4 ms·

> We need some way of saying “who we are” on the internet in a consistent manner. That way we can communicate with others in a verified way and associate with d

> We need some way of saying “who we are” on the internet in a consistent manner. That way we can communicate with others in a verified way and associate with digital data that we own. We also often need that data to be interoperable between different web properties. Do we really need this? Do we really want to permanently tie identity across websites like this? I find this initial "need"/justification/requirement questionable. I have a login on HN that is totally unique to e.g. Twitter and Instagram and <shudder> LinkedIn. Same with work vs personal. This is deliberate. I do not want to have the same identity here as I do elsewhere. There are many hopefully obvious reasons for this - mostly privacy (both in terms of immediate "in the moment" privacy, but also temporal privacy in the sense that I might not want some potentially ill-advised comments I made on some website 15 years ago to come back and bite me), but also it offers protections against "cancel culture" and general cyber-stalking and doxxing etc as that would become a whole lot easier if you can just run some query on a blockchain and find every single website I've ever used and dredge up my comments/content/etc. Being able to do that sounds very dystopian to me - why don't we just tattoo a barcode on our necks and be done with it?

pkulak 5y ago
Private keys are cheap to make. There's no reason you couldn't have a different one for every site. Of course, then it's on you to keep track of them, but it's already on you to keep track of the credentials you're using now. At least this way, the default of "use the same creds everywhere" is secure, if not more private.
- thebean11 5y ago
  This is already solved by existing crypto wallet tooling too, you can create an infinite number of keys all derived from a single root key (usually a 12-20 word phrase in modern wallets). A service with access to a single child public or even private key can't tie them to the sibling keys.
DeepYogurt 5y ago
I agree that we don't need unique identities across everything, but even if that is a real problem it is also solved by public key cryptography without a requirement of a blockchain.
- djohnston 5y ago
  Sure but the blockchain env like Ethereum gives you that for free along with a few slick chrome extensions like Metamask and a JS library (web3.js) that make all of this super easy to build on. You don't need to make any transactions or whatever, but you're inheriting all these tools for free.
  - tchock23 5y ago
    The reviews on the metamask chrome extension are pretty scary. And it has access to view all data on all sites you visit. Is there a better way?
betwixthewires 5y ago
So the thing about this is that there is no need to permanently tie identity across all sites and services you used (and provide), rather, the ability to do so when and where you need to do it. There's nothing requiring a user to use the same identity across every service they interact with, but the option should be there. I wouldn't want my matrix username(s) and my fediverse account(s) tied to my HN username(s), but I might want a github/gitlab/codeberg account tied to a social/messaging account while having different "personas" for different applications. Overall it's a useful tool to have in your belt, so long as it doesn't limit you in other ways.
- mattlondon 5y ago
  So if you are not going to go whole-hog and have one true identity for everything, why bother using anything apart from an email address? The argument seems to be that consistency allows you to prove ownership and re-use all of your content etc across the web by tying everything back to one verified identity. If you are having different identities on different sites then that benefit disappears, and I fail to see how it is then any better than using email addresses? You end up with different wallet IDs each with their own island of content, just like you have with email addresses. Sure you could chose to "move" content with one of your many identities by just logging in with the ID (presumably losing all of your existing content), but we have copy-paste for that already (and I am only half-joking saying that...)
  - wan23 5y ago
    Email addresses aren't really good for this. It's really easy to sign up for a service with someone else's email address, for example. Sure, if that person ever finds out they can potentially claim ownership of the account through a password reset, but it doesn't erase the fact that you have been using their "identity" for some time.
    - mattlondon 5y ago
      Is this still a thing though? Pretty much everything I've used in the past 10-15 years has required email validation before allowing you to do anything meaningful. Either way though, I don't see how an account claiming to be "wan23" would be any more trustworthy to me as created off of the back of an email account or off of a wallet ID - I still have no idea (nor do I care) who you are.
lamontcg 5y ago
Yeah I think it is mostly businesses that think this is a huge problem to solve to have identities matched across everything seamlessly. Mostly what I care about is logins and payments which are addressed by password managers and form filling for credit cards. I just want a friction free experience for setting up an account, logging back into it, and maybe purchasing something. And ideally I'd like to self-host, maybe with a service that looked like a NAS appliance hanging off a guest network on my router with a forwarded port through the firewall and some method for tracking my IP address (dyndns or similarish). And ideally payments happen by a handshake between the service I run, the processor and the merchant in a way that my actual credit card details are never used. And for recurring payments I have the ability to just switch them off. Bringing all the control back to me and not leaking out reusable PII everywhere. Of course corporations would aggressively hate that since it would destroy their business models of recurring payments for services the user is no longer using and the requirement of calling up the business and having to convince some phone operator that you really want to cancel.
- GekkePrutser 5y ago
  This sounds ideal. Especially the self hosted part.
- mattlondon 5y ago
  > Yeah I think it is mostly businesses that think this is a huge problem to solve to have identities matched across everything seamlessly. Your comment just gave me a thought - just imagine the online advertisers using this for tracking purposes! At the risk of spreading FUD, it would not surprise me to learn that perhaps this web3 thing is being fuelled/funded by the existing crop of online advertising networks or their close associates? (or at the very least they are watching this situation develop with an incredibly close level of detail) Who needs cookies if you have a 100% reliable & long-lived (potentially immortal?) ID that the user takes with them everywhere they go online (and is the same on every site they visit) and for every purchase they make (using that wallet) online and offline? This would be advertising networks' absolute dream situation if it becomes widespread - users voluntarily creating their own unique tracking fingerprint and using it on all the sites they visit, as well as helpfully logging all of their purchases they make with that ID on a public ledger that anyone can mine the data from. It really does not get much better for the online advertising industry than that. If you want a cynical take on web3 and are looking for your next billion dollar startup idea, then web3 ad tracking & targeting might be your best bet :)
rizkeyz 5y ago
Exactly, we do not need it. If it weren't for job negotiations I'd be making all my contributions on the net masked.

