4 ms·

My friends and I have thought this through in detail a while ago, and have a few suggestions to make. I hope you make the best of it! Distributed identity All

by DenisM 10y ago

My friends and I have thought this through in detail a while ago, and have a few suggestions to make. I hope you make the best of it! Distributed identity Allow me to designate trusted friends / custodians. Store fractions of my private key with them, so that they can rebuild the key if I lost mine. They should also be able to issue a "revocation as of certain date" if my key is compromised, and vouch for my new key being a valid replacement of the old key. So my identity becomes "Bob Smith from Seattle, friend of Jane Doe from Portland and Sally X from Redmond". My social circle is my identity! Non-technical users will not even need to know what private key / public key is. Relays Introduce a notion of the "relay" server - a server where I will register my current IP address for direct p2p connection, or pick my "voicemail" if I can't be reach right away. I can have multiple relays. So my list of friends is a list of their public keys and their relays as best I know them. Whenever I publish new content, the software will aggressively push the data to each of my friends / subscribers. Each time my relay list is updated, it also gets pushed to everyone. If I can't find my friend's relay, I will query our mutual friends to see if they know where to find my lost friend. Objects There should be a way to create handles for real-life objects and locations. Since many people will end up creating different entries for the same object, there should be a way for me to record in my log that guid-a and guid-b refer to the same restaurant in my opinion. As well I could access similar opinion records made by my friends, or their friends. Comments Each post has an identity, as does each location. My friends can comment on those things in their own log, but I will only see these comments if I get to access those posts / locations myself (or I go out of my way to look for them). This way I know what my friends think of this article or this restaurant. Bye-bye Yelp, bye-bye fake Amazon reviews. Content Curation I will subscribe to certain bots / people who will tell me that some pieces of news floating around will be a waste of my time or be offensive. Bye-bye clickbait, bye-bye goatse. Storage Allow me to designate space to store my friend's encrypted blobs for them. They can back up their files to me, and I can backup to them.

fossuser 10y ago
For the distributed identity piece is there a good reason not to rely on keybase.io? Also important that an initial smaller community would be targeted and that it would succeed there. FB did this will colleges, a federated one would in a world where FB already exists would have an even harder time.
- platz 10y ago
  > distributed identity piece is there a good reason not to rely on keybase.io Depends on your definition of "distributed", I suppose
  - pcmonk 10y ago
    My impression was that keybase is distributed? Can it be used without talking to keybase's servers?
    - cjbprime 10y ago
      The Keybase server manages giving out usernames, and recording the proof URLs for users, and then your client hits the URLs, checks that the proofs are signed with the appropriate key, and caches them to watch for future discrepancies. Keybase offers decentralized trust, in that the Keybase server can't lie to you about someone's keys -- your Keybase client will trust their public proofs and not the Keybase server -- but it's not a distributed/decentralized service as a whole, because you still receive hints from the server about where proofs live, and learn Keybase usernames from it. (I work at Keybase.)
      - agravier 10y ago
        Are you working on a fully decentralized architecture?
        cjbprime 10y ago
        (Speaking personally, not sure what an official Keybase opinion would be.) No, I don't think the tech is quite there yet. Even just handing out human-readable usernames requires blockchain-style consensus, and we don't have a blockchain being followed along by everyone's machines to adjudicate consensus requests (yet!). The folks at Blockstack Labs are doing fine work in this area, though: https://blockstack.org/ https://blockstack.org/
      - mundo 10y ago
ytjohn 10y ago
For relays, that is more or less what the pub servers do. I connect to a relay, and if I subscribe to a channel or follow an individual, I end up with messages from months ago. The pub servers "gossip" with each other, so any particular pub server you connect to, should be able to catch you up on all of your friends and channels "gossip".
crypt0x 10y ago
> Distributed identity a very nice person whom i like to call mix made a module for this recently: http://git.scuttlebot.io/%25XJz%2BcF9oIgd1eHYFGg3ycVwowLEseLwOc%2FwN%2Fvv8Dnc%3D.sha256 http://git.scuttlebot.io/%25XJz%2BcF9oIgd1eHYFGg3ycVwowLEseL...
- whimful 10y ago
  horcrux! also found here : https://www.npmjs.com/package/ssb-horcrux https://www.npmjs.com/package/ssb-horcrux The part which splits your key is now automated and part of Patchbay. I'll build the resurrection part when someone needs it
ftlio 10y ago
I think a lot of this stuff will rely on a more formal spec like https://github.com/solid/solid-spec https://github.com/solid/solid-spec to be useful. For identity, there's https://github.com/solid/solid-spec/blob/master/solid-webid-profiles.md https://github.com/solid/solid-spec/blob/master/solid-webid-... Right now I'm particularly interested in https://github.com/solid/web-access-control-spec https://github.com/solid/web-access-control-spec although I think it's incomplete when it comes to data portability and access control. From what I've seen on re-decentralizing the internet, access control is either non-existent, or relies on a server hosting your data to implement access control correctly. What if, in the WAC protocol linked above, instead of ACL resources informing the server, we could have ACL resources providing clients with keys to the encrypted resource (presumably wrapped in each authorized agent's pub key). Host proof data is a necessity for decentralized social networking IMO, even if the majority of agents would happily hand their keys over to their host.
password_reset 10y ago
you have had the same ideas as we did! this is roughly how secure scuttlebutt works.

