5 ms·

Authentication using the blockchain makes a great AI-resistant alternative to signups with captcha. The same account could be used by multiple independent servi

Authentication using the blockchain makes a great AI-resistant alternative to signups with captcha. The same account could be used by multiple independent services and this removes the need for a signup process altogether. It also removes the need for password management since you can use a single account/passphrase to log into various services without revealing your passphrase to any of these services; you can simply sign a message to prove to any service that you control an account (and know the passphrase) without actually revealing the passphrase to any of the third party services.

UncleMeat 5y ago
> The same account could be used by multiple independent services and this removes the need for a signup process altogether. This is only marginally better than SSO with Google/Apple/Facebook/whatever. It dodges the "Google closed my account" problem, which is a meaningful improvement. But I'm not fully certain why you need the public key to be part of a blockchain for this to work. Couldn't you just publish your public key identity on any number of considerably less wasteful systems? As far as I can tell, the only advantage here is the mapping between the name "UncleMeat" and my public key would be able to be reused across services... but in so many cases I don't want my identity to be consistent across services.
- cryptica 5y ago
  - Resistant to centralized censorship (as you pointed out) - It allows you to use the same passphrase for all services without compromising security since your passphrase never needs to leave your own machine; it is never sent over the wire. You just send signatures to different services. - The cost associated with purchasing tokens needed to initialize an account on the blockchain would serve as a spam prevention mechanism; an alternative to SIM cards which most centralized services rely on today as a cost barrier to limit the creation of spam accounts. - Superior integration potential between different services/systems provided by different companies/groups since they can all refer to the exact same account on the same blockchain and provide new ways to unify data between the different services.
  - UncleMeat 5y ago
    > Resistant to centralized censorship (as you pointed out) I'd wager that most people don't care about this much, though it is real. Still, this can be achieved with signature-based authentication that doesn't require the tremendous waste of BTC. Just... tell the service your public key and sign a message when you sign up. Your key pair doesn't need to be associated with some distributed system for that to work. This has been around for decades and not exactly caught on. > It allows you to use the same passphrase for all services without compromising security since your passphrase never needs to leave your own machine; it is never sent over the wire. You just send signatures to different services. This is true for all signature-based authentication, which does not necessitate a blockchain. > The cost associated with purchasing tokens needed to initialize an account on the blockchain would serve as a spam prevention mechanism; an alternative to SIM cards which most centralized services rely on today to limit the creation of spam accounts. This sounds like an anti-feature to me. Especially since it'd be foolish for a service to only support authentication via a blockchain. Imagine telling my grandmother that she needed to buy some btc in order to sign up for the service that hosted my wedding photos.
    - cryptica 5y ago
      >> This sounds like an anti-feature to me. Especially since it'd be foolish for a service to only support authentication via a blockchain. Imagine telling my grandmother that she needed to buy some btc in order to sign up for the service that hosted my wedding photos. This is different because your grandma would have to buy the tokens once and signup once and she will have access not only to the 'wedding photo service' but a large number of other services. It's more like paying a small amount of money to get access to an ecosystem of services. Like how people pay money to buy an iPhone and this gives them access to the Apple App Store and all the apps therein. There will also be network effects associated with the blockchain price going up with adoption. People who signed up early to the right blockchains will have priority access to certain software ecosystems and exclusive services which are only accessible to the richest among them (for example).
      - WJW 5y ago
mminer237 5y ago
Wouldn't that make it impossible to change your password if compromised?
- krageon 5y ago
  This post is talking about what is essentially a signing setup. If your private key is stolen in such a setup, the person who steals the key becomes you. Essentially yes :)
- cryptica 5y ago
  Yes but it also makes it a LOT less likely that your passphrase would be compromised because it is never sent to any service over the wire; with blockchain signatures, your passphrase never needs to leave your own machine. So the service providers you log into never have any opportunity to even see your passphrase; they only see your signatures which proves that you know the passphrase. You could use a different program for signing login messages so that you don't even need to insert your passphrase inside third party UIs. You'd use one trusted program of your choice to handle logins for all the different services; just copy paste the signature into the different services. There are some stateful blockchains which allow changing the passphrase but of course there is no 'forgot my password' feature; a malicious actor who manages to steal your passphrase could potentially use it to change your passphrase and lock you out of your account but at least you don't have to live in doubt if you suspect that your passphrase was compromised. The idea behind the blockchain auth approach is that you would only need one passphrase for all services but you would have to secure it carefully since losing it would cause you to be locked out of all services associated with that account.
  - marcus_holmes 5y ago
    If someone does steal your identity in this way, there's no way of getting it back. You can't appeal to any authority, because there's no authority to appeal to in a decentralised system. You literally have to start again and create a new identity. So you're gambling bigger: less likely to have your identity stolen, but complete loss of everything to do with that identity, with no recourse, if it is stolen. I'm not sure I like those odds.

