25 ms·

The two-sided market is the big deal here. Imagine that you are a bank or online market place. What are you going to do when one of your top customers shows up

The two-sided market is the big deal here. Imagine that you are a bank or online market place. What are you going to do when one of your top customers shows up and says that they lost their account keys? Are you going to explain that losing your account is actually a great feature that your company offers.

pjc50 5y ago
To be fair, this is the level of customer service that you get from Google in the first place. Banks are forced to do better.
- ramijames 5y ago
  Banks, at least in my country, can choose to accept incoming or outgoing financial transactions. Worse, governments have the rights to seize your assets, close your bank accounts, etc. Not sure any of that is better. I'd rather have Google shut my account down with no recourse. It's all shitty and it's all infuriating.
- ineedasername 5y ago
  >Google I don't think that helps the Web3 argument. Google has made a choice, whereas crypto it is a technical limitation (or, to some, a feature). It also isn't a very good talking point to say "it's no worse than Google" Crypto needs to develop a better balance between bad 2FA with loop holes on the traditional side and absolute loss on the crypto side before a lot of people would feel comfortable with it. Maybe that should be one of its target killer apps.
  - thebean11 5y ago
    It’s not a technical limitation any more than it is for Google. You can easily create software where a chosen third party (or some 2/3 parties scheme) can recover your account.
    - ineedasername 5y ago
      That's good to know. It is a hindrance to Web3 adoption that such mechanisms aren't in place: It would certainly prevent me from relying on a service. But what would a 3rd party or 2/3 party consensus use that would differ from current mechanisms? There would also need to be some care taken to make sure that such 3rd parties don't become centralized choke points themselves: They would be somewhat essential, so any service(s) that did this could rise to dominance either as a monopoly or a cartel.
      - thebean11 5y ago
        These mechanisms definitely aren't something built into the chain any more than they are built into HTTP or x86, but these chains are semi turing-complete so the software can be written (existing multi-sig ETH wallets are an example). Let's say I control some funds and want you to have access to recover the funds if I lose my master key. I transfer these funds to a smart contract that allows my Ethereum key full control to move things around, and allows your Ethereum key access to give control to a new key if I lose mine (probably with a x-day delay, so I have time to revoke your access if you go rogue!). For a 2/3 system, it's basically the same except 2 out of 3 of the other people need to "vote" on chain, and only then can my key be reset. There wouldn't need to be a centralized party who resets the keys. Social solutions where you give trusted friend(s) limited reset access, probably with a time lock like I mentioned, are extremely promising IMO.
        ineedasername 5y ago
        Thanks for the further explanation-- I fully understand that such things aren't baked into the current infrastructure-- which also creates problems (for example a cell service provider resetting a password over SMS through their own supposedly 2FA system). L The smart contract you describe is sort of what I meant by service providers emerging for this sort of thing: The average user will not feel comfortable rolling their own such contract. It either needs to be dead easy, or there will emerge services that do this for you and oversee their execution. I could be wrong about that... Much of what Web3 will look like is speculation. But if those sorts of services emerge and become market dominators, they would have a lot of control-- contracts that allow termination (deplatforming). As contracts become more complex to avoid edge cases we see being exploited right now, it may become even harder to understand all implications, loopholes, exploits, etc. The above may be a solvable problem: Develop tools to parse smart contracts. A specialized class of automated testing tools for smart contracts.
tzs 5y ago
In the case of my bank, I'd expect to walk into my local branch with my driver's license, passport, birth certificate, and any other official ID I have, and convince them that I am the same tzs who owns the account and have them set me up with new account keys. What I wish is that there was some way to tie my other accounts, directly or indirectly, to my bank. My bank account is the most recoverable account I have, because they can handle me showing up in person with ID. Other accounts just know me by my knowing the account password and/or being able to receive emails at the email address associated with the account. If either of those is compromised I can lose the account with no way to recover. If there were some way I could have my bank verify my identity to my email provider, and tell my email provider that if account recovery is ever needed on my email account to re-verify with my bank that it is really me requesting the account recovery it would be much safer. (If you are using an email address at a domain you own, then replace email provider with domain registrar). Then no matter how badly I'm compromised (as long as it is not by someone with sufficient resources and interest to be able to get past an in-person identity check at my bank), I've always got a path to recovery. Worst case, first recover the bank account in person. Then recover the email account using the bank account. Then recover compromised accounts that are using the email account for verification.
- abeppu 5y ago
  The bank still has a dependence on trusted authorities when it assumes your ID documents are legit. Rather than asking banks to confirm your identity for other accounts, I think we should ask governments to extend their practice of providing physical ID documents to providing online identification services. States have worked with Apple on "digital drivers licenses" that live on your phone, but the idea is still that you show them to someone in meatspace. Why shouldn't they provide an online service? Of course, all this depends on the assumption that your ID should be who you are IRL, rather than the model where we can all make up several independent pseudonyms for different purposes.
  - throwaway473825 5y ago
    Many European countries have government-provided online identification services. Estonia's implementation is usually regarded as one of the best: https://github.com/open-eid https://github.com/open-eid

pjc50 5y ago

To be fair, this is the level of customer service that you get from Google in the first place. Banks are forced to do better.

