3 ms·

I think decentralized identity has a lot of potential. Using a web3 app was kind of an eye-opening experience to me - I didn't make an account, and the develope

I think decentralized identity has a lot of potential. Using a web3 app was kind of an eye-opening experience to me - I didn't make an account, and the developer of the app isn't managing the data involved. There's tradeoffs here from a usability and security standpoint(now I'm responsible for everything and nobody can help me if I lose my keys). But I think this stands some existing preconceptions about the way the web _has_ to work(just because it always has worked that way) on their head.

acdha 5y ago
The three questions I always ask for an identity solution: 1. What's the barrier to using your app? Past experience suggests that large numbers of people will drop off as difficulty ramps up unless you're either giving away money or gate-keeping something people have to use (e.g. your insurance company's signup process can be terrible up to the point that you switch). 2. Who handles impersonation? (e.g. how do you keep someone from making the news by registering “donaldjtrump” and posting something?) 3. Who handles user error or compromise? e.g. if my phone or laptop is stolen, how screwed am I?
- knownjorbist 5y ago
  1. The barrier is using a wallet of some kind. For me this difficulty kind of goes both ways - one, we've primed everyone already to expect to "sign up" for an account as it is, but in this realm they only need a wallet(a one-time operation). You go to a web3 site and click "connect wallet", approve, and that's it. In order to actually _do_ anything in terms of mutating your wallet's state, you have to willingly accept the transaction. 2. Impersonation depends on the application in question. It is a subject with a lot of attention, and I've seen varying proposed solutions for "proof of uniqueness". This is a good jumping off point imo: https://www.microsoft.com/en-us/security/business/identity-access-management/decentralized-identity-blockchain https://www.microsoft.com/en-us/security/business/identity-a... 3. This is where things diverge sharply from "web2". There is no "forgot password" or support infrastructure that can come to the rescue. At this current moment you are screwed. But there are some promising ideas that could address this - look into "social recovery".

acdha 5y ago

The three questions I always ask for an identity solution: 1. What's the barrier to using your app? Past experience suggests that large numbers of people will drop off as difficulty ramps up unless you're either giving away money or gate-keeping something people have to use (e.g. your insurance company's signup process can be terrible up to the point that you switch). 2. Who handles impersonation? (e.g. how do you keep someone from making the news by registering “donaldjtrump” and posting something?) 3. Who handles user error or compromise? e.g. if my phone or laptop is stolen, how screwed am I?

knownjorbist 5y ago
1. The barrier is using a wallet of some kind. For me this difficulty kind of goes both ways - one, we've primed everyone already to expect to "sign up" for an account as it is, but in this realm they only need a wallet(a one-time operation). You go to a web3 site and click "connect wallet", approve, and that's it. In order to actually _do_ anything in terms of mutating your wallet's state, you have to willingly accept the transaction. 2. Impersonation depends on the application in question. It is a subject with a lot of attention, and I've seen varying proposed solutions for "proof of uniqueness". This is a good jumping off point imo: https://www.microsoft.com/en-us/security/business/identity-access-management/decentralized-identity-blockchain https://www.microsoft.com/en-us/security/business/identity-a... 3. This is where things diverge sharply from "web2". There is no "forgot password" or support infrastructure that can come to the rescue. At this current moment you are screwed. But there are some promising ideas that could address this - look into "social recovery".