13 ms·

Disclaimer: I work in the web3 (crypto) space and have for a long time already. I think the killer app for web3 is going to be a decentralized, open identity/a

Disclaimer: I work in the web3 (crypto) space and have for a long time already. I think the killer app for web3 is going to be a decentralized, open identity/auth solution. The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy. Nothing in the web2 tech stack currently allows this. Imagine being able to log in, securely, to HN, Twitter, your bank, et al., and with you comes basic data about how to contact you, how you pay, what assets you're holding, etc. You get to choose what you share, and you get to authenticate each transaction discretely. It's powerful and it puts that power in your hands, not in those of large corporate entities. That's what I'm interested in, and that's what I work on. We should all want some form of that. -- edit: glad the response to this was by people interested and curious. my usual feeling on HN is that people are hyper-negative about web3 tech. It's ok to be curious about new, cutting edge technology. That's what we're all here for, I think. Maybe the decentralized trend won't pan out. Maybe it is all a giant scam. Doesn't mean it isn't interesting and it doesn't mean that the people working in that space aren't legitimately trying to innovate.

elevader 5y ago
Wouldn't that be just as bad (if not worse) than the current situation? Those huge corporations could just read everything from the blockchain. At least in the current situation companies need to provide some sort of service to get to your data.
AnIdiotOnTheNet 5y ago
Web3 people need to talk about this more instead of all the FOMO scam bullshit they currently hype and which is tainting every reasonable human being against their ideas. Because right now, given how long the community has had to work on the problem and we still haven't seen anything like what you're describing, I'm still inclined to believe that Web3 is all a bunch of bullshit.
- ramijames 5y ago
  I do. I run a podcast (https://anchor.fm/ultraio/episodes/EP8-Ultras-case-for-NFTs-in-gaming-e1a5m6e https://anchor.fm/ultraio/episodes/EP8-Ultras-case-for-NFTs-...) and this is my primary concern: educating people about the real benefits of the technology. There's a lot of baseless hype and a lot of scammy bullshit. There is also a lot of real-world benefits that simply have not been leveraged to their fullest potential.
  - bsenftner 5y ago
    Love to hear some of the alluded to "real world benefits" - I have heard none so far, just claims of things an experienced engineer can invalidate with a few minutes of work.
    - ramijames 5y ago
      "A few minutes of work" is entirely disingenuous and misrepresents the problem at hand. "Blockchains" are not just distributed databases. They are also distributed, open APIs, and consensus mechanisms for updating and managing the functionality that controls those APIs and the data that they produce. I think about it this way: if you have one company that creates a database that many people use to build businesses around, then that company now holds a lot of power over the people who chose to build there. I believe that those people should have a say in the direction of the APIs that input/retrieve data, and ultimately should have some say in how long that database persists. The idea that we allow single entities to permanently control datasets seems absurd to me. Now, from an engineering management perspective, think about how you manage multiple teams who have different agendas, different priorities, and different needs for those APIs and the child data. How do you govern that? How do you ensure that all nodes that replicate this data set and the APIs are up to date and not doing funny business? This is all stuff that the decentralized community (web3) is trying to figure out together. It's DEEPLY interesting and ABSOLUTELY not "a few minutes work".
      - anduru_h 5y ago
        Could you elaborate more on how a blockchain will allow clients to influence the direction of the API and also keep other clients up to date on new API changes? That seems a lot more complex than the way you're putting it.
onepointsixC 5y ago
>The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy. Okay but instead of it being known to just say one company, anything on the block chain is known to everyone. I fail to see how that's any better or even remotely "powerful".
- ramijames 5y ago
  How does it feel knowing that you've signed up to 100 applications, which you use for everything from work to pleasure, and that that authenticating account can be taken from you at the whim of a company? Feels bad to me, man.
  - kdjfjcjcjd 5y ago
    Couldn't someone just steal your token and you lose access to 100 applications?
    - ramijames 5y ago
      No. It's not a token. It's an on-chain account verified by multiple permissions that are controlled by key pairs. It's based on EOSIO technology and is pretty robust.
      - nradov 5y ago
        How do you recover your account when you lose your keys?
        uncomputation 5y ago
        You can’t.
        waprin 5y ago
philosopher1234 5y ago
Unfortunately you acquire users by building what they actually want, not what they should want.
- ramijames 5y ago
  This is true and wise.
- haswell 5y ago
  This is not incompatible with what the parent comment is talking about. People want easy / seamless access to the services they use. If Web3 can find a way to provide that or improve upon the current hellscape of email based logins mixed with federated social logins mixed with the pain of maintaining 100 different accounts, it might just find a place. But the people working on this need to focus on the user’s end goals and UX needs, and not just declare the problem solved once a solution is technically working.
  - marcus_holmes 5y ago
    > People want easy / seamless access to the services they use. Free. People want it for free. Not free as in speech, but free as in beer. History has shown that the vast majority of people will trade their entire personal data set if they can get fake internet points for free.
    - ramijames 5y ago
      ABSOLUTELY. Accounts and transactions are free on our network. We think eventually all networks will have to go this route. Paying per-transaction is mind-bogglingly anti-user.
    - haswell 5y ago
      Sure, people want things for free, but that is orthogonal to the simplicity angle. Something can be free, but won’t see use if it sucks badly. People spend $$$ on Apple products because of the “just works” reputation. I’m not saying people want to pay for services, but I think it’s important to distinguish UX vs. cost when examining what motivates people.
worldmerge 5y ago
> Imagine being able to log in, securely, to HN, Twitter, your bank, et al., and with you comes basic data about how to contact you, how you pay, what assets you're holding, etc. You get to choose what you share, and you get to authenticate each transaction discretely. It's powerful and it puts that power in your hands, not in those of large corporate entities. That sounds interesting! How could I learn more about that? > that's what I work on What's your company?
