirm (why?) that I am who I am? Isn't this is only a matter between myself and whoever welcomes me on their site?

xorcist 11y ago
> Shall something bad happen - you'll lose your identity and will have to seek it back in a court. That's true for every way to prove identity. For most use cases, it's a feature that you can get it back in court. See also "identity theft". > that juridical sense isn't international. There are countries that seize or undelegate domains they can reach at whim. In a way it's very international. It has never happened in the history of the Internet that one top domain organization has undelegated domains under another top domain. It is true however that you are always subject to your country's laws. But this system is international in a way that none of your other identities are: You can easily get a domain in another country, and that ownership is exclusively managed by that country's laws. > I really don't want to trust any other entity but myself to be a source my identities, That doesn't make for very useful names. I may assert that I am Barrack Obama. You will most certainly not agree. That limits the usefulness of self-asserted identitites. See also "Zooko's Triangle".
- drdaeman 11y ago
  > It has never happened in the history of the Internet that one top domain organization has undelegated domains under another top domain I also haven't heard of such thing. I have heard of few others, though. US had seized a few .com domains, and I doubt they cared about citizenship of registrar. Russian government had requested un-delegation of few .ru ones, and blocking any access (ISP-level) to many others across the world. Australian .oz ccTLD was moved to .oz.au. Yugoslavian .yu ccTLD is gone and doesn't exist anymore. It was once feared that .su would also begone, but it had survived for some weird reason, although - who knows - for how long? I think a few email accounts I had registered in early '00s are long gone, some with the very email providers. But I still have my old private key I've created a decade ago. That's what I know about the credentials. YMMV, of course, and - sure - I know a few peers who had lost their keys. > I may assert that I am Barrack Obama Sure, and while I suppose it's not your name, I bet there is not a single Mr. Obama in this world. Zooko's triange is fine, identity system doesn't need unique names - a natural one doesn't have those anyway. We don't require worldwide login (username) uniqueness, right? If for some reason we want to know it's real US President Obama who wrote a message or signed up on a site, we need an assertion on his identity from US Govt, don't see any issues with this. And, duh, I bet he has a few tamper-resistant tokens that hold some signed keys, to sign his mail and whatever. I would be very surprised if he doesn't.