3 ms·

Identities on Microsoft, Amazon, and Google are not portable. They can permanently ban you and you lose access to every single service you used them to authenti

Identities on Microsoft, Amazon, and Google are not portable. They can permanently ban you and you lose access to every single service you used them to authenticate to. Private keys are portable between wallets.

endisneigh 5y ago
What you’re saying is also true with web3. A bad actor’s key could be banned and a list of bad actors could be shared among sites resulting in the same thing. In fact, if you believe in privacy at all you’d want to reject this idea for that alone.
- thebean11 5y ago
  Sure, multiple independent sites could individually ban you. That's a fundamentally different problem, and much much less likely. An antidote to that would be using a different key on each site you authenticate to. You still only need to store a single key, all other keys are derived from that yet cannot be associated with their sibling keys. > What you’re saying is also trust with web3. Not quite sure what you mean here, web3 is a pretty overloaded term. If you mean the very concept of web3..that's pretty fundamentally different from trusting a company that can unilaterally ban you, alter your data etc. There is no such parallel in web3. If you mean the JS library, that's also fundamentally different, and it's not the only game in town.
  - endisneigh 5y ago
    I’m not sure what your point is here - you could also create a new Google account per website or simply use an email address. The author advocates using third party services such as meta mask, who would need to be trusted. How do you implement it without any third party site. If we are talking about likelihood it’s unlike you’d be banned from Microsoft/Facebook/Google for no reason too. Furthermore as the administrator how you stop bad actors?
    - thebean11 5y ago
      You have to trust MetaMask to some extent, like any software you run locally, but MetaMask never gains control of your keys or identities, it's just a tool for using them (obviously 99.9% of users aren't auditing the code or building from source, but that's a totally different threat model). If MetaMask stops working for you, you can use a different tool with the same keys. If Google stops working for you you cannot transfer your account to Microsoft or Facebook. > If we are talking about likelihood it’s unlike you’d be banned from Microsoft/Facebook/Google for no reason too. I've seen posts on this forum about it. It happens and there's not much you can do if it does. > you could also create a new Google account per website or simply use an email address. > Furthermore as the administrator how you stop bad actors? Apologies if I'm missing something, if it's easy to spin up unique identities on both what's the difference here? It seems like it would be one or the other. And yes you can create a new Google account per website, but you are still at Google's mercy to authenticate. My 1Password has ~250 logins, I'd be seriously worried about a ban from Google if I made 250 accounts.
      - endisneigh 5y ago
        > Apologies if I'm missing something, if it's easy to spin up unique identities on both what's the difference here? It seems like it would be one or the other. Yes except for a centralized entity the admin would have recourse. How does a web server admin deal with it in the case of blockchain? > I've seen posts on this forum about it. It happens and there's not much you can do if it does. If we are talking about anecdotes I’ve seen people lose their private keys to phishing and consequently all of their money, so… > You have to trust MetaMask to some extent, like any software you run locally, but MetaMask never gains control of your keys or identities, it's just a tool for using them (obviously 99.9% of users aren't auditing the code or building from source, but that's a totally different threat model). If MetaMask stops working for you, you can use a different tool with the same keys. If Google stops working for you you cannot transfer your account to Microsoft or Facebook. This is not true, depending on implementation. Even if we accept what you’re saying as true you can run your own oauth server. Basically it seems the entirety of your argument rests upon trusting a centralized service. However the scenarios posited by the author are ones where blockchain is used to login to a centralized service to begin with so I don’t understand the criticism. Furthermore, unless one is to accept the infinite possibility and quantity of accounts, inevitably just like most other identity services, blacklists will be created. If that is not effective then blockchain will simply not be an option for most sites. Ultimately this convoluted web3 is no better than using an email address forwarder and a regular email and password.
  - rchaud 5y ago
    > Sure, multiple independent sites could individually ban you. That's a fundamentally different problem, and much much less likely. Wouldn't there be a common, shared list of malicious wallets that can be automatically blocked? Ublock Origin doesn't update its ad domains list itself, it relies on a number of lists that other people have created. I've never had to lift a finger ever since I installed UBO.
    - thebean11 5y ago
      There could be, but nobody is forced to follow it. If you use my website with Google SSO and Google deletes your account, you cannot sign into my site even if I do not want to follow the banlist.
threeseed 5y ago
Which is a problem 99.999999999% of people will never experience in their lifetime. And even if it is a problem you can always reach out to the website and get them involved in moving your account to a different provider.
kingcharles 5y ago
I lost access to my Google account because I was away too long, and therefore all the accounts it was tied to.

