6 ms·

>Well then, you might ask, why are we running around logging in with email+password, or god forbid, Login with Facebook? Why aren't we logging into everywhere w

>Well then, you might ask, why are we running around logging in with email+password, or god forbid, Login with Facebook? Why aren't we logging into everywhere with public keys, if the technology is so old? I'm a web3 enthusiast, and this is what cemented it for me as a proper successor to whatever we have now. Everyone agrees the legacy web auth is broken. Do you use the same password everywhere? That's low security, you must have a different password, preferably randomly generated, for each and every website, each having an arbitrary set of rules. It's a massive pain in the ass and leads to clicking a lot of "Forgot your password?", and pray to god the site you're using actually properly handles your password, or doesn't accidentally (or intentionally) log or leak your password. Yes, it's happened before, many many times. Logging in via wallet, on the other hand? Connect your wallet, choose your account, and you're in. It's stupid simple to integrate on the backend too, and incredibly secure as long as you don't leak your 12 words (but even then, you can use a ledger if you want to be safe). It also works as an unified account across different websites. It's amazing. Public key cryptography for the masses.

oh_sigh 5y ago
Isn't this what OAuth solves?
tshaddox 5y ago
You don't need any of the blockchain stuff to support logging in to websites with a public key. That's straightforward with any old public-key cryptography scheme like PGP. In fact, from what I can tell, most of the "web3 login" implementations are doing little more triggering your wallet extension (e.g. MetaMask) to sign a unique message with your private key to prove you control an Ethereum address. It works well, and I rather like it, but the login part itself could just as easily be an old-fashioned PGP key pair.
- vmception 5y ago
  correct, PGP had 30 years to get broad user-facing adoption and failed outside of a few paranoid folks on email and setting up git or ssh on a new machine once. blockchains and their addressing namespace have very quickly propelled standardized interfaces for signing key pairs for people that don't even think about it.
  - tshaddox 5y ago
    Neither has anything remotely mistakable for broad user-facing adoption.
    - vmception 5y ago
      sure, to clarify, I would say if we had a way to count frequency of key pair signing before wallets, and after wallets, you would see a major adoption curve having occurred and continuing. I think that's a good thing because I think key signing is a good thing that needed better adoption and use cases. its ridiculous to think 'hm my users need a browser extension to use my application' but now since millions already do this, its great. thank you, profit motive.
    - swalsh 5y ago
      Metamask has pretty broad adoption. Not quite "my mom" level yet. But it's gone far beyond techies on a fairly large scale, which PGP never really did.
  - kkfx 5y ago
    People do not know GNUPG/PGP simply because they are IT-illiterate and those who can teach them, on scale, do profit of such ignorance. Sorry for being rude, but that's is. The chain of trust concept is the simplest and most powerful concept of trust we have in the real world, it fail because most people still have issue understanding the difference between local and remote and understanding why privacy is a value. Blockchain is "popular" just because it's sold as a tool to make money and people who do not know think "let's try it". Nothing more. It's pushed because IT giants (who are probably those who really invented the concept) feel to be giant enough to kick banking out and replace them in a classic EEE move [1] while locking users even more because we need banks mostly for comfort and by law, but we can use cash "by nature" while we can't use cryptos without computers (full of crapware, down to the hw, produced by very few giants at least for their core components) and connections (again owned by few giants). They are sold as free, and they are in theory, in practice they are very hard prisons, worst than those who they say they want to