4 ms·

I said this in another comment on this post, but check out ENS. I’ve been a blockchain skeptic for a long time (and still am about art NFTs and most other thing

I said this in another comment on this post, but check out ENS. I’ve been a blockchain skeptic for a long time (and still am about art NFTs and most other things) but the idea of “SSO without a company attached” feels like something the mainstream public actually does want (think of all the negative public sentiment around big tech companies harvesting data and the grudging acceptance people have of their dependence on FB and Google for identity and easy sign-in). It’s also something that requires blockchain and can’t be done without a “decentralized consensus” about who owns what username (this is how you get around relying on a particular company). And ENS works now, it’s the kind of thing you could just go ahead and add to a web app you’re working on without having to wait for “the tech to arrive” or anything. Again, I’m still skeptical about most of this stuff, but this one thing seems like a pretty good and somewhat practical idea.

clpm4j 5y ago
I think blockchain SSO could be cool, but do you really think "the mainstream public actually does want" this? The negative public sentiment of big tech is coming from news platforms. As far as I can tell, hundreds of millions of people (e.g. the mainstream public) are using TikTok, Instagram, Snap, etc every single day. I've also never heard of any significant negativity towards Gmail for SSO (aside from my nerd engineer friends, and even among them a minority).
pavlov 5y ago
The mainstream public doesn't want their identity attached to a private key that they can lose. And if you're letting someone else store the key, then it's just another form of "Login with X".
- delaaxe 5y ago
  Unless the 'someone else' is a multisig consisting of a mixture of friends & relatives, instutitions and hardware devices.
  - uh_uh 5y ago
    And this is something that could power reversible transactions as well which I think is a current, but solvable problem of all crypto platforms. What you are proposing is actually a lot better than the tech we have now. If I ever lose my Google login and their customer service does not want to deal with me then honestly, I'm not sure what I'd do. I'd rather trust my friends and family to help me out than FAANG.
  - pavlov 5y ago
    An exciting new set of attack vectors and failure points foisted on people who mostly can’t understand what a safe URL looks like. When my partner clicks on a phishing link, not only are they exposing themselves but potentially also my identity in this multisig world.
  - _jal 5y ago
    And those institutions where everyone knows you go to register and hardware devices everyone trusts don't exist, so you're back to > doesn't seem to solve meaningful, mainstream problems yet
  - arcticbull 5y ago
    That's honestly the worst solution I could think of, and not one I would ever want to rely on. Not for me, not for my family, certainly not for my parents.
- Uehreka 5y ago
  Well if you think this is bad, wait until you hear about MFA ;-) On the real, I think there are people who will want to try this if it’s made easy enough. Some people could try getting a name and keeping a wallet through a 3rd party, in which case they’re no better or worse off than they are now. But at any moment, if they feel the need, they could transfer that username to a cold wallet if they want to take control of their security. Or transfer it back to the third party if they later decide that’s too much work. The cool thing about this is that it’s another option out there and it offers flexibility. For the record, again, I’m not one of those people calling this a revolution or “the biggest thing since the invention of the web”. I just think this one idea is kind of neat.
  - arcticbull 5y ago
    MFA only works because someone can re-set it for you. That's the point. "Not your keys, not your life" is simply the worst of all worlds.
- diveanon 5y ago
  Yeah much better to have it attached to phone number that can be sim swapped, biometric data that can be easily stolen, centralized user accounts, and my favorite national identity that you have no control over at all.
- Acrobatic_Road 5y ago
  >And if you're letting someone else store the key, then it's just another form of "Login with X". Luckily there's a way to have other people store your key without the key ever technically existing outside your own computer - https://app.tor.us/ https://app.tor.us/, and using common web services (like email) to retrieve everything you need to construct the key in your browser whenever you need it. You can even use this to send money to a public key before its corresponding private key has ever been constructed by anyone! Meaning you can send money to someone who lacks a wallet by email, or by telegram, or by discord, or by reddit, or by anything, and they retrieve the money without anyone else ever seeing their keys or having to manage their keys themselves. How it works: https://tech.tor.us/ https://tech.tor.us/ Disclaimer: NOT associated with torus, just think its cool.
