4 ms·

A piece of technology that seems to be missing is a global decentralised anonymous identity and trust framework. It probably requires a leap of engineering com

A piece of technology that seems to be missing is a global decentralised anonymous identity and trust framework. It probably requires a leap of engineering comparable to the invention of the blockchain (although I don't think that a blockchain is necessarily the model to follow here, since the data should be encrypted). Every website and app and network service seems to be reinventing the wheel here, and end up creating little silos of trust data, whereas in principle it should be possible to receive a (locally) consistent answer to the question of "Is this person in good standing with the other humans they interact with?" whether that person is sending you an email, or writing a software library you are downloading, or creating an account on your website, or selling you goods on Ebay, or offering you a lift through a ride sharing app.

ijpsud 7y ago
I was talking about this with a friend the other day. I don't know about the technical feasibility (RE sybil attack[0]), but if it were possible, it would have a massive impact on the web. The current state of the art (in terms of new user signup) is using phone numbers as representing unique "trustable" people, which is kind of absurd. This reminds me of how social security numbers weren't originally intended to be used as unique identification, but the demand for some form of identification was so strong that organisations ended up hackily using it anyway.[1] [0] https://en.wikipedia.org/wiki/Sybil_attack https://en.wikipedia.org/wiki/Sybil_attack [1] https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus
- zozbot234 7y ago
  Just post a bond that is forfeited if you engage in verifiable abuse, the proceeds of which are used to compensate the victims (if applicable). Use pseudonymous identity to link any number of site-specific "identities" to that same initial posting. Real-name identity can then be optional (although some sites may still insist on it), but users in good standing are protected from "sybil" attacks because each entirely-new user requires posting a separate bond, so the cost quickly becomes infeasible.
  - ryanthemadone 7y ago
    I naïve reading of your solution implies that the poor wouldn't be able to put up such a bond and would therefore be excluded from this techno utopia - where the rich would be able to create Sybil's and game systems all day long.
  - dane-pgp 7y ago
    Posting bonds might be part of a solution, but there is still a question of who gets to decide whether or not something is abuse (or who is a victim, for that matter). The closest I've seen to this sort of system is OpenBazaar's use of "proof of burn": https://openbazaar.org/blog/why-proof-of-burn/ https://openbazaar.org/blog/why-proof-of-burn/
    - zozbot234 7y ago
      > but there is still a question of who gets to decide whether or not something is abuse (or who is a victim, for that matter) In principle, all you need is a trusted arbitrator that's acceptable to all involved parties. This is how "multiple signatures" work on Bitcoin already; the third-party escrow can decide who's going to keep the coins by adding her signature to either party's claim.
  - zelly 7y ago
    This doesn't solve the problem of identity. You still would need some way of differentiating the accounts with the bond, or else I can just sybil the system by having a lot of money and a really good way of impersonating people.
- zelly 7y ago