replace. About web3: just try ZeroNet, is a kind of PopcornTime clone, instead of movies it share text, websites. Under the wood just the classic BitTorrent. Fast enough to be used, but certainly not usable by all on scale. The real decentralization we need is web 1.0 with today an IPv6 global for any device and PUBLIC registars who offer domains for free to Citizens JUST mediating eventual overhands, no third party resale allowed... It's not done like we do not push Usenet again just because those who know do want a surveilled and locked IT, not a really free one. [1] and bankers known that well: https://voxeu.org/content/banking-disrupted-financial-intermediation-era-transformational-technology https://voxeu.org/content/banking-disrupted-financial-interm... and also it's more recent evolution https://voxeu.org/article/digitalisation-and-future-banking https://voxeu.org/article/digitalisation-and-future-banking
- deleted 5y ago
  [deleted]
- birracerveza 5y ago
  >You don't need any of the blockchain stuff to support logging in to websites with a public key. Well yes, I wasn't refuting the author's "You don't need a f%ing blockchain", but simply stating that IMO Web3 is already miles better than legacy web, even just for its main authentication system. >That's straightforward with any old public-key cryptography scheme like PGP ... but the login part itself could just as easily be an old-fashioned PGP key pair. This reminds me of HN's famous Dropbox comment.[1] Yeah, wallets are "just" public key cryptography, but it's easy enough for anyone to use and for developers to integrate. PGP is extremely convoluted in comparison, and to this day I have no idea how to sign a message with it without having to open up a guide. With metamask it's just two clicks. [1] https://news.ycombinator.com/item?id=8863 https://news.ycombinator.com/item?id=8863
  - smaudet 5y ago
    That's because GPGP and PGP both are arcane, bad programs. They are standards written in a time when it was somewhat normal to carry pocket protectors. Sendthing is a reasonable, user friendly alternative to Dropbox. There will be a Sendthing for pgp one day...
- swalsh 5y ago
  This feels like the guy who said dropbox was useless because he has the ability to use rsync. Yeah the technology under Metamask is old, yeah it doesn't have to be connected to a blockchain (but it's damn convienent that it can). But it does it in a really user friendly way that has not caught on at the same level of mass adoption as Metamask has. The great part of Metamask, is there's almost nothing proprietary about it. You could rip all the blockchain stuff out of it, and it would still work. If I wanted the blockchain stuff later, as long as it follows the standard.... I still could. Brave has it already integrated!
  - tshaddox 5y ago
    My argument is not "blockchains are useless because public-key cryptography long predates blockchains." My argument is "the existence of public-key cryptography does not imply that blockchains are useful."
    - swalsh 5y ago
      I did not accuse you of saying "blockchains are useless because public-key cryptography long predates blockchains". I accused you of saying old fashioned PGP was user-friendly. It's not. It never caught on beyond tech users because it's too complicated for non-techies. My point was that Metamask has demonstrated the best UX yet to use public-key cryptography for everyday users.
lanstin 5y ago
Isn't clicking on "connect your wallet" the thing that all the people that have lost their NFTs or coins to a scam URL have done that they shouldn't have done?
- vmception 5y ago
  thats because they signed a transaction, obvious distinction as it is preparing to send money to authorize the scam. signing a keypair does not send money and doesn't use the blockchain, only the addressing namespace. of course with the state of education on this topic being such wide and widening gulf, people are going to get taken advantage of with obvious distinctions that are not so obvious to them.
  - tshaddox 5y ago
    I'm no expert, but aren't most of these scams the result of the user choosing to deliberately transfer their assets to another party because that party has convinced them they will get something in return? In other words, I think the victim is mistaken not about the fact that they're transferring away their assets, but rather is mistaken about the identity and intentions of the party they're transferring their assets to.