bsid 5y ago
$150+ to own one for a year?
- yokem55 5y ago
  It's $5/yr in eth for the actual registration fee. The problem is that the transaction fee gas to register and maintain that registration is steep. So it's fairly common to register your ens for multiple years to save on gas. Once L2's/rollups are more mature and under community control, I expect ens to migrate to one and cut those transaction fees down substantially.
  - lrae 5y ago
    > It's $5/yr in eth for the actual registration fee. Unless you want a 3 or 4 character do... ENS name. Then it's spicy.
- Uehreka 5y ago
  One of my friends got their name for 10 years for $120, so it seems like it fluctuates.
root_axis 5y ago
How is it any better than OpenID? OpenID doesn't require a blockchain at least.
Acrobatic_Road 5y ago
Wait until you learn that ENS domains are NFTS.
- Uehreka 5y ago
  Which is why I now specify “art NFTs” ;-)
twic 5y ago
Client certificates have been a thing for years. They haven't caught on because the user experience is so terrible. ENS seems like client certificates with extra steps. But, it is definitely a real use-case, so hats off to people for having a go at it!
- Uehreka 5y ago
  If you want to trade easy of use against trust and security, you can use a browser extension like MetaMask that can hold your private key (or one of your private keys which you’ve chosen for this purpose) and perform the auth flow on sites that support this stuff. The UX is pretty smooth. If you want more control, you can build one of these browsers or extensions from source and audit the code yourself. So you can choose your level of challenge/paranoia.
roca 5y ago
Mozilla's Persona project solved federated ID for the Web pretty well, a decade ago. The problem is that a lot of the big tech companies want to completely own their relationships with their users. Google is never going to let you log in with something other than a Google ID, etc. There is no technical way to solve this problem.
- cblconfederate 5y ago
  persona was good, but was abandoned prematurely, probably for the reasons you mention I can log in somewhere with metamask however without involving google. It's orthogonal , and that s why it can succeed
- Uehreka 5y ago
  Oh totally true, I’m not expecting them to. I just think this could be a way to pick some of the low hanging fruit: users who want easy sign-in on sites that don’t want to roll their own IDP. Right now that niche is filled with the multicolored array of “sign in with FB, Google, MS, GitHub, Steam, LinkedIn, Apple”. This would be a way to add an extra option of “sign in with ENS” that would offer the benefit of not including tracking or any association at all with a particular company. Maybe not that many people would use it, but unlike a lot of other crypto stuff, this doesn’t require universal buy-in in order to be marginally useful to the people who do use it.
- hirsin 5y ago
  I mean, no, but they do let you sign in with a non Gmail address. (My @microsoft.com is a consumer Google account. Same way my @gmail personal email is a consumer Microsoft account.) Means of contact end up being a pretty useful way of organizing identities (phone numbers have their issues) and having ways to fix mistakes. The one thing I haven't seen solved in web3 is communication to a user. Easy enough to encrypt messages in ipfs though, I suppose.
rvz 5y ago
> And ENS works now, it’s the kind of thing you could just go ahead and add to a web app you’re working on without having to wait for “the tech to arrive” or anything. What they don't tell you is that every single operation for every dApp on Ethereum, the gas fess make using this totally useless, which mean you have no choice but to tell others to wait for 'the gas fees to go down'. Rendering it useless. Everyone knows that every operation is so expensive, that you cannot use Ethereum to pay for your groceries; making it totally useless in general since everyone needs to eat. Not even the other L2, ZK contraptions are ready or are even optimised enough to be useful so that isn't an option despite the hype around it. Seems more like a centralised domain registrar contract having a sub-domain on .eth (collides with Ethiopia's three letter TLD) on an expensive blockchain controlled by so-called 'trusted' key-holders.
- cqwrtiq 5y ago
  Quick sidenote - when signing in with ENS, you sign a message off chain using your private key, which they validate against your public key (your ENS domain is viewable onchain and does not require ETH gas fees to retrieve). So there's no additional cost incurred when signing in via ENS (besides the initial cost to purchase the domain + annual fees). To your point about operations in general on Ethereum, yes, they are expensive, prohibitively so for the general population.
rgallagher27 5y ago
Just took a look at ENS, within 5 mins I was able to find <pupular_first_name>.eth's first and last name, who they work for, their LinkedIN profile, their ETH address, how much they have in crypto holdings, what NFT's they buy/sell and full tx history... Who wants that?

