4 ms·

I'm curious¹ Can you please comment here (or set up a webpage anywhere), explaining the overall ideas and proposals? If your idea of user-controlled identitie

I'm curious¹ Can you please comment here (or set up a webpage anywhere), explaining the overall ideas and proposals? If your idea of user-controlled identities is truly about something that users do possess (not just being provided), and you have any plan how to bring it to the world (without for users to need to install any software — that'd utterly fail — or do anything much besides clicking "log in as myself") — then I'm all for it. ___ ¹) Although I do believe Persona screwed it badly, as identities weren't controlled by users there, but merely leased to them by third parties - I find the concept of "identity provider" to be very wrong.

aidenn0 11y ago
I controlled my persona identity, and I didn't even run my own mail-server; I owned a domain and let someone else run the mail-server, and handled the persona side of things myself.
- drdaeman 11y ago
  I'm not sure one can "own" the domain. Well, IANA does. Then, if it's a ccTLD, your NIR (controlled by your government) does. Then the registrar you've registered domain name with does. They all do lease it to you (although legal agreements sort of say you "own" it, it's not a true ownership), but in practice they can take away your identity at any time they see fit or forced to. Or impersonate you, without your consent or even knowledge. I think we've heard about enough domain name seizures to not assume they're something owned. And an identity that can be seized or revoked is something that's just not right. I really want an identity system without need to trust any third parties to work. I walk in a store, I say "hi", they say "hi", and we're good. Just like it used to be with usernames and passwords, but without obvious issues passwords have. Notaries are absolutely useful, but they should assert identities ("yep, we know this dud, he's cool"), not provide them.
natrius 11y ago
Your identity will be a program on the Ethereum blockchain. That program has an address that will be the unique key for your identity. That program will indicate which keys can act on its behalf, and will provide a mechanism to revoke keys and recover the identity if your keys are lost. Users will have to install something because browsers have no key signing mechanism. If you manage keys in a web page, that web page can access your keys. You'll need an extension or an app to manage keys for you. This approach sounds like a stretch, right? No website is going to use an authentication mechanism that requires a separate install. If that were the initial use case for this, I would agree. The real use for these identities is within decentralized applications. These apps don't run on servers and don't force you to use middlemen when you interact with other people. Decentralized apps don't shut down. They don't care where you live. They connect you with other people on the planet that want to connect with you to trade, communicate, or interact in any way you want. The two of you choose your own rules, not those of the companies or governments that stand between you.
- drdaeman 11y ago
  Oh, I see. Sorry, not my thing, then. This is not a replacement for Persona, OpenID or "Log in with Google/Facebook/Twitter" buttons, which was what I hoped to see. And I'm not even sure how this is better than my PGP keypair (which is something way more widely recognized than Ethereum). Is there any skilled and powerful necromancer out there that can revive and reanimate W3C WebID committee?
chc4 11y ago
Looking through the grandparent's twitter provides a couple links on their solution. https://www.youtube.com/watch?v=Tbe6WibeRzQ&feature=youtu.be https://www.youtube.com/watch?v=Tbe6WibeRzQ&feature=youtu.be and https://medium.com/@ConsenSys/uport-the-wallet-is-the-new-browser-b133a83fe73#.3y0hnukxn https://medium.com/@ConsenSys/uport-the-wallet-is-the-new-br... in particular.
- natrius 11y ago
  Ah, I forgot about that blog post. Thanks for digging up the link! (The video is only tangentially related to identity.)

aidenn0 11y ago

I controlled my persona identity, and I didn't even run my own mail-server; I owned a domain and let someone else run the mail-server, and handled the persona side of things myself.

drdaeman 11y ago
I'm not sure one can "own" the domain. Well, IANA does. Then, if it's a ccTLD, your NIR (controlled by your government) does. Then the registrar you've registered domain name with does. They all do lease it to you (although legal agreements sort of say you "own" it, it's not a true ownership), but in practice they can take away your identity at any time they see fit or forced to. Or impersonate you, without your consent or even knowledge. I think we've heard about enough domain name seizures to not assume they're something owned. And an identity that can be seized or revoked is something that's just not right. I really want an identity system without need to trust any third parties to work. I walk in a store, I say "hi", they say "hi", and we're good. Just like it used to be with usernames and passwords, but without obvious issues passwords have. Notaries are absolutely useful, but they should assert identities ("yep, we know this dud, he's cool"), not provide them.

natrius 11y ago

Your identity will be a program on the Ethereum blockchain. That program has an address that will be the unique key for your identity. That program will indicate which keys can act on its behalf, and will provide a mechanism to revoke keys and recover the identity if your keys are lost. Users will have to install something because browsers have no key signing mechanism. If you manage keys in a web page, that web page can access your keys. You'll need an extension or an app to manage keys for you. This approach sounds like a stretch, right? No website is going to use an authentication mechanism that requires a separate install. If that were the initial use case for this, I would agree. The real use for these identities is within decentralized applications. These apps don't run on servers and don't force you to use middlemen when you interact with other people. Decentralized apps don't shut down. They don't care where you live. They connect you with other people on the planet that want to connect with you to trade, communicate, or interact in any way you want. The two of you choose your own rules, not those of the companies or governments that stand between you.

drdaeman 11y ago
Oh, I see. Sorry, not my thing, then. This is not a replacement for Persona, OpenID or "Log in with Google/Facebook/Twitter" buttons, which was what I hoped to see. And I'm not even sure how this is better than my PGP keypair (which is something way more widely recognized than Ethereum). Is there any skilled and powerful necromancer out there that can revive and reanimate W3C WebID committee?

chc4 11y ago

Looking through the grandparent's twitter provides a couple links on their solution. https://www.youtube.com/watch?v=Tbe6WibeRzQ&feature=youtu.be https://www.youtube.com/watch?v=Tbe6WibeRzQ&feature=youtu.be and https://medium.com/@ConsenSys/uport-the-wallet-is-the-new-browser-b133a83fe73#.3y0hnukxn https://medium.com/@ConsenSys/uport-the-wallet-is-the-new-br... in particular.

natrius 11y ago
Ah, I forgot about that blog post. Thanks for digging up the link! (The video is only tangentially related to identity.)