UncleMeat 5y ago

> The same account could be used by multiple independent services and this removes the need for a signup process altogether. This is only marginally better than SSO with Google/Apple/Facebook/whatever. It dodges the "Google closed my account" problem, which is a meaningful improvement. But I'm not fully certain why you need the public key to be part of a blockchain for this to work. Couldn't you just publish your public key identity on any number of considerably less wasteful systems? As far as I can tell, the only advantage here is the mapping between the name "UncleMeat" and my public key would be able to be reused across services... but in so many cases I don't want my identity to be consistent across services.

cryptica 5y ago
- Resistant to centralized censorship (as you pointed out) - It allows you to use the same passphrase for all services without compromising security since your passphrase never needs to leave your own machine; it is never sent over the wire. You just send signatures to different services. - The cost associated with purchasing tokens needed to initialize an account on the blockchain would serve as a spam prevention mechanism; an alternative to SIM cards which most centralized services rely on today as a cost barrier to limit the creation of spam accounts. - Superior integration potential between different services/systems provided by different companies/groups since they can all refer to the exact same account on the same blockchain and provide new ways to unify data between the different services.
- UncleMeat 5y ago
  > Resistant to centralized censorship (as you pointed out) I'd wager that most people don't care about this much, though it is real. Still, this can be achieved with signature-based authentication that doesn't require the tremendous waste of BTC. Just... tell the service your public key and sign a message when you sign up. Your key pair doesn't need to be associated with some distributed system for that to work. This has been around for decades and not exactly caught on. > It allows you to use the same passphrase for all services without compromising security since your passphrase never needs to leave your own machine; it is never sent over the wire. You just send signatures to different services. This is true for all signature-based authentication, which does not necessitate a blockchain. > The cost associated with purchasing tokens needed to initialize an account on the blockchain would serve as a spam prevention mechanism; an alternative to SIM cards which most centralized services rely on today to limit the creation of spam accounts. This sounds like an anti-feature to me. Especially since it'd be foolish for a service to only support authentication via a blockchain. Imagine telling my grandmother that she needed to buy some btc in order to sign up for the service that hosted my wedding photos.
  - cryptica 5y ago
    >> This sounds like an anti-feature to me. Especially since it'd be foolish for a service to only support authentication via a blockchain. Imagine telling my grandmother that she needed to buy some btc in order to sign up for the service that hosted my wedding photos. This is different because your grandma would have to buy the tokens once and signup once and she will have access not only to the 'wedding photo service' but a large number of other services. It's more like paying a small amount of money to get access to an ecosystem of services. Like how people pay money to buy an iPhone and this gives them access to the Apple App Store and all the apps therein. There will also be network effects associated with the blockchain price going up with adoption. People who signed up early to the right blockchains will have priority access to certain software ecosystems and exclusive services which are only accessible to the richest among them (for example).
    - WJW 5y ago

mminer237 5y ago

Wouldn't that make it impossible to change your password if compromised?

krageon 5y ago
This post is talking about what is essentially a signing setup. If your private key is stolen in such a setup, the person who steals the key becomes you. Essentially yes :)
cryptica 5y ago
Yes but it also makes it a LOT less likely that your passphrase would be compromised because it is never sent to any service over the wire; with blockchain signatures, your passphrase never needs to leave your own machine. So the service providers you log into never have any opportunity to even see your passphrase; they only see your signatures which proves that you know the passphrase. You could use a different program for signing login messages so that you don't even need to insert your passphrase inside third party UIs. You'd use one trusted program of your choice to handle logins for all the different services; just copy paste the signature into the different services. There are some stateful blockchains which allow changing the passphrase but of course there is no 'forgot my password' feature; a malicious actor who manages to steal your passphrase could potentially use it to change your passphrase and lock you out of your account but at least you don't have to live in doubt if you suspect that your passphrase was compromised. The idea behind the blockchain auth approach is that you would only need one passphrase for all services but you would have to secure it carefully since losing it would cause you to be locked out of all services associated with that account.
- marcus_holmes 5y ago
  If someone does steal your identity in this way, there's no way of getting it back. You can't appeal to any authority, because there's no authority to appeal to in a decentralised system. You literally have to start again and create a new identity. So you're gambling bigger: less likely to have your identity stolen, but complete loss of everything to do with that identity, with no recourse, if it is stolen. I'm not sure I like those odds.