- johnisgood 5y ago
  Yeah... How do I get to choose what I share? How would it work for HN or Twitter? Do they have to support this? Where should they start to be able to support this? Again, how am I going to choose what I share? Who exactly has to implement it? I really need some details. If we actually have to rely on Twitter implementing something like this, then I do not have high hopes, as they most likely would not want to implement something like this. :)
  - ramijames 5y ago
    Basically, we have an oauth-like mechanism that sites can integrate. The user gets to control, from their side, what data they whitelist and share. Whatever they don't, they don't get to have access to. You're right, though: this is a steep hill to climb.
- ramijames 5y ago
  Ultra.io is the company.
yucky 5y ago
I like this as well, but have zero faith in the wider public caring enough for that become the killer app. Most people do not care at all about Google/FB/Amazon owning their identity. It's sad, but true.
- ramijames 5y ago
  Sad, but true indeed. My hope is that there is a large enough minority that does care that will push for it's gradual integration and acceptance.
thesuperbigfrog 5y ago
>> I think the killer app for web3 is going to be a decentralized, open identity/auth solution. How would account recovery / password reset work in a web3-based system? With Google, Apple, etc. there is a party that one can go to for account recovery. How would it work for web3 if it is decentralized?
- ramijames 5y ago
  This is a really big problem that we spent a long time solving. The fact that if you lose your private key you lose your account and its associated identity and assets is a big deal. We have a recovery mechanism that allows you to set and manage secondary authenticators which are used as witnesses in the case of loss of access to your primary account. Another working group that I'm involved in is trying to solve this problem in a tangentially similar way using multi-signatures. It's an interesting approach.
  - aardvarkr 5y ago
    So what’s stopping my friends from stealing all of my money behind my back?
    - josephcsible 5y ago
      You're worried that a bunch of your most trusted friends, who you can even choose a subset of such that they don't know each other and have no connection other than you, will conspire to betray you in a provable way? Isn't that strictly less risk than giving a spare house key to a trusted friend or neighbor, which people do all the time?
- dopidopHN 5y ago
  Can’t à shared signed key algo be used ? Ala Shamir Shared secret algorithm? If 2 out of the 5 keys ( or whatever value ) are present you can log in.
- yokem55 5y ago
  There are multisig social recovery wallets where one party or a group of parties is trusted to help you get regain access to the account with a new signing key. Gnosis lets you do this with arbitrary friends of your choosing. Or if you're like most crypto folks and have no friends, something like Argent can handle this for you with email/phone number authentication after a delay (a few days).
afavour 5y ago
> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. Is it, though? It’s just a trade off people make to get a free service. If I want my email to be free of advertising scanning by large corporate entities I can just pay for Protonmail or something. This is what I feel like I see with web3 time and time again: it’s a complicated technological solution looking for a problem when (for the vast majority of people) that problem is already solvable without the complexity.
- ramijames 5y ago
  Honestly, I think the tech and infrastructure is simpler than what is currently deployed at google.
- aardvarkr 5y ago
  I strongly agree. Email is already a federated system that lets you own your own data. It turns out everyone would rather have convenience and that’s completely understandable.
pjc50 5y ago
> open identity/auth solution An open solution built around public key cryptography? This has been technically possible to do for two decades, in the form of PKI client certificates, but never got anywhere because the key management is the problem. Decentralisation trades "lose your account because you got banned" for "lose your account because any device with your key on it got compromised or lost", and for many people that works out worse. It's certainly less convenient. Identity provision is also a two-sided market. You need adoption from users and the companies they want to log into at the same time. That's why there's only a few providers that most companies bother to integrate with.
- gitfan86 5y ago
  The two-sided market is the big deal here. Imagine that you are a bank or online market place. What are you going to do when one of your top customers shows up and says that they lost their account keys? Are you going to explain that losing your account is actually a great feature that your company offers.
  - pjc50 5y ago
    To be fair, this is the level of customer service that you get from Google in the first place. Banks are forced to do better.
    - ramijames 5y ago
      Banks, at least in my country, can choose to accept incoming or outgoing financial transactions. Worse, governments have the rights to seize your assets, close your bank accounts, etc. Not sure any of that is better. I'd rather have Google shut my account down with no recourse. It's all shitty and it's all infuriating.
    - ineedasername 5y ago
      >Google I don't think that helps the Web3 argument. Google has made a choice, whereas crypto it is a technical limitation (or, to some, a feature). It also isn't a very good talking point to say "it's no worse than Google" Crypto needs to develop a better balance between bad 2FA with loop holes on the traditional side and absolute loss on the crypto side before a lot of people would feel comfortable with it. Maybe that should be one of its target killer apps.
Latty 5y ago
OpenID let you have custom auth that you controlled. Basically no one supported it, and basically no one used it. What would make the "web3" version different?
- ramijames 5y ago
  The honest answer here is because valuable assets are attached to that account. Money makes a big difference in what a company is incentivized to integrate and what they are not. OpenId is awesome, and is awesome FOR USERS. It's just not awesome for companies. They have zero incentive to integrate it.
  - brokensegue 5y ago
    I'm not sure it was awesome for users. I remember finding it confusing.
  - Latty 5y ago
    That seems very hopeful to me. You can attach certificates of ownership that mean nothing inherently and no one has any incentive to respect. I see no evidence of anyone finding a good use for NFTs right now, and all the suggestions I've heard have been hand-wavey and/or obviously deeply flawed. A bunch of speculators aren't going to drive actual adoption. To be clear: I used OpenID and I loved what it offered me, but I don't buy that "web3" fixes the problems that caused its death, or offers anything more than it did.
doom2 5y ago
