7 ms·

frankly, i think this is where decentralized networks can help us. 1. networks where global reach to total strangers is not even possible, or at least is not t

by olah_1 5y ago

frankly, i think this is where decentralized networks can help us. 1. networks where global reach to total strangers is not even possible, or at least is not the default. the vast majority of people only really want to reach their “friends of friends” anyway. this eliminates a lot of would-be hackers from even knowing you exist. 2. accounts that are unhackable because users log in with private keys instead of user/pass that sit on a server. of course losing your private key is a problem, but i would suggest a system of social-account recovery anyway where you can regain access by 3 out of 5 friends approving, for example.

k4runa 5y ago
I do think a "trusted friends" circle would be a better way to deal with these kinds of problems, because I know my friends would be available to help me and easier to reach than customer support.
dylan604 5y ago
>the vast majority of people i think the concept of followers shows that your premise isn't exactly true and people with more followers than just family, friends, and friends of friends is also another clue.
- olah_1 5y ago
  “friends” in the term “friends of friends” refers to followers
menodialogues 5y ago
thats your big idea? i mean you can create a social network that does anything, and your big market killer is "safer login experience?" ... like who the fuck cares.
- analognoise 5y ago
  It doesn't matter at all to reality, so it's probably the next Unicorn in SV.
  - olah_1 5y ago
    did you read the original post up top? are you aware that we are specifically talking about account safety and login?
- olah_1 5y ago
  as prompted from the OP, it’s just a few things that a decentralized network can offer around account safety that is better than the current centralized ones today. what are you looking for from me? i’ll try to perform better for you next time lol.
neximo64 5y ago
Wouldn't that be worse since private keys are king and there is no way to intervene?
- wpietri 5y ago
  Exactly. If private keys were that much better for the average, shouldn't some common services use them now?
  - DarylZero 5y ago
    Private keys are used to upload code to github. It's not about what's "better" but about what users are willing to tolerate. The average user has a very high tolerance for login bullshit, repeated captchas, etc. -- if the site has a monopoly on the social network you need to access.
    - wpietri 5y ago
      And yet, even Github has passwords. Even Github uses passwords as primary. Along with millions of other sites. This isn't about what a few large companies do. It's about what works for most people. Private keys, as appealing as they are in theory, don't really work from a user perspective. The closest thing that seems to be popular is 2FA keys like YubiKeys.
quickthrower2 5y ago
domain registration and a blog solves most of this. You have to BYO discoverability though.
PragmaticPulp 5y ago
> 2. accounts that are unhackable because users log in with private keys instead of user/pass There's nothing magical about private keys that prevents them from being lost or stolen. The average person doesn't want to manage private key files. The average person wants to be able to recover their account if they forget or lose their password. Moving to private keys isn't a realistic solution for logins for the average person.
- toofy 5y ago
  I’m sure the average person didn’t want to use keys to lock their house or car—we adapt.
- DarylZero 5y ago
  The average person prefers passwords to key files? The average user isn't even aware of the potential option of the key file. I think the popularity of password managers shows that users preferences are opposite to what you say. The user wants the machine to store the secrets rather than memorize and type them. Recovery mechanisms is a separate issue from whether you use passwords or key files.
- olah_1 5y ago
  > The average person wants to be able to recover their account if they forget or lose their password That’s why i mentioned Social Account Recovery. There are solutions to improve general UX of key management.
est31 5y ago
A simple social recovery method of 3 contacts approving could lead to mass takeovers if the attacker gets a hold onto multiple accounts. Often, a group of say 3 attacker controlled accounts doesn't just have one friend in common but multiple. As long as the graph is 3 connected and the attacker starts out with a group of accounts that can take over one more account, the attacker can take over the entire graph.
- aqouta 5y ago
  There are ways around this. Just having each account only able to do the verification thing occasionally and resetting that timer when it's done on your account make this a very slow process that manual intervention should be able to thwart.
root_axis 5y ago
Not a good idea. Account recovery should not depend on social relationships, the nature of which could change any time.
- olah_1 5y ago
  The point is that it’s optional and changeable.

by olah_1 5y ago

k4runa 5y ago

I do think a "trusted friends" circle would be a better way to deal with these kinds of problems, because I know my friends would be available to help me and easier to reach than customer support.

dylan604 5y ago

>the vast majority of people i think the concept of followers shows that your premise isn't exactly true and people with more followers than just family, friends, and friends of friends is also another clue.

olah_1 5y ago
“friends” in the term “friends of friends” refers to followers

menodialogues 5y ago

thats your big idea? i mean you can create a social network that does anything, and your big market killer is "safer login experience?" ... like who the fuck cares.

analognoise 5y ago
It doesn't matter at all to reality, so it's probably the next Unicorn in SV.
- olah_1 5y ago
  did you read the original post up top? are you aware that we are specifically talking about account safety and login?
olah_1 5y ago
as prompted from the OP, it’s just a few things that a decentralized network can offer around account safety that is better than the current centralized ones today. what are you looking for from me? i’ll try to perform better for you next time lol.

neximo64 5y ago

Wouldn't that be worse since private keys are king and there is no way to intervene?

wpietri 5y ago
Exactly. If private keys were that much better for the average, shouldn't some common services use them now?
- DarylZero 5y ago
  Private keys are used to upload code to github. It's not about what's "better" but about what users are willing to tolerate. The average user has a very high tolerance for login bullshit, repeated captchas, etc. -- if the site has a monopoly on the social network you need to access.
  - wpietri 5y ago
    And yet, even Github has passwords. Even Github uses passwords as primary. Along with millions of other sites. This isn't about what a few large companies do. It's about what works for most people. Private keys, as appealing as they are in theory, don't really work from a user perspective. The closest thing that seems to be popular is 2FA keys like YubiKeys.

quickthrower2 5y ago

domain registration and a blog solves most of this. You have to BYO discoverability though.

PragmaticPulp 5y ago

> 2. accounts that are unhackable because users log in with private keys instead of user/pass There's nothing magical about private keys that prevents them from being lost or stolen. The average person doesn't want to manage private key files. The average person wants to be able to recover their account if they forget or lose their password. Moving to private keys isn't a realistic solution for logins for the average person.

toofy 5y ago
I’m sure the average person didn’t want to use keys to lock their house or car—we adapt.
DarylZero 5y ago
The average person prefers passwords to key files? The average user isn't even aware of the potential option of the key file. I think the popularity of password managers shows that users preferences are opposite to what you say. The user wants the machine to store the secrets rather than memorize and type them. Recovery mechanisms is a separate issue from whether you use passwords or key files.
olah_1 5y ago
> The average person wants to be able to recover their account if they forget or lose their password That’s why i mentioned Social Account Recovery. There are solutions to improve general UX of key management.

est31 5y ago

A simple social recovery method of 3 contacts approving could lead to mass takeovers if the attacker gets a hold onto multiple accounts. Often, a group of say 3 attacker controlled accounts doesn't just have one friend in common but multiple. As long as the graph is 3 connected and the attacker starts out with a group of accounts that can take over one more account, the attacker can take over the entire graph.

aqouta 5y ago
There are ways around this. Just having each account only able to do the verification thing occasionally and resetting that timer when it's done on your account make this a very slow process that manual intervention should be able to thwart.

root_axis 5y ago

Not a good idea. Account recovery should not depend on social relationships, the nature of which could change any time.

olah_1 5y ago
The point is that it’s optional and changeable.