3 ms·
> I'm not into crypto, but it's also accepted in that community that you must safeguard your keys. Of course it is accepted, but so it is with passwords. And p
by grishka 5y ago
> I'm not into crypto, but it's also accepted in that community that you must safeguard your keys.
Of course it is accepted, but so it is with passwords. And people are terrible enough with passwords, yet here you are suggesting that they use something that can't even be (easily) memorized, can't be invalidated, and has to be stored reliably yet secretly, as "the" identifier. You're putting too much trust into your average user.
None of these cryptography-based identity schemes can possibly work in the real world, period.
- Ambolia 5y agoYou could still have server-owned accounts with that setup. It just wouldn't be the only option.
- grishka 5y agoYou could still have public-key-identified accounts with ActivityPub, too. ActivityPub does, in fact, use public-key cryptography for authentication, and each actor must have a key pair. It's just that it's not its identity — the identifier is a URL where the actor JSON object can be found.
- easrng 5y agoIn practice the keys are managed by the servers though.
- lumost 5y agoThe only time these systems will work is when the perceived risk of snooping is greater than the value of account recovery. There is certainly a niche for this, but it probably isn't very broad. The majority of internet users seem uncomfortable with surveillance, but accepting of it. I suspect the pendulum will swing if users no longer feel they have anyway to opt-out of surveillance. e.g. private browsing and other systems are recognized as ineffective, or sensitive data such as chat messages become broadly leaked and accessible to the typical user.
- DarylZero 5y agoThe other solutions don't work in the real world either. If somebody says that their Facebook account is lost and can't be recovered, people will believe them and not Facebook.