Honest question: can that happen without users having to purchase ETH (or whatever the underlying token is)? My very limited understanding is that web3 is inherently tied to cryptocurrency and the miners have to be paid somehow.
- ramijames 5y ago
  The open network that we built has free accounts, free transactions, no resource staking requirements, etc. Gas on Ethereum is absolutely a problem and absolutely does not scale. We do not have mining (proof of stake), and have been certified carbon neutral (https://medium.com/ultra-io/ultras-blockchain-is-carbonneutral-certified-edbc41251f87 https://medium.com/ultra-io/ultras-blockchain-is-carbonneutr...)
  - brokensegue 5y ago
    > With this in mind, we chose to assign seven designated Block Producers for Ultra’s blockchain. This does not sound truly distributed. Like you might as well not use Blockchain if it's not distributed.
    - BlueTemplar 5y ago
      Git uses a kind of blockchain and is often centralized rather than distributed.
      - brokensegue 5y ago
        Pedantic but fine. I'll revise to "why use a trustless distributed ledger if you are going to only allow 7 validators. Might as well just use MySQL with an API.".
    - ramijames 5y ago
      Decentralization is really a spectrum. We have a set of block producers that we've vetted and have worked closely with to set up the infrastructure for our network. They are external companies (Ubisoft is one of them). The code that runs on the network gets vetted by them and only goes into production after they sign a multisig and allow it. It's not thousands of anonymous nodes, but it is also not a single entity that controls everything. We intend to build out a more decentralized pattern with more complex governance as things mature. It's a software project and as you all well know, you can't launch your ideal at the start. You launch what you can and you improve as you go. Decentralization is that way, too.
uncomputation 5y ago
This has been proposed as decentralized identifiers before actually: https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/
Mezzie 5y ago
I'm curious because I'd bet you're right that such a thing would be adopted really quickly if it were user-friendly but my biggest question is whether everybody would be limited to a single identity or if you'd allow multiples. If you allow multiples, would 'identities' be free? If so, I'd be concerned that the same thing would happen to your company and product that happened to Web 1.0: In THEORY we'll all have control over our own data, but in actuality, running software takes time, expertise, and money, so aren't we all (meaning the general public/average person) going to have a choose an intermediary anyway? And you think it should be your company. (Which maybe it should, idk). I'd also be a bit concerned about: - Ability to spin up alts and anonymous pseuds is a key component to Internet use, for me. One great thing about email is how easy it is to get an email address; I don't need a credit card, address, ID, etc. I don't need to use a real name. And so on. This is one of the things that makes the Web so powerful a force for the marginalized. For instance, I had an email address when I was 6. That's illegal now, but 13 year olds can have them. Or say you're a lady in Afghanistan. - This information persisting over time and being unalterable might result in some very uncomfortable social situations if people keep the same credentials for decades. None of this is a reason not to do such a thing, and I think it's a good idea and one I'd actually use in a heartbeat, I'm just not under any illusions I'd be doing much other than switching my 'alliance' away from an email service provider.
ReactiveJelly 5y ago
> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. That's what the companies want, though. Facebook and Twitter don't trust me because I have an email address, they trust me because I have a _Google_ email address. Having a Gmail account means that Google trusts you. Google only trusts you if you provide a reputable phone number. If you host your own email, you can't do anything because nobody trusts you. Changing the protocol from email to crypto won't fix that. I either have to be reputable ("Yes I'm wealthy, Google trusts me, I have a phone number which means I have a bank account, which means I'm a legal citizen with a government ID, and this is my legal name") or I can't get in. Standing up my own throw-away identity will be as useless tomorrow as a Mailinator address is today. For you and me, email auth is a dark pattern. For the companies, it's a feature. It keeps out freeloaders, spammers, and criminals.
- zild3d 5y ago
  > If you host your own email, you can't do anything because nobody trusts you. Where can you not signup with your own hosted email? I can't think of any service. Twitter, bank, saas apps, just care that you have an email.
toomuchtodo 5y ago
Legitimate companies are unlikely to rely on decentralized identity unless required to by law. Apple/Google federated login? Absolutely, they have the power to dictate it (Sign In With Apple). Login.gov and ID.me? Absolutely, they’re trusted government and private sector identity proofing providers. But trusting the identity of your users to a distributed ledger or computation fabric? I just don’t see it happening, and it’ll likely go the way for Mozilla’s federated identity provider. You are seeking a technical fix for a regulatory issue (data sovereignty and portability & digital privacy). (I work in digital identity and interface with decision makers)
tome 5y ago
I'm a bit confused by why this is in the "crypto" space. I thought the whole point of the "crypto" space was to prevent double spend. If you don't need to do that then a distributed/federated database seems sufficient. Are you planning to allow users to give/sell their accounts to others? If not then why are you using a "crypto" platform?
- BlueTemplar 5y ago
  Because you get into the issue of who gets the right to modify what part of the database, and encrypted blockchain is supposedly a solution ?
pavlov 5y ago
> I work in the web3 (crypto) space > Maybe it is all a giant scam Normally you'd expect people who work on something supposedly worth billions to be able to say with a degree of confidence that it's not a giant scam.
leifg 5y ago
Leaving aside the discussions around PKI and necessary centralization in public/private key authentication I've seen this web3 debate a couple of times now. It starts with "web3 is the second (third?) coming of the internet and will revolutionize everything". If you ask for proof or use cases the very first comment is: "You can log into Twitter using a public/private key pair" These are two very different statements. So even if you assume there is advantage in public/private key auth it is still nowhere close to an internet revolution. Imagine the PostgreSQL team had praised the JSON data type as the revolution of the internet and disruption of all industries as we know it. It's a useful feature and it is used by a lot of companies but it has zero impact on everyday people. And Bloomberg and the Wall Street Journal are certainly not writing about it.
intrasight 5y ago