  Hot take, but the only real way to solve this identity problem is to take people's DNA. The only attack on that is to literally synthesize fake DNA/fake hair/fake saliva. Even then you can prompt randomly for DNA the way Twitter randomly prompts for phone number verification. Or ask the user for a selfie and spot inconsistencies in the mapping from DNA to face. It's scary to let internet companies have your actual DNA (though that didn't stop 23andme customers), so there could be an layer in between (a nonprofit? machine with a hardware security module?) that does the DNA sequencing and returns a digital signature to authenticate you. The obvious downside is that it would work too well. Banning becomes much more serious of a thing when it's lifelong and potentially could affect your descendants. I hope I'm not giving anyone any ideas because this is horrible.
  - s_kilk 7y ago
    Even DNA wouldn't work because of weird shit like chimerism. Our classic assumptions about this stuff just don't hold in reality.
tjalfi 7y ago
Sovrin[0] is a decentralized anonymous identity network that may be of interest. [0] https://sovrin.org https://sovrin.org
- dane-pgp 7y ago
  Very interesting, thank you. To give a little more detail, I will share a quote from their whitepaper: 'Sovrin utilizes a “public permissioned” distributed ledger design (Fig 4). The easiest analogy is to the global ATM network: anyone can use an ATM (public), but only those who’ve been given special permission can add a new ATM to the ATM network (permissioned). With the Sovrin Identity Network, it is the Sovrin Foundation that grants permission for “nodes” (akin to ATMs in the metaphor) to join the network.' https://sovrin.org/wp-content/uploads/2018/03/The-Inevitable-Rise-of-Self-Sovereign-Identity.pdf https://sovrin.org/wp-content/uploads/2018/03/The-Inevitable...
asdfsdfsdf 7y ago
Sounds like urbit. https://urbit.org/ https://urbit.org/ https://media.urbit.org/whitepaper.pdf https://media.urbit.org/whitepaper.pdf
zelly 7y ago
Trust cannot be decentralized. The whole idea of blockchain/Bitcoin[1] was eliminating trust from a process that would have required trust (keeping track of a ledger of funds). A system that provides trust in a trustless way is as paradoxical as it sounds. However you implement it, what some humans say have to serve as inputs to the system, and in reality that's who you're trusting. The best you can do is have just one central reference store of trust/reputation. China's social credit score is a working implementation of this. I don't think the West will ever be ready for that though, so you're going to have to deal with the fragmentation. [1] The innovation was requiring a computationally difficult problem to be solved to participate in the network and using hash functions to prevent tampering. This made any participant (miner) in the Bitcoin network a dumb cog in the machine that could be replaced by another. The people aren't special; the computational work is special.
- mikekchar 7y ago
  I completely agree with what you said, however I think there would be some very good value in simply keeping track of online relationships. I think the "web of trust" is actually very useful, if misnamed. Let's say I go to my online bank. I have a problem and I want to talk to the manager. It would be really great if I could have an easy way of determining if the person who is speaking to me is actually associated with the website I'm thinking of. I don't need to know their name. I don't need to know if they have a shady past or not. I just need to know that the somebody the website is going to let me talk to is the same somebody I'm talking to. Right now you can kind of jury rig something, but it's really difficult, error prone and easy to game socially. I work in the travel industry at the moment and even something as simple as being able to flag that a former salesperson no longer works for the company would be huge.

