7 ms·

Sure, I understand that of course. I am just saying that practically speaking this property is not going to matter much in the world where everyone and their do

Sure, I understand that of course. I am just saying that practically speaking this property is not going to matter much in the world where everyone and their dog is on GMail. It is certainly nice to have though.

bct 15y ago
A system that assumes that everyone is on GMail will tend to ensure that everyone is on GMail, whether or not that's a good thing. Decentralization leaves the possibility of that situation changing open. That matters. (Or, less philosophically: there was a time that everyone and their dog were on Internet Explorer. I think we're all glad that we didn't close the door to browsers other than IE.)
nl 15y ago
The last numbers I saw put Gmail at under 10% of email account marketshare. Hotmail and Yahoo both had much bigger shares. It's difficult to imagine an authentication system that doesn't have some kind of centralized mechanism for making sure identities aren't duplicated. In this case, delegating that to a combination of two existing technologies (DNS for the domain, then email for the username) that are open, well understood and easy to implement seems appropriate. What's the alternative? Using some kind of pseudo-GUID and then maybe a derivative of the Paxos distributed consensus algorithm to decide if it is to be trusted? I'd imagine there would be a good number of PhDs in that approach before a system like that would be close to being ready for actual implementation. This system seems just about as decentralized as is practical. If you disagree I'd be very happy to hear alternatives.
- JoshTriplett 15y ago
  You can have fully decentralized identities quite trivially: just create a public/private key. No consensus algorithms required. With browsers now supporting synchronization features to connect the browsers on all systems used by a single user, such a system could actually work quite well now, without the usability issues it would once have had.
  - nl 15y ago
    This is a variety of SPKI[1], right? I was thinking of a conventional PKI approach, with an adapted web of trust to verify identities [2]. You are right - theoretically this could work. But it would pretty much take a "boil the ocean" approach to make it work. Browsers would need to implement a secure (private) keystore, and presumably some way to sync that to other browsers. A whole new standardized authentication flow would need to be created, which wouldn't be the same as the existing certificate-based authentication (which no one uses anyway) [1] http://en.wikipedia.org/wiki/Simple_public_key_infrastructure http://en.wikipedia.org/wiki/Simple_public_key_infrastructur... [2] http://en.wikipedia.org/wiki/Public_key_infrastructure#Web_of_Trust http://en.wikipedia.org/wiki/Public_key_infrastructure#Web_o...
    - moe 15y ago
      "boil the ocean" This particular ocean should be fairly easy to boil with a browser extension for all popular browsers.
    - nolliesnom 15y ago
      Huh? Browsers support client SSL certs today, but for some reason nobody uses them except intranets.
- bct 15y ago
  Zooko's triangle[1] in action: A BrowserID (like an email address) is memorable and secure, but not decentralized (it's centralized in DNS). A cryptographic key is decentralized and secure, but not memorable. Systems that are memorable and decentralized, but not secure, don't address these use cases at all. (And then there's Namecoin[2], which is a fascinating development, but not likely to see broad adoption in the near future.) [1]: http://en.wikipedia.org/wiki/Zookos_triangle http://en.wikipedia.org/wiki/Zookos_triangle [2]: https://en.bitcoin.it/wiki/Namecoin https://en.bitcoin.it/wiki/Namecoin
  - braindead_in 15y ago
    http://en.wikipedia.org/wiki/Zooko%27s_triangle http://en.wikipedia.org/wiki/Zooko%27s_triangle

bct 15y ago

A system that assumes that everyone is on GMail will tend to ensure that everyone is on GMail, whether or not that's a good thing. Decentralization leaves the possibility of that situation changing open. That matters. (Or, less philosophically: there was a time that everyone and their dog were on Internet Explorer. I think we're all glad that we didn't close the door to browsers other than IE.)

nl 15y ago

The last numbers I saw put Gmail at under 10% of email account marketshare. Hotmail and Yahoo both had much bigger shares. It's difficult to imagine an authentication system that doesn't have some kind of centralized mechanism for making sure identities aren't duplicated. In this case, delegating that to a combination of two existing technologies (DNS for the domain, then email for the username) that are open, well understood and easy to implement seems appropriate. What's the alternative? Using some kind of pseudo-GUID and then maybe a derivative of the Paxos distributed consensus algorithm to decide if it is to be trusted? I'd imagine there would be a good number of PhDs in that approach before a system like that would be close to being ready for actual implementation. This system seems just about as decentralized as is practical. If you disagree I'd be very happy to hear alternatives.

JoshTriplett 15y ago
You can have fully decentralized identities quite trivially: just create a public/private key. No consensus algorithms required. With browsers now supporting synchronization features to connect the browsers on all systems used by a single user, such a system could actually work quite well now, without the usability issues it would once have had.
- nl 15y ago
  This is a variety of SPKI[1], right? I was thinking of a conventional PKI approach, with an adapted web of trust to verify identities [2]. You are right - theoretically this could work. But it would pretty much take a "boil the ocean" approach to make it work. Browsers would need to implement a secure (private) keystore, and presumably some way to sync that to other browsers. A whole new standardized authentication flow would need to be created, which wouldn't be the same as the existing certificate-based authentication (which no one uses anyway) [1] http://en.wikipedia.org/wiki/Simple_public_key_infrastructure http://en.wikipedia.org/wiki/Simple_public_key_infrastructur... [2] http://en.wikipedia.org/wiki/Public_key_infrastructure#Web_of_Trust http://en.wikipedia.org/wiki/Public_key_infrastructure#Web_o...
  - moe 15y ago
    "boil the ocean" This particular ocean should be fairly easy to boil with a browser extension for all popular browsers.
  - nolliesnom 15y ago
    Huh? Browsers support client SSL certs today, but for some reason nobody uses them except intranets.
bct 15y ago
Zooko's triangle[1] in action: A BrowserID (like an email address) is memorable and secure, but not decentralized (it's centralized in DNS). A cryptographic key is decentralized and secure, but not memorable. Systems that are memorable and decentralized, but not secure, don't address these use cases at all. (And then there's Namecoin[2], which is a fascinating development, but not likely to see broad adoption in the near future.) [1]: http://en.wikipedia.org/wiki/Zookos_triangle http://en.wikipedia.org/wiki/Zookos_triangle [2]: https://en.bitcoin.it/wiki/Namecoin https://en.bitcoin.it/wiki/Namecoin
- braindead_in 15y ago
  http://en.wikipedia.org/wiki/Zooko%27s_triangle http://en.wikipedia.org/wiki/Zooko%27s_triangle