endisneigh 5y ago

What you’re saying is also true with web3. A bad actor’s key could be banned and a list of bad actors could be shared among sites resulting in the same thing. In fact, if you believe in privacy at all you’d want to reject this idea for that alone.

thebean11 5y ago
Sure, multiple independent sites could individually ban you. That's a fundamentally different problem, and much much less likely. An antidote to that would be using a different key on each site you authenticate to. You still only need to store a single key, all other keys are derived from that yet cannot be associated with their sibling keys. > What you’re saying is also trust with web3. Not quite sure what you mean here, web3 is a pretty overloaded term. If you mean the very concept of web3..that's pretty fundamentally different from trusting a company that can unilaterally ban you, alter your data etc. There is no such parallel in web3. If you mean the JS library, that's also fundamentally different, and it's not the only game in town.
- endisneigh 5y ago
  I’m not sure what your point is here - you could also create a new Google account per website or simply use an email address. The author advocates using third party services such as meta mask, who would need to be trusted. How do you implement it without any third party site. If we are talking about likelihood it’s unlike you’d be banned from Microsoft/Facebook/Google for no reason too. Furthermore as the administrator how you stop bad actors?
  - thebean11 5y ago
    You have to trust MetaMask to some extent, like any software you run locally, but MetaMask never gains control of your keys or identities, it's just a tool for using them (obviously 99.9% of users aren't auditing the code or building from source, but that's a totally different threat model). If MetaMask stops working for you, you can use a different tool with the same keys. If Google stops working for you you cannot transfer your account to Microsoft or Facebook. > If we are talking about likelihood it’s unlike you’d be banned from Microsoft/Facebook/Google for no reason too. I've seen posts on this forum about it. It happens and there's not much you can do if it does. > you could also create a new Google account per website or simply use an email address. > Furthermore as the administrator how you stop bad actors? Apologies if I'm missing something, if it's easy to spin up unique identities on both what's the difference here? It seems like it would be one or the other. And yes you can create a new Google account per website, but you are still at Google's mercy to authenticate. My 1Password has ~250 logins, I'd be seriously worried about a ban from Google if I made 250 accounts.
    - endisneigh 5y ago
      > Apologies if I'm missing something, if it's easy to spin up unique identities on both what's the difference here? It seems like it would be one or the other. Yes except for a centralized entity the admin would have recourse. How does a web server admin deal with it in the case of blockchain? > I've seen posts on this forum about it. It happens and there's not much you can do if it does. If we are talking about anecdotes I’ve seen people lose their private keys to phishing and consequently all of their money, so… > You have to trust MetaMask to some extent, like any software you run locally, but MetaMask never gains control of your keys or identities, it's just a tool for using them (obviously 99.9% of users aren't auditing the code or building from source, but that's a totally different threat model). If MetaMask stops working for you, you can use a different tool with the same keys. If Google stops working for you you cannot transfer your account to Microsoft or Facebook. This is not true, depending on implementation. Even if we accept what you’re saying as true you can run your own oauth server. Basically it seems the entirety of your argument rests upon trusting a centralized service. However the scenarios posited by the author are ones where blockchain is used to login to a centralized service to begin with so I don’t understand the criticism. Furthermore, unless one is to accept the infinite possibility and quantity of accounts, inevitably just like most other identity services, blacklists will be created. If that is not effective then blockchain will simply not be an option for most sites. Ultimately this convoluted web3 is no better than using an email address forwarder and a regular email and password.
- rchaud 5y ago
  > Sure, multiple independent sites could individually ban you. That's a fundamentally different problem, and much much less likely. Wouldn't there be a common, shared list of malicious wallets that can be automatically blocked? Ublock Origin doesn't update its ad domains list itself, it relies on a number of lists that other people have created. I've never had to lift a finger ever since I installed UBO.
  - thebean11 5y ago
    There could be, but nobody is forced to follow it. If you use my website with Google SSO and Google deletes your account, you cannot sign into my site even if I do not want to follow the banlist.

threeseed 5y ago

Which is a problem 99.999999999% of people will never experience in their lifetime. And even if it is a problem you can always reach out to the website and get them involved in moving your account to a different provider.

kingcharles 5y ago

I lost access to my Google account because I was away too long, and therefore all the accounts it was tied to.