4 ms·

>In web3, your wallet ID (used for purchases and proposed for logins too) is an undeletable cookie that tracks you both online and off, and one that anyone can

by Tenoke 5y ago

>In web3, your wallet ID (used for purchases and proposed for logins too) is an undeletable cookie that tracks you both online and off, and one that anyone can retrieve. Purchases sure on most chains (though not on e.g. Secret) but the chain isn't recording your logins via your address in most cases. You are just showing to the site that you have the key without making any transactions. So no, advertisers won't have much extra data on your site visiting habits that they don't have now.

oblio 5y ago
The thing is, can't they "triangulate" who you are by your transactions? In the same way tracking your location for sure can determine who you are. https://www.nytimes.com/interactive/2018/12/10/business/location-data-privacy-apps.html https://www.nytimes.com/interactive/2018/12/10/business/loca... Based on just a few transactions they can figure out that you're a middle aged guy, living in Nowhereville, Iowa, that's into samba, anime and drives a Toyota Corolla, etc. and then from that it's not hard to actually figure out who that person is.
- Tenoke 5y ago
  I don't see a particular reason to conduct every transaction on-chain, or at least on a public L1. At any rate, I was mostly replying about your login data being public which isn't true.
  - oblio 5y ago
    Then how will we conduct our transactions? Right now I use my country's currency, do you want me to go to a mix of currencies like I'm playing some sort of Android free to play game? That's just adding complexity to my life for no obvious reason.
    - nefitty 5y ago
      Crypto is sort of like the increasing plethora of streaming services, except crypto projects seem to reproduce at a much higher rate and further deprioritize UX. It's not every day, if ever, that I'm dealing with fiat currency conversion. In crypto, it's another one of those seemingly unnecessary hassles that is tolerated as a matter of course.
    - Tenoke 5y ago
      I use both PayPal and my bank for different transaction with no issues. I won't care to use some crypto app if that's popular, too. At any rate, I'm not personally advocating for crypto here, and the projects in crypto which I'm following are less about pure payments (which I don't mind doing via debit card or equivalent, whether built via banks or on top of crypto) and more about more complex smart contracts (e.g. the dex approach vs traditional exchanges and its assosiated different profit incentives, mechanisms and safety profile).
      - shock-value 5y ago
        PayPal and your bank both transact in dollars. In the crypto space, presumably, you’d need to operate with different currencies at varying exchange rates. Or use some kind of “wrapped” currency at significant complexity and risk (see recent Ethereum-Solana bridge exploit and associated massive loss).
        Tenoke 5y ago
        End users didn't suffer a loss after that exploit and I expect my risk from holding usdc and it crashing without Coinbase paying to fix things is already lower than the risk of my PayPal account being closed which I've seen happen to people.
        rmbyrro 5y ago
        I think no one really knows whether DeFi can be really safer than OldFi. Since it's old, we sort of know what to expect. In DeFi we obviously are still discovering. I dislike OldFi and want to contribute to a new, healthier system to serve people in general. But, short term, risk of DeFi is obviously higher due to its imaturity. OldFi has been maturing for 100's of years. Perhaps we could argue 1000's. It'll take at least 20-50 more years to reach a similar maturity in DeFi. By maturity I mean: people understand the risks and know what to expect.
UncleMeat 5y ago
Registration via NFTs is already a thing. You join the yacht club by buying an ape. In this manner, everybody can know who is a member of the club. If you are just doing login by registering your public key with a service.... then you are just doing signature-based-authentication that you could have done two decades ago.
- mattlondon 5y ago
  Except that login is now tied to your transaction history.
- sanderjd 5y ago
  I think it's worth puzzling out why nobody actually has been doing signature based authentication for the last two decades though. I'm honestly not sure whether that's a flattering exercise for web3 or the opposite.
  - UncleMeat 5y ago
    I don't think it is puzzling. 1. Users understand passwords. While password stuffing is a concern, almost nobody actually makes product decisions based on rational security analysis. 2. Only a small number of users are concerned about centralized login via OpenID Connect. The privacy and account access weaknesses of logging in with Google or Facebook aren't concerns for the huge majority of users. 3. Creating and maintaining a key pair is less ergonomic than creating and maintaining a password. #3 is now different for people who are regularly using blockchain systems so it doesn't surprise me that uptake is larger than now than in the past. More people have a Coinbase account than use PGP. But I am not convinced that people actually care enough to swap if they aren't already ideologically aligned with blockchain technology.
    - sanderjd 5y ago
      This is all reasonable, but you're a lot more certain it's the full answer than I would be. For #1: New people come to technology all the time. They don't understand passwords yet, so if something is better than passwords it can make inroads. For #3: It's not clear to me why this is the case, besides just that it has always been the case. It's really un-ergonomic to create and maintain passwords. It just seems the alternatives have been even more so. (Interestingly, I don't think Coinbase actually gives you a keypair you can use to login to stuff...)

