4 ms·

You need decentralized apps for centralized identity to work I think. Ironic I guess. But if you can have decentralized apps where the app writer is decoupled

You need decentralized apps for centralized identity to work I think. Ironic I guess. But if you can have decentralized apps where the app writer is decoupled from the app hosts (miners on Ethereum or similar), then there is a market for basically a identity+locker service sold directly to consumers. You need a cadre of great already written decentralized apps for that market to make sense, and we are possibly still 10 years away from that day. PhD students smarter than either of us are scratching their heads literally right now to even describe that first wave of apps. Five years til they defend their dissertations. Then the race is on.

vageli 7y ago
> You need decentralized apps for centralized identity to work I think. Ironic I guess. Can you expand on this? I don't see how that conclusion follows.
- erikpukinskis 7y ago
  Google, Facebook, etc have so many apps and have so many users that it would be crazy for them not to control their identity systems. A team of 20 people maintaining OAuth servers is a rounding error for them. They tend to want as many moats as possible (not because moats are good, but because you have to be paranoid AF to grow to a multi billion dollar company.) With distributed apps, the app writer doesn’t host their app, it’s hosted by random miners all over the world. This makes open source hosted services suddenly very easy for individuals to write. You don’t have to start a company to host your service, you just have to write it. Similar to the olden days when you could just throw up a tarball on a FTP site and millions of people could use your app. So it’s a very lightweight social structure holding up the nuts and bolts of running the service. However that creates a problem: there’s no trusted party there who is actually unlocking your data and assuring you and other that you are in fact you. If you have super duper OpSec skills, of course you can just maintain your private keys, get a safety deposit box for your backup tokens, etc. But for normal users that won’t be an option, so this space of open source decentralized apps will create a market for someone to provide at least basic identity services: holding backup keys, resetting your passwords, revoking session tokens, etc. And once you’re doing that you might as well throw in drivers license validation, group level data access control, etc.

vageli 7y ago

> You need decentralized apps for centralized identity to work I think. Ironic I guess. Can you expand on this? I don't see how that conclusion follows.

erikpukinskis 7y ago
Google, Facebook, etc have so many apps and have so many users that it would be crazy for them not to control their identity systems. A team of 20 people maintaining OAuth servers is a rounding error for them. They tend to want as many moats as possible (not because moats are good, but because you have to be paranoid AF to grow to a multi billion dollar company.) With distributed apps, the app writer doesn’t host their app, it’s hosted by random miners all over the world. This makes open source hosted services suddenly very easy for individuals to write. You don’t have to start a company to host your service, you just have to write it. Similar to the olden days when you could just throw up a tarball on a FTP site and millions of people could use your app. So it’s a very lightweight social structure holding up the nuts and bolts of running the service. However that creates a problem: there’s no trusted party there who is actually unlocking your data and assuring you and other that you are in fact you. If you have super duper OpSec skills, of course you can just maintain your private keys, get a safety deposit box for your backup tokens, etc. But for normal users that won’t be an option, so this space of open source decentralized apps will create a market for someone to provide at least basic identity services: holding backup keys, resetting your passwords, revoking session tokens, etc. And once you’re doing that you might as well throw in drivers license validation, group level data access control, etc.