by DenisM 10y ago

fossuser 10y ago

For the distributed identity piece is there a good reason not to rely on keybase.io? Also important that an initial smaller community would be targeted and that it would succeed there. FB did this will colleges, a federated one would in a world where FB already exists would have an even harder time.

platz 10y ago
> distributed identity piece is there a good reason not to rely on keybase.io Depends on your definition of "distributed", I suppose
- pcmonk 10y ago
  My impression was that keybase is distributed? Can it be used without talking to keybase's servers?
  - cjbprime 10y ago
    The Keybase server manages giving out usernames, and recording the proof URLs for users, and then your client hits the URLs, checks that the proofs are signed with the appropriate key, and caches them to watch for future discrepancies. Keybase offers decentralized trust, in that the Keybase server can't lie to you about someone's keys -- your Keybase client will trust their public proofs and not the Keybase server -- but it's not a distributed/decentralized service as a whole, because you still receive hints from the server about where proofs live, and learn Keybase usernames from it. (I work at Keybase.)
    - agravier 10y ago
      Are you working on a fully decentralized architecture?
      - cjbprime 10y ago
        (Speaking personally, not sure what an official Keybase opinion would be.) No, I don't think the tech is quite there yet. Even just handing out human-readable usernames requires blockchain-style consensus, and we don't have a blockchain being followed along by everyone's machines to adjudicate consensus requests (yet!). The folks at Blockstack Labs are doing fine work in this area, though: https://blockstack.org/ https://blockstack.org/
    - mundo 10y ago

ytjohn 10y ago

For relays, that is more or less what the pub servers do. I connect to a relay, and if I subscribe to a channel or follow an individual, I end up with messages from months ago. The pub servers "gossip" with each other, so any particular pub server you connect to, should be able to catch you up on all of your friends and channels "gossip".

crypt0x 10y ago

> Distributed identity a very nice person whom i like to call mix made a module for this recently: http://git.scuttlebot.io/%25XJz%2BcF9oIgd1eHYFGg3ycVwowLEseLwOc%2FwN%2Fvv8Dnc%3D.sha256 http://git.scuttlebot.io/%25XJz%2BcF9oIgd1eHYFGg3ycVwowLEseL...

whimful 10y ago
horcrux! also found here : https://www.npmjs.com/package/ssb-horcrux https://www.npmjs.com/package/ssb-horcrux The part which splits your key is now automated and part of Patchbay. I'll build the resurrection part when someone needs it

ftlio 10y ago

I think a lot of this stuff will rely on a more formal spec like https://github.com/solid/solid-spec https://github.com/solid/solid-spec to be useful. For identity, there's https://github.com/solid/solid-spec/blob/master/solid-webid-profiles.md https://github.com/solid/solid-spec/blob/master/solid-webid-... Right now I'm particularly interested in https://github.com/solid/web-access-control-spec https://github.com/solid/web-access-control-spec although I think it's incomplete when it comes to data portability and access control. From what I've seen on re-decentralizing the internet, access control is either non-existent, or relies on a server hosting your data to implement access control correctly. What if, in the WAC protocol linked above, instead of ACL resources informing the server, we could have ACL resources providing clients with keys to the encrypted resource (presumably wrapped in each authorized agent's pub key). Host proof data is a necessity for decentralized social networking IMO, even if the majority of agents would happily hand their keys over to their host.

password_reset 10y ago

you have had the same ideas as we did! this is roughly how secure scuttlebutt works.