by Tenoke 5y ago

oblio 5y ago

The thing is, can't they "triangulate" who you are by your transactions? In the same way tracking your location for sure can determine who you are. https://www.nytimes.com/interactive/2018/12/10/business/location-data-privacy-apps.html https://www.nytimes.com/interactive/2018/12/10/business/loca... Based on just a few transactions they can figure out that you're a middle aged guy, living in Nowhereville, Iowa, that's into samba, anime and drives a Toyota Corolla, etc. and then from that it's not hard to actually figure out who that person is.

Tenoke 5y ago
I don't see a particular reason to conduct every transaction on-chain, or at least on a public L1. At any rate, I was mostly replying about your login data being public which isn't true.
- oblio 5y ago
  Then how will we conduct our transactions? Right now I use my country's currency, do you want me to go to a mix of currencies like I'm playing some sort of Android free to play game? That's just adding complexity to my life for no obvious reason.
  - nefitty 5y ago
    Crypto is sort of like the increasing plethora of streaming services, except crypto projects seem to reproduce at a much higher rate and further deprioritize UX. It's not every day, if ever, that I'm dealing with fiat currency conversion. In crypto, it's another one of those seemingly unnecessary hassles that is tolerated as a matter of course.
  - Tenoke 5y ago
    I use both PayPal and my bank for different transaction with no issues. I won't care to use some crypto app if that's popular, too. At any rate, I'm not personally advocating for crypto here, and the projects in crypto which I'm following are less about pure payments (which I don't mind doing via debit card or equivalent, whether built via banks or on top of crypto) and more about more complex smart contracts (e.g. the dex approach vs traditional exchanges and its assosiated different profit incentives, mechanisms and safety profile).
    - shock-value 5y ago
      PayPal and your bank both transact in dollars. In the crypto space, presumably, you’d need to operate with different currencies at varying exchange rates. Or use some kind of “wrapped” currency at significant complexity and risk (see recent Ethereum-Solana bridge exploit and associated massive loss).
      - Tenoke 5y ago
        End users didn't suffer a loss after that exploit and I expect my risk from holding usdc and it crashing without Coinbase paying to fix things is already lower than the risk of my PayPal account being closed which I've seen happen to people.
        rmbyrro 5y ago
        I think no one really knows whether DeFi can be really safer than OldFi. Since it's old, we sort of know what to expect. In DeFi we obviously are still discovering. I dislike OldFi and want to contribute to a new, healthier system to serve people in general. But, short term, risk of DeFi is obviously higher due to its imaturity. OldFi has been maturing for 100's of years. Perhaps we could argue 1000's. It'll take at least 20-50 more years to reach a similar maturity in DeFi. By maturity I mean: people understand the risks and know what to expect.

UncleMeat 5y ago

Registration via NFTs is already a thing. You join the yacht club by buying an ape. In this manner, everybody can know who is a member of the club. If you are just doing login by registering your public key with a service.... then you are just doing signature-based-authentication that you could have done two decades ago.

mattlondon 5y ago
Except that login is now tied to your transaction history.
sanderjd 5y ago
I think it's worth puzzling out why nobody actually has been doing signature based authentication for the last two decades though. I'm honestly not sure whether that's a flattering exercise for web3 or the opposite.
- UncleMeat 5y ago
  I don't think it is puzzling. 1. Users understand passwords. While password stuffing is a concern, almost nobody actually makes product decisions based on rational security analysis. 2. Only a small number of users are concerned about centralized login via OpenID Connect. The privacy and account access weaknesses of logging in with Google or Facebook aren't concerns for the huge majority of users. 3. Creating and maintaining a key pair is less ergonomic than creating and maintaining a password. #3 is now different for people who are regularly using blockchain systems so it doesn't surprise me that uptake is larger than now than in the past. More people have a Coinbase account than use PGP. But I am not convinced that people actually care enough to swap if they aren't already ideologically aligned with blockchain technology.
  - sanderjd 5y ago
    This is all reasonable, but you're a lot more certain it's the full answer than I would be. For #1: New people come to technology all the time. They don't understand passwords yet, so if something is better than passwords it can make inroads. For #3: It's not clear to me why this is the case, besides just that it has always been the case. It's really un-ergonomic to create and maintain passwords. It just seems the alternatives have been even more so. (Interestingly, I don't think Coinbase actually gives you a keypair you can use to login to stuff...)