clpm4j 5y ago

I think blockchain SSO could be cool, but do you really think "the mainstream public actually does want" this? The negative public sentiment of big tech is coming from news platforms. As far as I can tell, hundreds of millions of people (e.g. the mainstream public) are using TikTok, Instagram, Snap, etc every single day. I've also never heard of any significant negativity towards Gmail for SSO (aside from my nerd engineer friends, and even among them a minority).

pavlov 5y ago

The mainstream public doesn't want their identity attached to a private key that they can lose. And if you're letting someone else store the key, then it's just another form of "Login with X".

delaaxe 5y ago
Unless the 'someone else' is a multisig consisting of a mixture of friends & relatives, instutitions and hardware devices.
- uh_uh 5y ago
  And this is something that could power reversible transactions as well which I think is a current, but solvable problem of all crypto platforms. What you are proposing is actually a lot better than the tech we have now. If I ever lose my Google login and their customer service does not want to deal with me then honestly, I'm not sure what I'd do. I'd rather trust my friends and family to help me out than FAANG.
- pavlov 5y ago
  An exciting new set of attack vectors and failure points foisted on people who mostly can’t understand what a safe URL looks like. When my partner clicks on a phishing link, not only are they exposing themselves but potentially also my identity in this multisig world.
- _jal 5y ago
  And those institutions where everyone knows you go to register and hardware devices everyone trusts don't exist, so you're back to > doesn't seem to solve meaningful, mainstream problems yet
- arcticbull 5y ago
  That's honestly the worst solution I could think of, and not one I would ever want to rely on. Not for me, not for my family, certainly not for my parents.
Uehreka 5y ago
Well if you think this is bad, wait until you hear about MFA ;-) On the real, I think there are people who will want to try this if it’s made easy enough. Some people could try getting a name and keeping a wallet through a 3rd party, in which case they’re no better or worse off than they are now. But at any moment, if they feel the need, they could transfer that username to a cold wallet if they want to take control of their security. Or transfer it back to the third party if they later decide that’s too much work. The cool thing about this is that it’s another option out there and it offers flexibility. For the record, again, I’m not one of those people calling this a revolution or “the biggest thing since the invention of the web”. I just think this one idea is kind of neat.
- arcticbull 5y ago
  MFA only works because someone can re-set it for you. That's the point. "Not your keys, not your life" is simply the worst of all worlds.
diveanon 5y ago
Yeah much better to have it attached to phone number that can be sim swapped, biometric data that can be easily stolen, centralized user accounts, and my favorite national identity that you have no control over at all.
Acrobatic_Road 5y ago
>And if you're letting someone else store the key, then it's just another form of "Login with X". Luckily there's a way to have other people store your key without the key ever technically existing outside your own computer - https://app.tor.us/ https://app.tor.us/, and using common web services (like email) to retrieve everything you need to construct the key in your browser whenever you need it. You can even use this to send money to a public key before its corresponding private key has ever been constructed by anyone! Meaning you can send money to someone who lacks a wallet by email, or by telegram, or by discord, or by reddit, or by anything, and they retrieve the money without anyone else ever seeing their keys or having to manage their keys themselves. How it works: https://tech.tor.us/ https://tech.tor.us/ Disclaimer: NOT associated with torus, just think its cool.

bsid 5y ago

$150+ to own one for a year?

yokem55 5y ago
It's $5/yr in eth for the actual registration fee. The problem is that the transaction fee gas to register and maintain that registration is steep. So it's fairly common to register your ens for multiple years to save on gas. Once L2's/rollups are more mature and under community control, I expect ens to migrate to one and cut those transaction fees down substantially.
- lrae 5y ago
  > It's $5/yr in eth for the actual registration fee. Unless you want a 3 or 4 character do... ENS name. Then it's spicy.
Uehreka 5y ago
One of my friends got their name for 10 years for $120, so it seems like it fluctuates.

root_axis 5y ago

How is it any better than OpenID? OpenID doesn't require a blockchain at least.

