4 ms·

In my experience, one of the largest hurdles decentralization faces is agent identity. Or simply put, how do you determine who is who on the network. The origin

In my experience, one of the largest hurdles decentralization faces is agent identity. Or simply put, how do you determine who is who on the network. The original Internet failed to address this problem. The successful solutions I have seen to this issue have employed centralization. SSL certificates from Verisign and login with Google Sign In so consumers can trust your website. Don't confuse this with distributed authentication. They exist , but I would say difficult to use. I am talking about identity.

LukeB42 10y ago
Does this contact come back with the same public RSA key each time? Could they sign a small piece of data with the key? It probably [is/isn't] them, then. In Synchrony[1] this forms your address (like an email address but for editing web pages / chat / RTC teleconferencing / multi-user JS/WebAssembly applications), which contacts can then put a name to in the UI by mousing over. The address has the form network_name/node_id/user_id, where network_name is an opt-in namespace (so Synchrony can select routing tables based on their overall trustworthiness), node_id is 160 bits based on the SHA1 of "ip:port:pubkey" which peer nodes can then verify, preventing one another from assuming node IDs that correspond to popular URLs, so no one can computationally inexpensively monitor popular URLs for financial gain[2]. Note that the RSA keypair is per-instance of the software and not per user-identity - that when we ask a node if it can sign for some data it's the installation rather than the individual user identity being checked. [1] https://github.com/psybernetics/synchrony https://github.com/psybernetics/synchrony [2] http://www.tm.uka.de/doc/SKademlia_2007.pdf http://www.tm.uka.de/doc/SKademlia_2007.pdf
- zigzigzag 10y ago
  Keypairs are not useful identities though. They don't encode any meaningful attributes (e.g. name) and it's too hard to manage them.

LukeB42 10y ago

Does this contact come back with the same public RSA key each time? Could they sign a small piece of data with the key? It probably [is/isn't] them, then. In Synchrony[1] this forms your address (like an email address but for editing web pages / chat / RTC teleconferencing / multi-user JS/WebAssembly applications), which contacts can then put a name to in the UI by mousing over. The address has the form network_name/node_id/user_id, where network_name is an opt-in namespace (so Synchrony can select routing tables based on their overall trustworthiness), node_id is 160 bits based on the SHA1 of "ip:port:pubkey" which peer nodes can then verify, preventing one another from assuming node IDs that correspond to popular URLs, so no one can computationally inexpensively monitor popular URLs for financial gain[2]. Note that the RSA keypair is per-instance of the software and not per user-identity - that when we ask a node if it can sign for some data it's the installation rather than the individual user identity being checked. [1] https://github.com/psybernetics/synchrony https://github.com/psybernetics/synchrony [2] http://www.tm.uka.de/doc/SKademlia_2007.pdf http://www.tm.uka.de/doc/SKademlia_2007.pdf

zigzigzag 10y ago
Keypairs are not useful identities though. They don't encode any meaningful attributes (e.g. name) and it's too hard to manage them.