3 ms·

"unless it was done following a court order or something similar" I thought, this is one of the main points we want to avoid here, so why are you phrasing it a

by k__ 5y ago

"unless it was done following a court order or something similar" I thought, this is one of the main points we want to avoid here, so why are you phrasing it as something so unimportant?

preseinger 5y ago
Court orders and regulations and etc. are the manifestations of government, and the mechanism by which humanity establishes social order. We... don't want to avoid court orders. We don't want to skirt regulations. These things exist for reasons.
acdha 5y ago
Because it's something which is exceedingly rare, and it's more often desirable than not — for example, if your business partner breaks their agreement with you, you probably want a way to have a court enforced turnover rather than just having to write it off forever. The larger point here is that there's no benefit to the user if the experience is replacing “Login with Google” with “Login with <large exchange>”, which is what it would be for the vast majority of users. If it's saying “Login with your private key”, it would be important to think about why OpenID/Persona didn't catch on or the already-supported x509 key support which has been available for decades.
- k__ 5y ago
  Okay, if you really think this is the case, then I understand the argument.
  - acdha 5y ago
    I mean, you're the salesperson, sell the benefits — to the average person, how does this proposed system make their life better?
    - DarylZero 5y ago
      It's about competition. You remove user lock-in and thereby create a market of competitors seeking to win users from each other.
      - acdha 5y ago
        Okay, so what does that mean for the normal person? They're going from trusting Google to trusting another company which costs more, or holding their key themselves with the knowledge that they'll be locked out of all of their accounts if they lose it or are compromised. I understand that you have a financial benefit if they sign up but what part of that says “here's a benefit to you which is worth paying $$$ for!” to a normal person?
        DarylZero 5y ago
        You're mixing multiple issues up. Passwords and private keys are exactly equivalent in the possibilities of loss or compromise (and recovery). So we're not touching any of that here. > what part of that says “here's a benefit to you which is worth paying $$$ for!” to a normal person? You get to keep your contacts even if you get booted off the platform (or your contacts do). And it doesn't cost anything.
- DarylZero 5y ago
  >it would be important to think about why OpenID/Persona didn't catch on or the already-supported x509 key Why did SIM chips take off? Why did credit cards with smart chips take off? These both embed private keys. Even desktop computers are now embedding private keys in their motherboards. Clearly, something is missing from your analysis.
  - acdha 5y ago
    > Clearly, something is missing from your analysis. And yet you are unable to say what or offer relevant examples. Do you login in to websites using the key on your phone's SIM or your credit card? Both of those are amusing because they're bot not only irrelevant to the scenario in question but also something people use because that's what they were given, not something they sought out.
  - iggldiggl 5y ago
    The private key there is only an implementation detail, though. The reason people don't care about it is because in the case of a SIM card you can get a replacement SIM while keeping the same phone number (which is what people really care about), and in the case of a credit card where a premature replacement might involve a change of credit card number - for one-off payments it doesn't matter anyway, you just start using the new card and that's it - and for recurring payments all businesses already need to allow for updating your credit card details because credit cards regularly expire anyway, so having to possibly manually update all your recurring payments might be a bit tedious and annoying, but it's certainly no impossible, out-of-the-ordinary task

by k__ 5y ago

"unless it was done following a court order or something similar" I thought, this is one of the main points we want to avoid here, so why are you phrasing it as something so unimportant?

preseinger 5y ago

Court orders and regulations and etc. are the manifestations of government, and the mechanism by which humanity establishes social order. We... don't want to avoid court orders. We don't want to skirt regulations. These things exist for reasons.

acdha 5y ago

Because it's something which is exceedingly rare, and it's more often desirable than not — for example, if your business partner breaks their agreement with you, you probably want a way to have a court enforced turnover rather than just having to write it off forever. The larger point here is that there's no benefit to the user if the experience is replacing “Login with Google” with “Login with <large exchange>”, which is what it would be for the vast majority of users. If it's saying “Login with your private key”, it would be important to think about why OpenID/Persona didn't catch on or the already-supported x509 key support which has been available for decades.

k__ 5y ago
Okay, if you really think this is the case, then I understand the argument.
- acdha 5y ago
  I mean, you're the salesperson, sell the benefits — to the average person, how does this proposed system make their life better?
  - DarylZero 5y ago
    It's about competition. You remove user lock-in and thereby create a market of competitors seeking to win users from each other.
    - acdha 5y ago
      Okay, so what does that mean for the normal person? They're going from trusting Google to trusting another company which costs more, or holding their key themselves with the knowledge that they'll be locked out of all of their accounts if they lose it or are compromised. I understand that you have a financial benefit if they sign up but what part of that says “here's a benefit to you which is worth paying $$$ for!” to a normal person?
      - DarylZero 5y ago
        You're mixing multiple issues up. Passwords and private keys are exactly equivalent in the possibilities of loss or compromise (and recovery). So we're not touching any of that here. > what part of that says “here's a benefit to you which is worth paying $$$ for!” to a normal person? You get to keep your contacts even if you get booted off the platform (or your contacts do). And it doesn't cost anything.
DarylZero 5y ago
>it would be important to think about why OpenID/Persona didn't catch on or the already-supported x509 key Why did SIM chips take off? Why did credit cards with smart chips take off? These both embed private keys. Even desktop computers are now embedding private keys in their motherboards. Clearly, something is missing from your analysis.
- acdha 5y ago
  > Clearly, something is missing from your analysis. And yet you are unable to say what or offer relevant examples. Do you login in to websites using the key on your phone's SIM or your credit card? Both of those are amusing because they're bot not only irrelevant to the scenario in question but also something people use because that's what they were given, not something they sought out.
- iggldiggl 5y ago
  The private key there is only an implementation detail, though. The reason people don't care about it is because in the case of a SIM card you can get a replacement SIM while keeping the same phone number (which is what people really care about), and in the case of a credit card where a premature replacement might involve a change of credit card number - for one-off payments it doesn't matter anyway, you just start using the new card and that's it - and for recurring payments all businesses already need to allow for updating your credit card details because credit cards regularly expire anyway, so having to possibly manually update all your recurring payments might be a bit tedious and annoying, but it's certainly no impossible, out-of-the-ordinary task