    - vmception 5y ago
      no. thats one kind. many of these scams are erroneous approval transactions. an approval transaction is necessary for another program to use your assets. that program can have a human controller or another function that allows it to seize your asset later. you can read more about this here https://kalis.me/unlimited-erc20-allowances/ https://kalis.me/unlimited-erc20-allowances/ (NFT standard classes inherit the ERC20 interface)
  - stormbrew 5y ago
    In other words: maybe using the same key for your wallet as for logging into random websites is not a good idea, and “web3” as an approach to identity has some real flaws that are being papered over. Certainly involving more crypto in the issue of logging in to things might be a net benefit, but there’s no reason it should come from blockchain instead of, say, the password manager and totp token software people are already getting used to using and that don’t expose you to financial damage. In the end though, people still need to get into their accounts when software is unavailable so it seems unlikely passwords are ever completely going away.
ibz 5y ago
Actually LNURL-auth [1] has nothing to do with blockchains except that it makes it dead simple to use a Lightning wallet, such as Breez, to log in. All it does is send a request, get a random string, sign that with the private key, and send it back alongside with the public key and the signature. Yes, it works. Yes, it is simple. No, it has nothing to do with blockchains. Websites like http://stacker.news http://stacker.news are using this. See https://lightninglogin.live https://lightninglogin.live
hiq 5y ago
> incredibly secure as long as you don't leak your 12 words So what happens when you do? It sounds incredibly secure until you end up in a bad situation with no remediation.
TurningCanadian 5y ago
Sounds like https://webauthn.io/ https://webauthn.io/ would solve your problem. It's a real solution in use by a number of popular websites already. E.g. Cloudflare, ID.me.
notsrg 5y ago
>Everyone agrees the legacy web auth is broken Only web3 enthusiasts with a solution in search of a problem agree with this. Auth has been a solved problem for years. Use a password manager. No need for blockchain nonsense. Next.
- lgessler 5y ago
  I'm bear on web3 but you can't seriously say that with a straight face. The average person doesn't, won't, and in a way can't use a password manager, and measures like 2FA which mitigate weak password security still yield imperfect results.
  - notsrg 5y ago
    If they won't use a password manager why would they use a crypto wallet? Adding public key cryptography to the mix almost guarantees the barrier to entry is higher.
- desttro 5y ago
  This is true and I use LastPass but we are in the minority of users. LastPass and other password keepers are too onerous for the mainstream and require upkeep. The whole point of why web3 is the hammer everyone is trying to use is because of user adoption and buzz generated by crypto.
- birracerveza 4y ago
  >Auth has been a solved problem for years. Only web3 detractors with an allergy to blockchains agree with this. You can mitigate the risks by using a password manager, but you can't argue that it's a solid system, come on now. You still have to trust websites to actually properly handle your credentials, and then hope for the best. Even with a password manager. >Use a password manager. If I need to use an external application to actually properly use the system, I might as well have that application use an actual proper system in the first place (public key cryptography), especially if that application also acts as your online de facto identity that only requires you to remember 12 words to access from anywhere. >No need for blockchain nonsense. Doesn't use blockchain. Next.
bin_bash 5y ago
Bringing a blockchain along for simply logging in with public keys has to be peak cargo cult.
knorker 5y ago
This was solved in U2F, webauthn, or if you want other options there's Steve Gibson's squirrel.