Reminded me of this Jaron Lanier quote from "Sway" podcast: "I believe Facebook is undervalued for what it does. Because Facebook is essentially running identity for the internet, which is a very valuable function. So under a data dignity regime, I think Facebook would double or triple in value very quickly." I do think that digital identity is going to be an existential(pun intended) question. Ideally it would be managed by a competent government agency. That's likely in many countries. I doubt that it'll be the case in the USA.
tptacek 5y ago
I love when web3 people say this, because it's revealing. There is really no application you can come up with that is less amenable to decentralized blockchain technology than identity. The hardest problem in identity isn't public key authentication (which we've had for 2 decades, and nobody wants) but account recovery. The absolute last thing any ordinary user wants is an identity that is cryptographically unrecoverable, or that functions like a bearer bond if compromised. Account recovery isn't a basket of features like multi-sig wallets and threshold schemes. It's the assumption, so far baked in that most users don't even realize they're making it, that if something goes wrong with an account there is a human-mediated process for restoring access. A centralized authority is intrinsic to the concept! It has to be there from the beginning! You can't ask users to opt into it, because they're users and they don't know how any of this stuff works. It's for this reason that Apple and Google control so much of Internet identity, and are going to continue doing so. Advocates of decentralized identity are poisoned by the experiences and preferences of a tiny but vocal sliver of users that (1) are deeply into this stuff and (2) do enough weird shit to occasionally get on Google or Apple's bad side and have bad/annoying experiences with account recovery. The problem is that these voices are not representative of the market, like, at all. Google does a better job of global Internet identity than any organization operating at any kind of scale. If you can't recognize why this might be true, and will be an enormous obstacle to adoption, you're not engaging seriously with identity. The power that decentralized identity offers, normal people don't want. The things it takes away: necessities. It's a toy, not a killer app.
- annnoo 5y ago
  I completely agree with you, but I a small thought about public key authentication. Today more and more people without a background in IT which got in the "Web3"/Crypto ecosystem get in touch with public key authentication mostly used with wallets like Metamask. It get's understandable and usable for the average user.
  - tptacek 5y ago
    I don't see what that would get me that I wouldn't already have with Sign In With Apple, other than not being tied to Apple, which is one of the most important features of SIWA: if something goes wrong, there will be an ultra-annoying hard-landing customer service procedure that will, ultimately, restore access to my account.
zomglings 5y ago
Also building on web3. I agree about authorization (permissions) but not about identity/authentication. We do not need people to have to disclose their identities in order to use a service. We already have an authentication mechanism on every blockchain - the notion of an address/account. What we need is a decentralized way to associate permissions with those accounts. This is something that must happen more by social consensus - projects adopting a standard. The technology already exists.
can16358p 5y ago
Combine it with a decentralized/uncensorable web3 version of Twitter/Facebook and it also has the potential to become a killer app.
- arlcode 5y ago
  I don't think I agree that this is a killer app. Virtually no one wants the consequences of a fully unmoderated (aka uncensored) social network. Either there is are strong filter/segmentation capabilities (like "the algorithm" on current plattforms and different plattforms for different audiences) or anybody but the most radical / loud users leave sooner rather than later. Most users also have any of their content removed. So I don't see many advantages over the present state.
ForHackernews 5y ago
Email is already decentralized. I pay for Fastmail with my own domain because I don't want Microsoft or Google to own my primary online identity.
UncleMeat 5y ago
Signature-based authentication has existed for decades. All that has changed now is that your public key is now a "wallet." If blockchain based authentication becomes the norm, it will be entirely because there is now an unrelated reason for people to create, publish, and store an asymmetric key pair.
popcorncowboy 5y ago
> Nothing in the web2 tech stack currently allows this. Seriously? It takes five seconds online to find projects like https://solidproject.org https://solidproject.org (backed by people like Tim Berners-Lee) that don’t need blockchain and present strong arguments to address the kind of issues you raise. But it’s an open specification for the web. How lame and very NOT crypto $$$diamond_hands$$$. The most impressive thing about blockchain is its capacity to create zealots for the One True Way, all others be damned.
acdha 5y ago
> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy. > > Nothing in the web2 tech stack currently allows this. Anyone who wants to can get their own email address which doesn't require giving data to advertisers. You can run your own domain or use an email service which isn't run as a loss-leader for advertisers, and you can use services like the one Apple built into iOS if you want to prevent the sites you visit from having a common identifier. The cryptocurrency services will need a variation of that same solution since using one wallet for everything is bad for privacy but the average person has limited interest or ability to reliably juggle many wallets. What's more interesting is to consider is why many people chose a single email provider when it started as a service which is at least as decentralized as any cryptocurrency. That includes the extremely important account recovery problems tptacek mentioned, spam, but also simply things like the different values most people have for security and operations. Cryptocurrencies are theoretically decentralized but in practice most of the people involved seem to use a handful of exchanges and ostensibly decentralized services often depend on one or two companies, and that tends to come down to the same answer: most people don't want to run servers or be one mistake away from losing everything, and would prefer that work be someone else's job. The other problem we have is how much people are willing to pay. Fastmail, iCloud, etc. are not expensive but a LOT of people have reliably voted with their feet and there seems to be only a small number of people who mind ads enough to pay for alternatives. I don't see web3 as SSO going anywhere until there's a lot more value to be shown from buying in — that upfront non-trivial payment requirement for something which just allows you to access other services you presumably would also have to pay for seems like a tough sell as a mainstream movement.

