8 ms·

You are describing "Login with Google" HN could easily support that, but one of the features of HN is that anonymity is optional.

k__ 5y ago
Login with Google is Login with Google, not login with your own private keys.
- gitfan86 5y ago
  You do have your own private keys when you enable authenticator on your mobile device for TWO-Factor auth.
- acdha 5y ago
  How is that meaningfully different? Technically, yes, Google could give your account to someone else but that would have significant business impacts unless it was done following a court order or something similar, which would also apply to a blockchain key. Similarly, unless the plan is to tell people that one mistake or hardware failure means they irrecoverably lose their identity, the same process which allows replacing an old key with a new one can be used to replace you. Finally, there appears to be either no benefit or a big privacy impact mapping keys to profiles on sites. If I go to a website and see “J. Random User” I have to trust that the owner of that site verified their identity against the expected source; if I see something like a signature against a particular key, there's a privacy issue from making it so easy to link you across sites and other activity (yes, people can use ), and if you don't trust the site operator you still have the problem of them showing a different ID when they're doing something dodgy.
  - k__ 5y ago
    "unless it was done following a court order or something similar" I thought, this is one of the main points we want to avoid here, so why are you phrasing it as something so unimportant?
    - preseinger 5y ago
      Court orders and regulations and etc. are the manifestations of government, and the mechanism by which humanity establishes social order. We... don't want to avoid court orders. We don't want to skirt regulations. These things exist for reasons.
    - acdha 5y ago
      Because it's something which is exceedingly rare, and it's more often desirable than not — for example, if your business partner breaks their agreement with you, you probably want a way to have a court enforced turnover rather than just having to write it off forever. The larger point here is that there's no benefit to the user if the experience is replacing “Login with Google” with “Login with <large exchange>”, which is what it would be for the vast majority of users. If it's saying “Login with your private key”, it would be important to think about why OpenID/Persona didn't catch on or the already-supported x509 key support which has been available for decades.
      - k__ 5y ago
        Okay, if you really think this is the case, then I understand the argument.
        acdha 5y ago
        I mean, you're the salesperson, sell the benefits — to the average person, how does this proposed system make their life better?
        DarylZero 5y ago
        It's about competition. You remove user lock-in and thereby create a market of competitors seeking to win users from each other.
        acdha 5y ago
        Okay, so what does that mean for the normal person? They're going from trusting Google to trusting another company which costs more, or holding their key themselves with the knowledge that they'll be locked out of all of their accounts if they lose it or are compromised. I understand that you have a financial benefit if they sign up but what part of that says “here's a benefit to you which is worth paying $$$ for!” to a normal person?
  - DarylZero 5y ago
    Google could: * Cancel your account for suspected fraud * Fall for a password recovery or other attack on your credentials * Cancel the entire service * Introduce fees for the service * Disconnect the identity service from the site where you authenticate
    - gitfan86 5y ago
      I want the identity provider to be able to cancel accounts. If they cannot cancel accounts what happens when a scammer creates an account that looks exactly like my company?
      - DarylZero 5y ago
        The "account" is a public key, which is random digits, so it doesn't look like anything.
    - acdha 5y ago
      Sure, and if we're coming up with hypotheticals, here are some which are far more likely: * A blockchain could increase the fees for service. Wait, that happens on a daily basis and you have no control over it. * A blockchain user could fall for an attack. Unlike the Google scenario, there's no way to regain control of your account – time to setup a new one and convince everyone you work with to update. * The site you're actually trying to use could switch to a different blockchain (which is more likely than only offering login with Google or that being canceled). * The site you're using could check a list of addresses and ban yours because it's suspected to be associated with fraud This is why I suggested taking off your salesguy hat and thinking about what this is like for normal people. Switching to a system which has mandatory upfront inconvenience and expense needs to have a big win to be worth it for people. If it's all “you'll find something to do with it later” you'll get adoption like GPG did. In this case, I think the key thing to consider is why people use Gmail. It's not like you can't run your own email server, but most people don't want to be responsible for something that important.
      - DarylZero 5y ago

