4 ms·
I have an idea for a FOSS blockchain-based system that allows anonymous reputation tracking through tokens to provide an alternate API for trusting anonymized u
by kakarot 10y ago
I have an idea for a FOSS blockchain-based system that allows anonymous reputation tracking through tokens to provide an alternate API for trusting anonymized users through CDNs, portals, etc. Generating, storing and sending the tokens can be automated and transparent.
The premise is that if your calculated reputation isn't above a certain score, servers can choose to disregard or throttle your requests. Servers can update your rep on the blockchain via a provided OTP, based on user behavior. The higher your rep, the less likely it is that actions interpreted as malicious will sever or throttle your connection.
The big technical challenges I see would be mitigating abuse from both malicious clients and servers. Visit a malicious server and your rep is harmed. Weighting all past scores could mitigate this issue. Combining a gradient descent algorithm for adjusting reputation with a "time-out" mechanism could possibly mitigate the incentive for botnets to farm good tokens to sell to malicious users. The other big challenge of course would be user adoption.
This could be a robust way of dealing with DDoS attacks and botnets in the increasingly anonymized web. It could create an accountable web of trust for anonymous authentication, as it would take time and effort to create and maintain more than a few trustworthy private tokens. Any blockchain experts care to chime in?
- duskwuff 10y agoEr, privacy? From what you're describing it sounds like you'd be building a giant public database of users' browsing habits, which should raise some eyebrows. The fact that it's structured as a blockchain makes it worse, as there's no way to age out data.
- kakarot 10y agoBlockchain-based, so pure bitcoin-style blockchain implementation isn't necessary. It probably wouldn't be that big of an obstacle adding a trimming mechanism by, for example, maintaining a group of sub-chains. To limit the granularity of data being stored, it would only be used at authentication endpoints, to create a private session. Once you've identified yourself as reputable with a OTP that doesn't reveal anything about your actual internal ID, you can transfer secrets and further authentication is not necessary. The system would employ paranoid homomorphic encryption [0] and a fuzzy API. Hardly a worthwhile vector for analysis compared to the standard MitM attacks applied today by state agencies and ISPs. [0] https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption
- duskwuff 10y agoI think the problem runs deeper than you're considering. The entire purpose of this service, as you're describing it, is to allow web sites to access information on what other sites their users have visited (and, presumably, to read "reputation" annotations made by those sites), and to use that to make access control decisions. The privacy violations involved are inherent to that purpose; you can't wipe them away by throwing "but with encryption" at the problem.
- kakarot 10y agoI don't mean to shut down your criticism, but how does it present a vulnerable security model?
- duskwuff 10y agoPrivacy is a component of security. Systemically violating your users' privacy is a security issue -- period. If your "security models" don't recognize this as an issue, you need to change those models.
- kakarot 10y agoPrivacy and security are two separate domains. But even then, how does this violate anyone's privacy in any way that existing authentication protocols do not?
- caniszczyk 10y agocheck out Hyperledger for a FOSS blockchain community of projects: https://www.hyperledger.org/ https://www.hyperledger.org/