Acrobatic_Road 5y ago

Wait until you learn that ENS domains are NFTS.

Uehreka 5y ago
Which is why I now specify “art NFTs” ;-)

twic 5y ago

Client certificates have been a thing for years. They haven't caught on because the user experience is so terrible. ENS seems like client certificates with extra steps. But, it is definitely a real use-case, so hats off to people for having a go at it!

Uehreka 5y ago
If you want to trade easy of use against trust and security, you can use a browser extension like MetaMask that can hold your private key (or one of your private keys which you’ve chosen for this purpose) and perform the auth flow on sites that support this stuff. The UX is pretty smooth. If you want more control, you can build one of these browsers or extensions from source and audit the code yourself. So you can choose your level of challenge/paranoia.

roca 5y ago

Mozilla's Persona project solved federated ID for the Web pretty well, a decade ago. The problem is that a lot of the big tech companies want to completely own their relationships with their users. Google is never going to let you log in with something other than a Google ID, etc. There is no technical way to solve this problem.

cblconfederate 5y ago
persona was good, but was abandoned prematurely, probably for the reasons you mention I can log in somewhere with metamask however without involving google. It's orthogonal , and that s why it can succeed
Uehreka 5y ago
Oh totally true, I’m not expecting them to. I just think this could be a way to pick some of the low hanging fruit: users who want easy sign-in on sites that don’t want to roll their own IDP. Right now that niche is filled with the multicolored array of “sign in with FB, Google, MS, GitHub, Steam, LinkedIn, Apple”. This would be a way to add an extra option of “sign in with ENS” that would offer the benefit of not including tracking or any association at all with a particular company. Maybe not that many people would use it, but unlike a lot of other crypto stuff, this doesn’t require universal buy-in in order to be marginally useful to the people who do use it.
hirsin 5y ago
I mean, no, but they do let you sign in with a non Gmail address. (My @microsoft.com is a consumer Google account. Same way my @gmail personal email is a consumer Microsoft account.) Means of contact end up being a pretty useful way of organizing identities (phone numbers have their issues) and having ways to fix mistakes. The one thing I haven't seen solved in web3 is communication to a user. Easy enough to encrypt messages in ipfs though, I suppose.

rvz 5y ago

> And ENS works now, it’s the kind of thing you could just go ahead and add to a web app you’re working on without having to wait for “the tech to arrive” or anything. What they don't tell you is that every single operation for every dApp on Ethereum, the gas fess make using this totally useless, which mean you have no choice but to tell others to wait for 'the gas fees to go down'. Rendering it useless. Everyone knows that every operation is so expensive, that you cannot use Ethereum to pay for your groceries; making it totally useless in general since everyone needs to eat. Not even the other L2, ZK contraptions are ready or are even optimised enough to be useful so that isn't an option despite the hype around it. Seems more like a centralised domain registrar contract having a sub-domain on .eth (collides with Ethiopia's three letter TLD) on an expensive blockchain controlled by so-called 'trusted' key-holders.

cqwrtiq 5y ago
Quick sidenote - when signing in with ENS, you sign a message off chain using your private key, which they validate against your public key (your ENS domain is viewable onchain and does not require ETH gas fees to retrieve). So there's no additional cost incurred when signing in via ENS (besides the initial cost to purchase the domain + annual fees). To your point about operations in general on Ethereum, yes, they are expensive, prohibitively so for the general population.

rgallagher27 5y ago

Just took a look at ENS, within 5 mins I was able to find <pupular_first_name>.eth's first and last name, who they work for, their LinkedIN profile, their ETH address, how much they have in crypto holdings, what NFT's they buy/sell and full tx history... Who wants that?