elevader 5y ago

Wouldn't that be just as bad (if not worse) than the current situation? Those huge corporations could just read everything from the blockchain. At least in the current situation companies need to provide some sort of service to get to your data.

AnIdiotOnTheNet 5y ago

Web3 people need to talk about this more instead of all the FOMO scam bullshit they currently hype and which is tainting every reasonable human being against their ideas. Because right now, given how long the community has had to work on the problem and we still haven't seen anything like what you're describing, I'm still inclined to believe that Web3 is all a bunch of bullshit.

ramijames 5y ago
I do. I run a podcast (https://anchor.fm/ultraio/episodes/EP8-Ultras-case-for-NFTs-in-gaming-e1a5m6e https://anchor.fm/ultraio/episodes/EP8-Ultras-case-for-NFTs-...) and this is my primary concern: educating people about the real benefits of the technology. There's a lot of baseless hype and a lot of scammy bullshit. There is also a lot of real-world benefits that simply have not been leveraged to their fullest potential.
- bsenftner 5y ago
  Love to hear some of the alluded to "real world benefits" - I have heard none so far, just claims of things an experienced engineer can invalidate with a few minutes of work.
  - ramijames 5y ago
    "A few minutes of work" is entirely disingenuous and misrepresents the problem at hand. "Blockchains" are not just distributed databases. They are also distributed, open APIs, and consensus mechanisms for updating and managing the functionality that controls those APIs and the data that they produce. I think about it this way: if you have one company that creates a database that many people use to build businesses around, then that company now holds a lot of power over the people who chose to build there. I believe that those people should have a say in the direction of the APIs that input/retrieve data, and ultimately should have some say in how long that database persists. The idea that we allow single entities to permanently control datasets seems absurd to me. Now, from an engineering management perspective, think about how you manage multiple teams who have different agendas, different priorities, and different needs for those APIs and the child data. How do you govern that? How do you ensure that all nodes that replicate this data set and the APIs are up to date and not doing funny business? This is all stuff that the decentralized community (web3) is trying to figure out together. It's DEEPLY interesting and ABSOLUTELY not "a few minutes work".
    - anduru_h 5y ago
      Could you elaborate more on how a blockchain will allow clients to influence the direction of the API and also keep other clients up to date on new API changes? That seems a lot more complex than the way you're putting it.

onepointsixC 5y ago

ramijames 5y ago
How does it feel knowing that you've signed up to 100 applications, which you use for everything from work to pleasure, and that that authenticating account can be taken from you at the whim of a company? Feels bad to me, man.
- kdjfjcjcjd 5y ago
  Couldn't someone just steal your token and you lose access to 100 applications?
  - ramijames 5y ago
    No. It's not a token. It's an on-chain account verified by multiple permissions that are controlled by key pairs. It's based on EOSIO technology and is pretty robust.
    - nradov 5y ago
      How do you recover your account when you lose your keys?
      - uncomputation 5y ago
        You can’t.
      - waprin 5y ago

philosopher1234 5y ago

Unfortunately you acquire users by building what they actually want, not what they should want.

ramijames 5y ago
This is true and wise.
haswell 5y ago
This is not incompatible with what the parent comment is talking about. People want easy / seamless access to the services they use. If Web3 can find a way to provide that or improve upon the current hellscape of email based logins mixed with federated social logins mixed with the pain of maintaining 100 different accounts, it might just find a place. But the people working on this need to focus on the user’s end goals and UX needs, and not just declare the problem solved once a solution is technically working.
- marcus_holmes 5y ago
  > People want easy / seamless access to the services they use. Free. People want it for free. Not free as in speech, but free as in beer. History has shown that the vast majority of people will trade their entire personal data set if they can get fake internet points for free.
  - ramijames 5y ago
    ABSOLUTELY. Accounts and transactions are free on our network. We think eventually all networks will have to go this route. Paying per-transaction is mind-bogglingly anti-user.
  - haswell 5y ago
    Sure, people want things for free, but that is orthogonal to the simplicity angle. Something can be free, but won’t see use if it sucks badly. People spend $$$ on Apple products because of the “just works” reputation. I’m not saying people want to pay for services, but I think it’s important to distinguish UX vs. cost when examining what motivates people.

worldmerge 5y ago

> Imagine being able to log in, securely, to HN, Twitter, your bank, et al., and with you comes basic data about how to contact you, how you pay, what assets you're holding, etc. You get to choose what you share, and you get to authenticate each transaction discretely. It's powerful and it puts that power in your hands, not in those of large corporate entities. That sounds interesting! How could I learn more about that? > that's what I work on What's your company?

johnisgood 5y ago
Yeah... How do I get to choose what I share? How would it work for HN or Twitter? Do they have to support this? Where should they start to be able to support this? Again, how am I going to choose what I share? Who exactly has to implement it? I really need some details. If we actually have to rely on Twitter implementing something like this, then I do not have high hopes, as they most likely would not want to implement something like this. :)
- ramijames 5y ago
  Basically, we have an oauth-like mechanism that sites can integrate. The user gets to control, from their side, what data they whitelist and share. Whatever they don't, they don't get to have access to. You're right, though: this is a steep hill to climb.
ramijames 5y ago
Ultra.io is the company.