pkulak 5y ago

Private keys are cheap to make. There's no reason you couldn't have a different one for every site. Of course, then it's on you to keep track of them, but it's already on you to keep track of the credentials you're using now. At least this way, the default of "use the same creds everywhere" is secure, if not more private.

thebean11 5y ago
This is already solved by existing crypto wallet tooling too, you can create an infinite number of keys all derived from a single root key (usually a 12-20 word phrase in modern wallets). A service with access to a single child public or even private key can't tie them to the sibling keys.

DeepYogurt 5y ago

I agree that we don't need unique identities across everything, but even if that is a real problem it is also solved by public key cryptography without a requirement of a blockchain.

djohnston 5y ago
Sure but the blockchain env like Ethereum gives you that for free along with a few slick chrome extensions like Metamask and a JS library (web3.js) that make all of this super easy to build on. You don't need to make any transactions or whatever, but you're inheriting all these tools for free.
- tchock23 5y ago
  The reviews on the metamask chrome extension are pretty scary. And it has access to view all data on all sites you visit. Is there a better way?

betwixthewires 5y ago

So the thing about this is that there is no need to permanently tie identity across all sites and services you used (and provide), rather, the ability to do so when and where you need to do it. There's nothing requiring a user to use the same identity across every service they interact with, but the option should be there. I wouldn't want my matrix username(s) and my fediverse account(s) tied to my HN username(s), but I might want a github/gitlab/codeberg account tied to a social/messaging account while having different "personas" for different applications. Overall it's a useful tool to have in your belt, so long as it doesn't limit you in other ways.

mattlondon 5y ago
So if you are not going to go whole-hog and have one true identity for everything, why bother using anything apart from an email address? The argument seems to be that consistency allows you to prove ownership and re-use all of your content etc across the web by tying everything back to one verified identity. If you are having different identities on different sites then that benefit disappears, and I fail to see how it is then any better than using email addresses? You end up with different wallet IDs each with their own island of content, just like you have with email addresses. Sure you could chose to "move" content with one of your many identities by just logging in with the ID (presumably losing all of your existing content), but we have copy-paste for that already (and I am only half-joking saying that...)
- wan23 5y ago
  Email addresses aren't really good for this. It's really easy to sign up for a service with someone else's email address, for example. Sure, if that person ever finds out they can potentially claim ownership of the account through a password reset, but it doesn't erase the fact that you have been using their "identity" for some time.
  - mattlondon 5y ago
    Is this still a thing though? Pretty much everything I've used in the past 10-15 years has required email validation before allowing you to do anything meaningful. Either way though, I don't see how an account claiming to be "wan23" would be any more trustworthy to me as created off of the back of an email account or off of a wallet ID - I still have no idea (nor do I care) who you are.

lamontcg 5y ago

Yeah I think it is mostly businesses that think this is a huge problem to solve to have identities matched across everything seamlessly. Mostly what I care about is logins and payments which are addressed by password managers and form filling for credit cards. I just want a friction free experience for setting up an account, logging back into it, and maybe purchasing something. And ideally I'd like to self-host, maybe with a service that looked like a NAS appliance hanging off a guest network on my router with a forwarded port through the firewall and some method for tracking my IP address (dyndns or similarish). And ideally payments happen by a handshake between the service I run, the processor and the merchant in a way that my actual credit card details are never used. And for recurring payments I have the ability to just switch them off. Bringing all the control back to me and not leaking out reusable PII everywhere. Of course corporations would aggressively hate that since it would destroy their business models of recurring payments for services the user is no longer using and the requirement of calling up the business and having to convince some phone operator that you really want to cancel.

GekkePrutser 5y ago
This sounds ideal. Especially the self hosted part.
mattlondon 5y ago
> Yeah I think it is mostly businesses that think this is a huge problem to solve to have identities matched across everything seamlessly. Your comment just gave me a thought - just imagine the online advertisers using this for tracking purposes! At the risk of spreading FUD, it would not surprise me to learn that perhaps this web3 thing is being fuelled/funded by the existing crop of online advertising networks or their close associates? (or at the very least they are watching this situation develop with an incredibly close level of detail) Who needs cookies if you have a 100% reliable & long-lived (potentially immortal?) ID that the user takes with them everywhere they go online (and is the same on every site they visit) and for every purchase they make (using that wallet) online and offline? This would be advertising networks' absolute dream situation if it becomes widespread - users voluntarily creating their own unique tracking fingerprint and using it on all the sites they visit, as well as helpfully logging all of their purchases they make with that ID on a public ledger that anyone can mine the data from. It really does not get much better for the online advertising industry than that. If you want a cynical take on web3 and are looking for your next billion dollar startup idea, then web3 ad tracking & targeting might be your best bet :)

rizkeyz 5y ago

Exactly, we do not need it. If it weren't for job negotiations I'd be making all my contributions on the net masked.