ijpsud 7y ago

I was talking about this with a friend the other day. I don't know about the technical feasibility (RE sybil attack[0]), but if it were possible, it would have a massive impact on the web. The current state of the art (in terms of new user signup) is using phone numbers as representing unique "trustable" people, which is kind of absurd. This reminds me of how social security numbers weren't originally intended to be used as unique identification, but the demand for some form of identification was so strong that organisations ended up hackily using it anyway.[1] [0] https://en.wikipedia.org/wiki/Sybil_attack https://en.wikipedia.org/wiki/Sybil_attack [1] https://www.youtube.com/watch?v=Erp8IAUouus https://www.youtube.com/watch?v=Erp8IAUouus

zozbot234 7y ago
Just post a bond that is forfeited if you engage in verifiable abuse, the proceeds of which are used to compensate the victims (if applicable). Use pseudonymous identity to link any number of site-specific "identities" to that same initial posting. Real-name identity can then be optional (although some sites may still insist on it), but users in good standing are protected from "sybil" attacks because each entirely-new user requires posting a separate bond, so the cost quickly becomes infeasible.
- ryanthemadone 7y ago
  I naïve reading of your solution implies that the poor wouldn't be able to put up such a bond and would therefore be excluded from this techno utopia - where the rich would be able to create Sybil's and game systems all day long.
- dane-pgp 7y ago
  Posting bonds might be part of a solution, but there is still a question of who gets to decide whether or not something is abuse (or who is a victim, for that matter). The closest I've seen to this sort of system is OpenBazaar's use of "proof of burn": https://openbazaar.org/blog/why-proof-of-burn/ https://openbazaar.org/blog/why-proof-of-burn/
  - zozbot234 7y ago
    > but there is still a question of who gets to decide whether or not something is abuse (or who is a victim, for that matter) In principle, all you need is a trusted arbitrator that's acceptable to all involved parties. This is how "multiple signatures" work on Bitcoin already; the third-party escrow can decide who's going to keep the coins by adding her signature to either party's claim.
- zelly 7y ago
  This doesn't solve the problem of identity. You still would need some way of differentiating the accounts with the bond, or else I can just sybil the system by having a lot of money and a really good way of impersonating people.
zelly 7y ago
Hot take, but the only real way to solve this identity problem is to take people's DNA. The only attack on that is to literally synthesize fake DNA/fake hair/fake saliva. Even then you can prompt randomly for DNA the way Twitter randomly prompts for phone number verification. Or ask the user for a selfie and spot inconsistencies in the mapping from DNA to face. It's scary to let internet companies have your actual DNA (though that didn't stop 23andme customers), so there could be an layer in between (a nonprofit? machine with a hardware security module?) that does the DNA sequencing and returns a digital signature to authenticate you. The obvious downside is that it would work too well. Banning becomes much more serious of a thing when it's lifelong and potentially could affect your descendants. I hope I'm not giving anyone any ideas because this is horrible.
- s_kilk 7y ago
  Even DNA wouldn't work because of weird shit like chimerism. Our classic assumptions about this stuff just don't hold in reality.

tjalfi 7y ago

Sovrin[0] is a decentralized anonymous identity network that may be of interest. [0] https://sovrin.org https://sovrin.org

dane-pgp 7y ago
Very interesting, thank you. To give a little more detail, I will share a quote from their whitepaper: 'Sovrin utilizes a “public permissioned” distributed ledger design (Fig 4). The easiest analogy is to the global ATM network: anyone can use an ATM (public), but only those who’ve been given special permission can add a new ATM to the ATM network (permissioned). With the Sovrin Identity Network, it is the Sovrin Foundation that grants permission for “nodes” (akin to ATMs in the metaphor) to join the network.' https://sovrin.org/wp-content/uploads/2018/03/The-Inevitable-Rise-of-Self-Sovereign-Identity.pdf https://sovrin.org/wp-content/uploads/2018/03/The-Inevitable...

asdfsdfsdf 7y ago

Sounds like urbit. https://urbit.org/ https://urbit.org/ https://media.urbit.org/whitepaper.pdf https://media.urbit.org/whitepaper.pdf

zelly 7y ago

Trust cannot be decentralized. The whole idea of blockchain/Bitcoin[1] was eliminating trust from a process that would have required trust (keeping track of a ledger of funds). A system that provides trust in a trustless way is as paradoxical as it sounds. However you implement it, what some humans say have to serve as inputs to the system, and in reality that's who you're trusting. The best you can do is have just one central reference store of trust/reputation. China's social credit score is a working implementation of this. I don't think the West will ever be ready for that though, so you're going to have to deal with the fragmentation. [1] The innovation was requiring a computationally difficult problem to be solved to participate in the network and using hash functions to prevent tampering. This made any participant (miner) in the Bitcoin network a dumb cog in the machine that could be replaced by another. The people aren't special; the computational work is special.

mikekchar 7y ago
I completely agree with what you said, however I think there would be some very good value in simply keeping track of online relationships. I think the "web of trust" is actually very useful, if misnamed. Let's say I go to my online bank. I have a problem and I want to talk to the manager. It would be really great if I could have an easy way of determining if the person who is speaking to me is actually associated with the website I'm thinking of. I don't need to know their name. I don't need to know if they have a shady past or not. I just need to know that the somebody the website is going to let me talk to is the same somebody I'm talking to. Right now you can kind of jury rig something, but it's really difficult, error prone and easy to game socially. I work in the travel industry at the moment and even something as simple as being able to flag that a former salesperson no longer works for the company would be huge.