yucky 5y ago

I like this as well, but have zero faith in the wider public caring enough for that become the killer app. Most people do not care at all about Google/FB/Amazon owning their identity. It's sad, but true.

ramijames 5y ago
Sad, but true indeed. My hope is that there is a large enough minority that does care that will push for it's gradual integration and acceptance.

thesuperbigfrog 5y ago

>> I think the killer app for web3 is going to be a decentralized, open identity/auth solution. How would account recovery / password reset work in a web3-based system? With Google, Apple, etc. there is a party that one can go to for account recovery. How would it work for web3 if it is decentralized?

ramijames 5y ago
This is a really big problem that we spent a long time solving. The fact that if you lose your private key you lose your account and its associated identity and assets is a big deal. We have a recovery mechanism that allows you to set and manage secondary authenticators which are used as witnesses in the case of loss of access to your primary account. Another working group that I'm involved in is trying to solve this problem in a tangentially similar way using multi-signatures. It's an interesting approach.
- aardvarkr 5y ago
  So what’s stopping my friends from stealing all of my money behind my back?
  - josephcsible 5y ago
    You're worried that a bunch of your most trusted friends, who you can even choose a subset of such that they don't know each other and have no connection other than you, will conspire to betray you in a provable way? Isn't that strictly less risk than giving a spare house key to a trusted friend or neighbor, which people do all the time?
dopidopHN 5y ago
Can’t à shared signed key algo be used ? Ala Shamir Shared secret algorithm? If 2 out of the 5 keys ( or whatever value ) are present you can log in.
yokem55 5y ago
There are multisig social recovery wallets where one party or a group of parties is trusted to help you get regain access to the account with a new signing key. Gnosis lets you do this with arbitrary friends of your choosing. Or if you're like most crypto folks and have no friends, something like Argent can handle this for you with email/phone number authentication after a delay (a few days).

afavour 5y ago

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. Is it, though? It’s just a trade off people make to get a free service. If I want my email to be free of advertising scanning by large corporate entities I can just pay for Protonmail or something. This is what I feel like I see with web3 time and time again: it’s a complicated technological solution looking for a problem when (for the vast majority of people) that problem is already solvable without the complexity.

ramijames 5y ago
Honestly, I think the tech and infrastructure is simpler than what is currently deployed at google.
aardvarkr 5y ago
I strongly agree. Email is already a federated system that lets you own your own data. It turns out everyone would rather have convenience and that’s completely understandable.

pjc50 5y ago

> open identity/auth solution An open solution built around public key cryptography? This has been technically possible to do for two decades, in the form of PKI client certificates, but never got anywhere because the key management is the problem. Decentralisation trades "lose your account because you got banned" for "lose your account because any device with your key on it got compromised or lost", and for many people that works out worse. It's certainly less convenient. Identity provision is also a two-sided market. You need adoption from users and the companies they want to log into at the same time. That's why there's only a few providers that most companies bother to integrate with.

gitfan86 5y ago
The two-sided market is the big deal here. Imagine that you are a bank or online market place. What are you going to do when one of your top customers shows up and says that they lost their account keys? Are you going to explain that losing your account is actually a great feature that your company offers.
- pjc50 5y ago
  To be fair, this is the level of customer service that you get from Google in the first place. Banks are forced to do better.
  - ramijames 5y ago
    Banks, at least in my country, can choose to accept incoming or outgoing financial transactions. Worse, governments have the rights to seize your assets, close your bank accounts, etc. Not sure any of that is better. I'd rather have Google shut my account down with no recourse. It's all shitty and it's all infuriating.
  - ineedasername 5y ago
    >Google I don't think that helps the Web3 argument. Google has made a choice, whereas crypto it is a technical limitation (or, to some, a feature). It also isn't a very good talking point to say "it's no worse than Google" Crypto needs to develop a better balance between bad 2FA with loop holes on the traditional side and absolute loss on the crypto side before a lot of people would feel comfortable with it. Maybe that should be one of its target killer apps.

Latty 5y ago

OpenID let you have custom auth that you controlled. Basically no one supported it, and basically no one used it. What would make the "web3" version different?

ramijames 5y ago
The honest answer here is because valuable assets are attached to that account. Money makes a big difference in what a company is incentivized to integrate and what they are not. OpenId is awesome, and is awesome FOR USERS. It's just not awesome for companies. They have zero incentive to integrate it.
- brokensegue 5y ago
  I'm not sure it was awesome for users. I remember finding it confusing.
- Latty 5y ago
  That seems very hopeful to me. You can attach certificates of ownership that mean nothing inherently and no one has any incentive to respect. I see no evidence of anyone finding a good use for NFTs right now, and all the suggestions I've heard have been hand-wavey and/or obviously deeply flawed. A bunch of speculators aren't going to drive actual adoption. To be clear: I used OpenID and I loved what it offered me, but I don't buy that "web3" fixes the problems that caused its death, or offers anything more than it did.

doom2 5y ago

Honest question: can that happen without users having to purchase ETH (or whatever the underlying token is)? My very limited understanding is that web3 is inherently tied to cryptocurrency and the miners have to be paid somehow.

