3 ms·
I think it's worth puzzling out why nobody actually has been doing signature based authentication for the last two decades though. I'm honestly not sure whether
by sanderjd 5y ago
I think it's worth puzzling out why nobody actually has been doing signature based authentication for the last two decades though. I'm honestly not sure whether that's a flattering exercise for web3 or the opposite.
- UncleMeat 5y agoI don't think it is puzzling. 1. Users understand passwords. While password stuffing is a concern, almost nobody actually makes product decisions based on rational security analysis. 2. Only a small number of users are concerned about centralized login via OpenID Connect. The privacy and account access weaknesses of logging in with Google or Facebook aren't concerns for the huge majority of users. 3. Creating and maintaining a key pair is less ergonomic than creating and maintaining a password. #3 is now different for people who are regularly using blockchain systems so it doesn't surprise me that uptake is larger than now than in the past. More people have a Coinbase account than use PGP. But I am not convinced that people actually care enough to swap if they aren't already ideologically aligned with blockchain technology.
- sanderjd 5y agoThis is all reasonable, but you're a lot more certain it's the full answer than I would be. For #1: New people come to technology all the time. They don't understand passwords yet, so if something is better than passwords it can make inroads. For #3: It's not clear to me why this is the case, besides just that it has always been the case. It's really un-ergonomic to create and maintain passwords. It just seems the alternatives have been even more so. (Interestingly, I don't think Coinbase actually gives you a keypair you can use to login to stuff...)