5 ms·

I need to put my personal information in a public ledger, and then waste energy to prove it is correct?

specialist 5y ago
Yup, more or less. Misc central authorities issue you secure enclaves. Dept of licensing, health care system, banks, github, employer, etc. You then create key pairs as needed. Publish those public keys to misc web's of trust, as needed. Then use private digitally sign anything you think worth signing. Log those transactions to the misc blockchains, as needed. -- The alternative to authenticity is our current Freedom Speeches™ dystopia. Bots, sock puppets, identity theft industry, fraud, etc. For all the naysayers: Would you install unsigned, untrusted code? If you answer yes, then stuff like privacy and authenticity isn't really your priority. Choose wisely.
- mindslight 5y ago
  The problem is that any such system needs to be designed such that an individual can't be forced to give up their ironclad identity to a grocery store for loyalty discounts, to a webstore simply to make a purchase, or even to an online discussion forum - eg through blinding, nyms, and legal restrictions. But we lack the political will to mandate this, because corporate interests will sponsor loopholes that eliminate any such protections. We have the current state of affairs precisely because the law failed to include any prohibition on companies demanding SSNs/DLs for arbitrary purposes. > Would you install unsigned, untrusted code? Yes. I trust javascript from https://google.com https://google.com the same as javascript from http://dodgywarez.example.com http://dodgywarez.example.com. Both get executed in a javascript VM, nested in a KVM VM, off of my main desktop machine. Security based on making sure that there is someone to sue just doesn't scale.
  - specialist 5y ago
    Somewhat sandboxed scripting vs operating system is like coupon flyers vs notarized legal documents. Would you bank online via HTTP (vs HTTPS)? When I was doing nodejs work, npm artifacts still weren't being signed. Sure, some people play in traffic. Doesn't mean we all should. People arguing against privacy & authenicity always remind me of a coworker who emphatically opposed password managers or any system whatsoever for managing secrets. Something something "single point of failure".
    - mindslight 5y ago
      You seem to have referenced that example merely for a way of saying things should be secure, but I took it and tied it into a larger point about the futility of stronger identification. The thing about security is that it's inherently a multi party problem. Some party that is able to identify me is increasing their own security, but likely at the expense of decreasing my own security. You speak of authenticity, yet there is a good reason chat protocols don't stop at naive signatures, and actually increase their complexity for additional properties like repudiation. Sure, many activities prudently require a way to reasonably identify people and have an acceptable downside. And sometimes when individuals' security is broken, society benefits (eg DKIM being used to verify leaked email authenticity). But there are many more that do not need such things, and in fact doing so would harm our freedom (the examples I gave). You seem to be staking out the position that some sort of universal identity would be a good thing, including for casual Internet communication ("Bots, sock puppets"). I wholeheartedly disagree with this.
      - specialist 5y ago
        > I wholeheartedly disagree... Nihilism. For future, maybe lead with that. Save everyone a bit of angst.
        mindslight 5y ago
        I don't understand. Are you equating my position to nihilism? It's most assuredly not. If anything, technological determinism is closer to nihilism.
- nonameiguess 5y ago
  Babies, indigent and homeless, institutionalized, imprisoned, extreme rural, or people who just don't want to use electronic devices (Amish, etc.) all still have legal identities. Some of those people are even allowed to be employed and have bank accounts.
  - specialist 5y ago
    Since some of us can't or won't have privacy & authenticty, then no one can?

Yup, more or less. Misc central authorities issue you secure enclaves. Dept of licensing, health care system, banks, github, employer, etc. You then create key pairs as needed. Publish those public keys to misc web's of trust, as needed. Then use private digitally sign anything you think worth signing. Log those transactions to the misc blockchains, as needed. -- The alternative to authenticity is our current Freedom Speeches™ dystopia. Bots, sock puppets, identity theft industry, fraud, etc. For all the naysayers: Would you install unsigned, untrusted code? If you answer yes, then stuff like privacy and authenticity isn't really your priority. Choose wisely.

mindslight 5y ago
The problem is that any such system needs to be designed such that an individual can't be forced to give up their ironclad identity to a grocery store for loyalty discounts, to a webstore simply to make a purchase, or even to an online discussion forum - eg through blinding, nyms, and legal restrictions. But we lack the political will to mandate this, because corporate interests will sponsor loopholes that eliminate any such protections. We have the current state of affairs precisely because the law failed to include any prohibition on companies demanding SSNs/DLs for arbitrary purposes. > Would you install unsigned, untrusted code? Yes. I trust javascript from https://google.com https://google.com the same as javascript from http://dodgywarez.example.com http://dodgywarez.example.com. Both get executed in a javascript VM, nested in a KVM VM, off of my main desktop machine. Security based on making sure that there is someone to sue just doesn't scale.
- specialist 5y ago
  Somewhat sandboxed scripting vs operating system is like coupon flyers vs notarized legal documents. Would you bank online via HTTP (vs HTTPS)? When I was doing nodejs work, npm artifacts still weren't being signed. Sure, some people play in traffic. Doesn't mean we all should. People arguing against privacy & authenicity always remind me of a coworker who emphatically opposed password managers or any system whatsoever for managing secrets. Something something "single point of failure".
  - mindslight 5y ago
    You seem to have referenced that example merely for a way of saying things should be secure, but I took it and tied it into a larger point about the futility of stronger identification. The thing about security is that it's inherently a multi party problem. Some party that is able to identify me is increasing their own security, but likely at the expense of decreasing my own security. You speak of authenticity, yet there is a good reason chat protocols don't stop at naive signatures, and actually increase their complexity for additional properties like repudiation. Sure, many activities prudently require a way to reasonably identify people and have an acceptable downside. And sometimes when individuals' security is broken, society benefits (eg DKIM being used to verify leaked email authenticity). But there are many more that do not need such things, and in fact doing so would harm our freedom (the examples I gave). You seem to be staking out the position that some sort of universal identity would be a good thing, including for casual Internet communication ("Bots, sock puppets"). I wholeheartedly disagree with this.
    - specialist 5y ago
      > I wholeheartedly disagree... Nihilism. For future, maybe lead with that. Save everyone a bit of angst.
      - mindslight 5y ago
        I don't understand. Are you equating my position to nihilism? It's most assuredly not. If anything, technological determinism is closer to nihilism.
nonameiguess 5y ago
Babies, indigent and homeless, institutionalized, imprisoned, extreme rural, or people who just don't want to use electronic devices (Amish, etc.) all still have legal identities. Some of those people are even allowed to be employed and have bank accounts.
- specialist 5y ago
  Since some of us can't or won't have privacy & authenticty, then no one can?