ramijames 5y ago
Banks, at least in my country, can choose to accept incoming or outgoing financial transactions. Worse, governments have the rights to seize your assets, close your bank accounts, etc. Not sure any of that is better. I'd rather have Google shut my account down with no recourse. It's all shitty and it's all infuriating.
ineedasername 5y ago
>Google I don't think that helps the Web3 argument. Google has made a choice, whereas crypto it is a technical limitation (or, to some, a feature). It also isn't a very good talking point to say "it's no worse than Google" Crypto needs to develop a better balance between bad 2FA with loop holes on the traditional side and absolute loss on the crypto side before a lot of people would feel comfortable with it. Maybe that should be one of its target killer apps.
- thebean11 5y ago
  It’s not a technical limitation any more than it is for Google. You can easily create software where a chosen third party (or some 2/3 parties scheme) can recover your account.
  - ineedasername 5y ago
    That's good to know. It is a hindrance to Web3 adoption that such mechanisms aren't in place: It would certainly prevent me from relying on a service. But what would a 3rd party or 2/3 party consensus use that would differ from current mechanisms? There would also need to be some care taken to make sure that such 3rd parties don't become centralized choke points themselves: They would be somewhat essential, so any service(s) that did this could rise to dominance either as a monopoly or a cartel.
    - thebean11 5y ago
      These mechanisms definitely aren't something built into the chain any more than they are built into HTTP or x86, but these chains are semi turing-complete so the software can be written (existing multi-sig ETH wallets are an example). Let's say I control some funds and want you to have access to recover the funds if I lose my master key. I transfer these funds to a smart contract that allows my Ethereum key full control to move things around, and allows your Ethereum key access to give control to a new key if I lose mine (probably with a x-day delay, so I have time to revoke your access if you go rogue!). For a 2/3 system, it's basically the same except 2 out of 3 of the other people need to "vote" on chain, and only then can my key be reset. There wouldn't need to be a centralized party who resets the keys. Social solutions where you give trusted friend(s) limited reset access, probably with a time lock like I mentioned, are extremely promising IMO.
      - ineedasername 5y ago
        Thanks for the further explanation-- I fully understand that such things aren't baked into the current infrastructure-- which also creates problems (for example a cell service provider resetting a password over SMS through their own supposedly 2FA system). L The smart contract you describe is sort of what I meant by service providers emerging for this sort of thing: The average user will not feel comfortable rolling their own such contract. It either needs to be dead easy, or there will emerge services that do this for you and oversee their execution. I could be wrong about that... Much of what Web3 will look like is speculation. But if those sorts of services emerge and become market dominators, they would have a lot of control-- contracts that allow termination (deplatforming). As contracts become more complex to avoid edge cases we see being exploited right now, it may become even harder to understand all implications, loopholes, exploits, etc. The above may be a solvable problem: Develop tools to parse smart contracts. A specialized class of automated testing tools for smart contracts.

tzs 5y ago

In the case of my bank, I'd expect to walk into my local branch with my driver's license, passport, birth certificate, and any other official ID I have, and convince them that I am the same tzs who owns the account and have them set me up with new account keys. What I wish is that there was some way to tie my other accounts, directly or indirectly, to my bank. My bank account is the most recoverable account I have, because they can handle me showing up in person with ID. Other accounts just know me by my knowing the account password and/or being able to receive emails at the email address associated with the account. If either of those is compromised I can lose the account with no way to recover. If there were some way I could have my bank verify my identity to my email provider, and tell my email provider that if account recovery is ever needed on my email account to re-verify with my bank that it is really me requesting the account recovery it would be much safer. (If you are using an email address at a domain you own, then replace email provider with domain registrar). Then no matter how badly I'm compromised (as long as it is not by someone with sufficient resources and interest to be able to get past an in-person identity check at my bank), I've always got a path to recovery. Worst case, first recover the bank account in person. Then recover the email account using the bank account. Then recover compromised accounts that are using the email account for verification.

abeppu 5y ago
The bank still has a dependence on trusted authorities when it assumes your ID documents are legit. Rather than asking banks to confirm your identity for other accounts, I think we should ask governments to extend their practice of providing physical ID documents to providing online identification services. States have worked with Apple on "digital drivers licenses" that live on your phone, but the idea is still that you show them to someone in meatspace. Why shouldn't they provide an online service? Of course, all this depends on the assumption that your ID should be who you are IRL, rather than the model where we can all make up several independent pseudonyms for different purposes.
- throwaway473825 5y ago
  Many European countries have government-provided online identification services. Estonia's implementation is usually regarded as one of the best: https://github.com/open-eid https://github.com/open-eid