k__ 5y ago

gitfan86 5y ago
You do have your own private keys when you enable authenticator on your mobile device for TWO-Factor auth.
acdha 5y ago
How is that meaningfully different? Technically, yes, Google could give your account to someone else but that would have significant business impacts unless it was done following a court order or something similar, which would also apply to a blockchain key. Similarly, unless the plan is to tell people that one mistake or hardware failure means they irrecoverably lose their identity, the same process which allows replacing an old key with a new one can be used to replace you. Finally, there appears to be either no benefit or a big privacy impact mapping keys to profiles on sites. If I go to a website and see “J. Random User” I have to trust that the owner of that site verified their identity against the expected source; if I see something like a signature against a particular key, there's a privacy issue from making it so easy to link you across sites and other activity (yes, people can use ), and if you don't trust the site operator you still have the problem of them showing a different ID when they're doing something dodgy.
- k__ 5y ago
  "unless it was done following a court order or something similar" I thought, this is one of the main points we want to avoid here, so why are you phrasing it as something so unimportant?
  - preseinger 5y ago
    Court orders and regulations and etc. are the manifestations of government, and the mechanism by which humanity establishes social order. We... don't want to avoid court orders. We don't want to skirt regulations. These things exist for reasons.
  - acdha 5y ago
    Because it's something which is exceedingly rare, and it's more often desirable than not — for example, if your business partner breaks their agreement with you, you probably want a way to have a court enforced turnover rather than just having to write it off forever. The larger point here is that there's no benefit to the user if the experience is replacing “Login with Google” with “Login with <large exchange>”, which is what it would be for the vast majority of users. If it's saying “Login with your private key”, it would be important to think about why OpenID/Persona didn't catch on or the already-supported x509 key support which has been available for decades.
    - k__ 5y ago
      Okay, if you really think this is the case, then I understand the argument.
      - acdha 5y ago
        I mean, you're the salesperson, sell the benefits — to the average person, how does this proposed system make their life better?
        DarylZero 5y ago
        It's about competition. You remove user lock-in and thereby create a market of competitors seeking to win users from each other.
        acdha 5y ago
        Okay, so what does that mean for the normal person? They're going from trusting Google to trusting another company which costs more, or holding their key themselves with the knowledge that they'll be locked out of all of their accounts if they lose it or are compromised. I understand that you have a financial benefit if they sign up but what part of that says “here's a benefit to you which is worth paying $$$ for!” to a normal person?
- DarylZero 5y ago
  Google could: * Cancel your account for suspected fraud * Fall for a password recovery or other attack on your credentials * Cancel the entire service * Introduce fees for the service * Disconnect the identity service from the site where you authenticate
  - gitfan86 5y ago
    I want the identity provider to be able to cancel accounts. If they cannot cancel accounts what happens when a scammer creates an account that looks exactly like my company?
    - DarylZero 5y ago
      The "account" is a public key, which is random digits, so it doesn't look like anything.
  - acdha 5y ago
    Sure, and if we're coming up with hypotheticals, here are some which are far more likely: * A blockchain could increase the fees for service. Wait, that happens on a daily basis and you have no control over it. * A blockchain user could fall for an attack. Unlike the Google scenario, there's no way to regain control of your account – time to setup a new one and convince everyone you work with to update. * The site you're actually trying to use could switch to a different blockchain (which is more likely than only offering login with Google or that being canceled). * The site you're using could check a list of addresses and ban yours because it's suspected to be associated with fraud This is why I suggested taking off your salesguy hat and thinking about what this is like for normal people. Switching to a system which has mandatory upfront inconvenience and expense needs to have a big win to be worth it for people. If it's all “you'll find something to do with it later” you'll get adoption like GPG did. In this case, I think the key thing to consider is why people use Gmail. It's not like you can't run your own email server, but most people don't want to be responsible for something that important.
    - DarylZero 5y ago