ramijames 5y ago
The open network that we built has free accounts, free transactions, no resource staking requirements, etc. Gas on Ethereum is absolutely a problem and absolutely does not scale. We do not have mining (proof of stake), and have been certified carbon neutral (https://medium.com/ultra-io/ultras-blockchain-is-carbonneutral-certified-edbc41251f87 https://medium.com/ultra-io/ultras-blockchain-is-carbonneutr...)
- brokensegue 5y ago
  > With this in mind, we chose to assign seven designated Block Producers for Ultra’s blockchain. This does not sound truly distributed. Like you might as well not use Blockchain if it's not distributed.
  - BlueTemplar 5y ago
    Git uses a kind of blockchain and is often centralized rather than distributed.
    - brokensegue 5y ago
      Pedantic but fine. I'll revise to "why use a trustless distributed ledger if you are going to only allow 7 validators. Might as well just use MySQL with an API.".
  - ramijames 5y ago
    Decentralization is really a spectrum. We have a set of block producers that we've vetted and have worked closely with to set up the infrastructure for our network. They are external companies (Ubisoft is one of them). The code that runs on the network gets vetted by them and only goes into production after they sign a multisig and allow it. It's not thousands of anonymous nodes, but it is also not a single entity that controls everything. We intend to build out a more decentralized pattern with more complex governance as things mature. It's a software project and as you all well know, you can't launch your ideal at the start. You launch what you can and you improve as you go. Decentralization is that way, too.

uncomputation 5y ago

This has been proposed as decentralized identifiers before actually: https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/

Mezzie 5y ago

I'm curious because I'd bet you're right that such a thing would be adopted really quickly if it were user-friendly but my biggest question is whether everybody would be limited to a single identity or if you'd allow multiples. If you allow multiples, would 'identities' be free? If so, I'd be concerned that the same thing would happen to your company and product that happened to Web 1.0: In THEORY we'll all have control over our own data, but in actuality, running software takes time, expertise, and money, so aren't we all (meaning the general public/average person) going to have a choose an intermediary anyway? And you think it should be your company. (Which maybe it should, idk). I'd also be a bit concerned about: - Ability to spin up alts and anonymous pseuds is a key component to Internet use, for me. One great thing about email is how easy it is to get an email address; I don't need a credit card, address, ID, etc. I don't need to use a real name. And so on. This is one of the things that makes the Web so powerful a force for the marginalized. For instance, I had an email address when I was 6. That's illegal now, but 13 year olds can have them. Or say you're a lady in Afghanistan. - This information persisting over time and being unalterable might result in some very uncomfortable social situations if people keep the same credentials for decades. None of this is a reason not to do such a thing, and I think it's a good idea and one I'd actually use in a heartbeat, I'm just not under any illusions I'd be doing much other than switching my 'alliance' away from an email service provider.

ReactiveJelly 5y ago

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. That's what the companies want, though. Facebook and Twitter don't trust me because I have an email address, they trust me because I have a _Google_ email address. Having a Gmail account means that Google trusts you. Google only trusts you if you provide a reputable phone number. If you host your own email, you can't do anything because nobody trusts you. Changing the protocol from email to crypto won't fix that. I either have to be reputable ("Yes I'm wealthy, Google trusts me, I have a phone number which means I have a bank account, which means I'm a legal citizen with a government ID, and this is my legal name") or I can't get in. Standing up my own throw-away identity will be as useless tomorrow as a Mailinator address is today. For you and me, email auth is a dark pattern. For the companies, it's a feature. It keeps out freeloaders, spammers, and criminals.

zild3d 5y ago
> If you host your own email, you can't do anything because nobody trusts you. Where can you not signup with your own hosted email? I can't think of any service. Twitter, bank, saas apps, just care that you have an email.

toomuchtodo 5y ago

Legitimate companies are unlikely to rely on decentralized identity unless required to by law. Apple/Google federated login? Absolutely, they have the power to dictate it (Sign In With Apple). Login.gov and ID.me? Absolutely, they’re trusted government and private sector identity proofing providers. But trusting the identity of your users to a distributed ledger or computation fabric? I just don’t see it happening, and it’ll likely go the way for Mozilla’s federated identity provider. You are seeking a technical fix for a regulatory issue (data sovereignty and portability & digital privacy). (I work in digital identity and interface with decision makers)

tome 5y ago

I'm a bit confused by why this is in the "crypto" space. I thought the whole point of the "crypto" space was to prevent double spend. If you don't need to do that then a distributed/federated database seems sufficient. Are you planning to allow users to give/sell their accounts to others? If not then why are you using a "crypto" platform?

BlueTemplar 5y ago
Because you get into the issue of who gets the right to modify what part of the database, and encrypted blockchain is supposedly a solution ?

pavlov 5y ago

> I work in the web3 (crypto) space > Maybe it is all a giant scam Normally you'd expect people who work on something supposedly worth billions to be able to say with a degree of confidence that it's not a giant scam.

leifg 5y ago

Leaving aside the discussions around PKI and necessary centralization in public/private key authentication I've seen this web3 debate a couple of times now. It starts with "web3 is the second (third?) coming of the internet and will revolutionize everything". If you ask for proof or use cases the very first comment is: "You can log into Twitter using a public/private key pair" These are two very different statements. So even if you assume there is advantage in public/private key auth it is still nowhere close to an internet revolution. Imagine the PostgreSQL team had praised the JSON data type as the revolution of the internet and disruption of all industries as we know it. It's a useful feature and it is used by a lot of companies but it has zero impact on everyday people. And Bloomberg and the Wall Street Journal are certainly not writing about it.