oh_sigh 5y ago

Isn't this what OAuth solves?

tshaddox 5y ago

You don't need any of the blockchain stuff to support logging in to websites with a public key. That's straightforward with any old public-key cryptography scheme like PGP. In fact, from what I can tell, most of the "web3 login" implementations are doing little more triggering your wallet extension (e.g. MetaMask) to sign a unique message with your private key to prove you control an Ethereum address. It works well, and I rather like it, but the login part itself could just as easily be an old-fashioned PGP key pair.

vmception 5y ago
correct, PGP had 30 years to get broad user-facing adoption and failed outside of a few paranoid folks on email and setting up git or ssh on a new machine once. blockchains and their addressing namespace have very quickly propelled standardized interfaces for signing key pairs for people that don't even think about it.
- tshaddox 5y ago
  Neither has anything remotely mistakable for broad user-facing adoption.
  - vmception 5y ago
    sure, to clarify, I would say if we had a way to count frequency of key pair signing before wallets, and after wallets, you would see a major adoption curve having occurred and continuing. I think that's a good thing because I think key signing is a good thing that needed better adoption and use cases. its ridiculous to think 'hm my users need a browser extension to use my application' but now since millions already do this, its great. thank you, profit motive.
  - swalsh 5y ago
    Metamask has pretty broad adoption. Not quite "my mom" level yet. But it's gone far beyond techies on a fairly large scale, which PGP never really did.
- kkfx 5y ago
  People do not know GNUPG/PGP simply because they are IT-illiterate and those who can teach them, on scale, do profit of such ignorance. Sorry for being rude, but that's is. The chain of trust concept is the simplest and most powerful concept of trust we have in the real world, it fail because most people still have issue understanding the difference between local and remote and understanding why privacy is a value. Blockchain is "popular" just because it's sold as a tool to make money and people who do not know think "let's try it". Nothing more. It's pushed because IT giants (who are probably those who really invented the concept) feel to be giant enough to kick banking out and replace them in a classic EEE move [1] while locking users even more because we need banks mostly for comfort and by law, but we can use cash "by nature" while we can't use cryptos without computers (full of crapware, down to the hw, produced by very few giants at least for their core components) and connections (again owned by few giants). They are sold as free, and they are in theory, in practice they are very hard prisons, worst than those who they say they want to replace. About web3: just try ZeroNet, is a kind of PopcornTime clone, instead of movies it share text, websites. Under the wood just the classic BitTorrent. Fast enough to be used, but certainly not usable by all on scale. The real decentralization we need is web 1.0 with today an IPv6 global for any device and PUBLIC registars who offer domains for free to Citizens JUST mediating eventual overhands, no third party resale allowed... It's not done like we do not push Usenet again just because those who know do want a surveilled and locked IT, not a really free one. [1] and bankers known that well: https://voxeu.org/content/banking-disrupted-financial-intermediation-era-transformational-technology https://voxeu.org/content/banking-disrupted-financial-interm... and also it's more recent evolution https://voxeu.org/article/digitalisation-and-future-banking https://voxeu.org/article/digitalisation-and-future-banking
deleted 5y ago
[deleted]
birracerveza 5y ago
>You don't need any of the blockchain stuff to support logging in to websites with a public key. Well yes, I wasn't refuting the author's "You don't need a f%ing blockchain", but simply stating that IMO Web3 is already miles better than legacy web, even just for its main authentication system. >That's straightforward with any old public-key cryptography scheme like PGP ... but the login part itself could just as easily be an old-fashioned PGP key pair. This reminds me of HN's famous Dropbox comment.[1] Yeah, wallets are "just" public key cryptography, but it's easy enough for anyone to use and for developers to integrate. PGP is extremely convoluted in comparison, and to this day I have no idea how to sign a message with it without having to open up a guide. With metamask it's just two clicks. [1] https://news.ycombinator.com/item?id=8863 https://news.ycombinator.com/item?id=8863
- smaudet 5y ago
  That's because GPGP and PGP both are arcane, bad programs. They are standards written in a time when it was somewhat normal to carry pocket protectors. Sendthing is a reasonable, user friendly alternative to Dropbox. There will be a Sendthing for pgp one day...
swalsh 5y ago
This feels like the guy who said dropbox was useless because he has the ability to use rsync. Yeah the technology under Metamask is old, yeah it doesn't have to be connected to a blockchain (but it's damn convienent that it can). But it does it in a really user friendly way that has not caught on at the same level of mass adoption as Metamask has. The great part of Metamask, is there's almost nothing proprietary about it. You could rip all the blockchain stuff out of it, and it would still work. If I wanted the blockchain stuff later, as long as it follows the standard.... I still could. Brave has it already integrated!
- tshaddox 5y ago
  My argument is not "blockchains are useless because public-key cryptography long predates blockchains." My argument is "the existence of public-key cryptography does not imply that blockchains are useful."
  - swalsh 5y ago
    I did not accuse you of saying "blockchains are useless because public-key cryptography long predates blockchains". I accused you of saying old fashioned PGP was user-friendly. It's not. It never caught on beyond tech users because it's too complicated for non-techies. My point was that Metamask has demonstrated the best UX yet to use public-key cryptography for everyday users.

lanstin 5y ago

Isn't clicking on "connect your wallet" the thing that all the people that have lost their NFTs or coins to a scam URL have done that they shouldn't have done?

