4 ms·

These magic numbers should get neutered, considered compromised from the start, and then we build a system based on that assumption. We could use a GPG like sys

These magic numbers should get neutered, considered compromised from the start, and then we build a system based on that assumption. We could use a GPG like system with certificates and expiration. A creditor produces my ciphertext signed before a revocation, or they can't even file it against my credit, which will take the same for verification to mark against my credit, and dismissing such claims by a creditor is trivial and automated. You dispute a transaction, and they produce your signature, or else it simply disappears. No court trials, nothing. It could get complicated, like mandatory checking of centralized revocation lists, which the creditor would also need proof of, etc. But it could be worked out by smart people, and even run by the government gasp. If a hacker gets the information, wow, they've got your public keys, and then upon discovering the breach, all the certs get revoked. But we'll keep using dumb magic numbers forever.

saagarjha 6y ago
> We could use a GPG like system with certificates and expiration. Yup, now nobody is going to use the thing. People use social security numbers because they’re convenient, not because they’re good.
- theonemind 6y ago
  I think such a system could be made convenient. And if the alternative is not legally binding, like, if they want to use magic numbers and paper and you give them the number and sign with ink and they give you money then come to collect, and all you have to say is "show me the digital signature", and they produce it or by law they have no claim, it'll get figured out and convenient.
- samatman 6y ago
  Europeans all own a little gizmo that takes a plastic card, which they use to authorize bank exchanges. It's not a big deal, and the proposal you're dismissing has an identical user experience. With 99% of pockets containing an NFC chipped phone these days, it could be even easier than that.
throwaway201103 6y ago
I agree about the "dumb magic numbers" but I don't think any digital system is the answer in the short term. Look at the complete disaster with ransomware, cryptolocking of databases shutting down or severely hampering businesses and health care orgs, the disclosures of data from organizations at every level of size and presumed technical sophistication, credit cards skimmed at will at ATMs, retailers, and online. It's a house of cards built on sand. Is the worst that can happen is the disclosure of public keys? What about the undetected exfiltration of the private keys that are used to issue everyone's certificates? Or the the random disabling/ransoming of the verfication infrastructure leaving nobody able to transact any business? I don't think we're close to being able to pull it off at anything approaching scale. It's not just a technical problem, hard as that is by itself, it's also a political problem, and a public trust problem. Right now, half the country would reject it based simply on which party is in power. "It could get complicated" indeed. I think we are a decade at least, maybe a generation away.

saagarjha 6y ago

> We could use a GPG like system with certificates and expiration. Yup, now nobody is going to use the thing. People use social security numbers because they’re convenient, not because they’re good.

theonemind 6y ago
I think such a system could be made convenient. And if the alternative is not legally binding, like, if they want to use magic numbers and paper and you give them the number and sign with ink and they give you money then come to collect, and all you have to say is "show me the digital signature", and they produce it or by law they have no claim, it'll get figured out and convenient.
samatman 6y ago
Europeans all own a little gizmo that takes a plastic card, which they use to authorize bank exchanges. It's not a big deal, and the proposal you're dismissing has an identical user experience. With 99% of pockets containing an NFC chipped phone these days, it could be even easier than that.

throwaway201103 6y ago

I agree about the "dumb magic numbers" but I don't think any digital system is the answer in the short term. Look at the complete disaster with ransomware, cryptolocking of databases shutting down or severely hampering businesses and health care orgs, the disclosures of data from organizations at every level of size and presumed technical sophistication, credit cards skimmed at will at ATMs, retailers, and online. It's a house of cards built on sand. Is the worst that can happen is the disclosure of public keys? What about the undetected exfiltration of the private keys that are used to issue everyone's certificates? Or the the random disabling/ransoming of the verfication infrastructure leaving nobody able to transact any business? I don't think we're close to being able to pull it off at anything approaching scale. It's not just a technical problem, hard as that is by itself, it's also a political problem, and a public trust problem. Right now, half the country would reject it based simply on which party is in power. "It could get complicated" indeed. I think we are a decade at least, maybe a generation away.