intrasight 5y ago

Reminded me of this Jaron Lanier quote from "Sway" podcast: "I believe Facebook is undervalued for what it does. Because Facebook is essentially running identity for the internet, which is a very valuable function. So under a data dignity regime, I think Facebook would double or triple in value very quickly." I do think that digital identity is going to be an existential(pun intended) question. Ideally it would be managed by a competent government agency. That's likely in many countries. I doubt that it'll be the case in the USA.

tptacek 5y ago

I love when web3 people say this, because it's revealing. There is really no application you can come up with that is less amenable to decentralized blockchain technology than identity. The hardest problem in identity isn't public key authentication (which we've had for 2 decades, and nobody wants) but account recovery. The absolute last thing any ordinary user wants is an identity that is cryptographically unrecoverable, or that functions like a bearer bond if compromised. Account recovery isn't a basket of features like multi-sig wallets and threshold schemes. It's the assumption, so far baked in that most users don't even realize they're making it, that if something goes wrong with an account there is a human-mediated process for restoring access. A centralized authority is intrinsic to the concept! It has to be there from the beginning! You can't ask users to opt into it, because they're users and they don't know how any of this stuff works. It's for this reason that Apple and Google control so much of Internet identity, and are going to continue doing so. Advocates of decentralized identity are poisoned by the experiences and preferences of a tiny but vocal sliver of users that (1) are deeply into this stuff and (2) do enough weird shit to occasionally get on Google or Apple's bad side and have bad/annoying experiences with account recovery. The problem is that these voices are not representative of the market, like, at all. Google does a better job of global Internet identity than any organization operating at any kind of scale. If you can't recognize why this might be true, and will be an enormous obstacle to adoption, you're not engaging seriously with identity. The power that decentralized identity offers, normal people don't want. The things it takes away: necessities. It's a toy, not a killer app.

annnoo 5y ago
I completely agree with you, but I a small thought about public key authentication. Today more and more people without a background in IT which got in the "Web3"/Crypto ecosystem get in touch with public key authentication mostly used with wallets like Metamask. It get's understandable and usable for the average user.
- tptacek 5y ago
  I don't see what that would get me that I wouldn't already have with Sign In With Apple, other than not being tied to Apple, which is one of the most important features of SIWA: if something goes wrong, there will be an ultra-annoying hard-landing customer service procedure that will, ultimately, restore access to my account.

zomglings 5y ago

Also building on web3. I agree about authorization (permissions) but not about identity/authentication. We do not need people to have to disclose their identities in order to use a service. We already have an authentication mechanism on every blockchain - the notion of an address/account. What we need is a decentralized way to associate permissions with those accounts. This is something that must happen more by social consensus - projects adopting a standard. The technology already exists.

can16358p 5y ago

Combine it with a decentralized/uncensorable web3 version of Twitter/Facebook and it also has the potential to become a killer app.

arlcode 5y ago
I don't think I agree that this is a killer app. Virtually no one wants the consequences of a fully unmoderated (aka uncensored) social network. Either there is are strong filter/segmentation capabilities (like "the algorithm" on current plattforms and different plattforms for different audiences) or anybody but the most radical / loud users leave sooner rather than later. Most users also have any of their content removed. So I don't see many advantages over the present state.

ForHackernews 5y ago

Email is already decentralized. I pay for Fastmail with my own domain because I don't want Microsoft or Google to own my primary online identity.

UncleMeat 5y ago

Signature-based authentication has existed for decades. All that has changed now is that your public key is now a "wallet." If blockchain based authentication becomes the norm, it will be entirely because there is now an unrelated reason for people to create, publish, and store an asymmetric key pair.

popcorncowboy 5y ago

> Nothing in the web2 tech stack currently allows this. Seriously? It takes five seconds online to find projects like https://solidproject.org https://solidproject.org (backed by people like Tim Berners-Lee) that don’t need blockchain and present strong arguments to address the kind of issues you raise. But it’s an open specification for the web. How lame and very NOT crypto $$$diamond_hands$$$. The most impressive thing about blockchain is its capacity to create zealots for the One True Way, all others be damned.

acdha 5y ago

> The idea that we use our email accounts, attached to huge corporations which siphon every detail about us for their advertising engines is absolutely absurd. I just want to be able to log in to applications and carry some of the simple data like my identity and what assets I have available with me, without having to pay for it by losing my privacy and autonomy. > > Nothing in the web2 tech stack currently allows this. Anyone who wants to can get their own email address which doesn't require giving data to advertisers. You can run your own domain or use an email service which isn't run as a loss-leader for advertisers, and you can use services like the one Apple built into iOS if you want to prevent the sites you visit from having a common identifier. The cryptocurrency services will need a variation of that same solution since using one wallet for everything is bad for privacy but the average person has limited interest or ability to reliably juggle many wallets. What's more interesting is to consider is why many people chose a single email provider when it started as a service which is at least as decentralized as any cryptocurrency. That includes the extremely important account recovery problems tptacek mentioned, spam, but also simply things like the different values most people have for security and operations. Cryptocurrencies are theoretically decentralized but in practice most of the people involved seem to use a handful of exchanges and ostensibly decentralized services often depend on one or two companies, and that tends to come down to the same answer: most people don't want to run servers or be one mistake away from losing everything, and would prefer that work be someone else's job. The other problem we have is how much people are willing to pay. Fastmail, iCloud, etc. are not expensive but a LOT of people have reliably voted with their feet and there seems to be only a small number of people who mind ads enough to pay for alternatives. I don't see web3 as SSO going anywhere until there's a lot more value to be shown from buying in — that upfront non-trivial payment requirement for something which just allows you to access other services you presumably would also have to pay for seems like a tough sell as a mainstream movement.