vmception 5y ago
thats because they signed a transaction, obvious distinction as it is preparing to send money to authorize the scam. signing a keypair does not send money and doesn't use the blockchain, only the addressing namespace. of course with the state of education on this topic being such wide and widening gulf, people are going to get taken advantage of with obvious distinctions that are not so obvious to them.
- tshaddox 5y ago
  I'm no expert, but aren't most of these scams the result of the user choosing to deliberately transfer their assets to another party because that party has convinced them they will get something in return? In other words, I think the victim is mistaken not about the fact that they're transferring away their assets, but rather is mistaken about the identity and intentions of the party they're transferring their assets to.
  - vmception 5y ago
    no. thats one kind. many of these scams are erroneous approval transactions. an approval transaction is necessary for another program to use your assets. that program can have a human controller or another function that allows it to seize your asset later. you can read more about this here https://kalis.me/unlimited-erc20-allowances/ https://kalis.me/unlimited-erc20-allowances/ (NFT standard classes inherit the ERC20 interface)
- stormbrew 5y ago
  In other words: maybe using the same key for your wallet as for logging into random websites is not a good idea, and “web3” as an approach to identity has some real flaws that are being papered over. Certainly involving more crypto in the issue of logging in to things might be a net benefit, but there’s no reason it should come from blockchain instead of, say, the password manager and totp token software people are already getting used to using and that don’t expose you to financial damage. In the end though, people still need to get into their accounts when software is unavailable so it seems unlikely passwords are ever completely going away.

ibz 5y ago

Actually LNURL-auth [1] has nothing to do with blockchains except that it makes it dead simple to use a Lightning wallet, such as Breez, to log in. All it does is send a request, get a random string, sign that with the private key, and send it back alongside with the public key and the signature. Yes, it works. Yes, it is simple. No, it has nothing to do with blockchains. Websites like http://stacker.news http://stacker.news are using this. See https://lightninglogin.live https://lightninglogin.live

hiq 5y ago

> incredibly secure as long as you don't leak your 12 words So what happens when you do? It sounds incredibly secure until you end up in a bad situation with no remediation.

TurningCanadian 5y ago

Sounds like https://webauthn.io/ https://webauthn.io/ would solve your problem. It's a real solution in use by a number of popular websites already. E.g. Cloudflare, ID.me.

notsrg 5y ago

>Everyone agrees the legacy web auth is broken Only web3 enthusiasts with a solution in search of a problem agree with this. Auth has been a solved problem for years. Use a password manager. No need for blockchain nonsense. Next.

lgessler 5y ago
I'm bear on web3 but you can't seriously say that with a straight face. The average person doesn't, won't, and in a way can't use a password manager, and measures like 2FA which mitigate weak password security still yield imperfect results.
- notsrg 5y ago
  If they won't use a password manager why would they use a crypto wallet? Adding public key cryptography to the mix almost guarantees the barrier to entry is higher.
desttro 5y ago
This is true and I use LastPass but we are in the minority of users. LastPass and other password keepers are too onerous for the mainstream and require upkeep. The whole point of why web3 is the hammer everyone is trying to use is because of user adoption and buzz generated by crypto.
birracerveza 4y ago
>Auth has been a solved problem for years. Only web3 detractors with an allergy to blockchains agree with this. You can mitigate the risks by using a password manager, but you can't argue that it's a solid system, come on now. You still have to trust websites to actually properly handle your credentials, and then hope for the best. Even with a password manager. >Use a password manager. If I need to use an external application to actually properly use the system, I might as well have that application use an actual proper system in the first place (public key cryptography), especially if that application also acts as your online de facto identity that only requires you to remember 12 words to access from anywhere. >No need for blockchain nonsense. Doesn't use blockchain. Next.

bin_bash 5y ago

Bringing a blockchain along for simply logging in with public keys has to be peak cargo cult.

knorker 5y ago

This was solved in U2F, webauthn, or if you want other options there's Steve Gibson's squirrel.