4 ms·

> You can have universal login with MetaMask, sure, but that functionality isn't reliant on a blockchain. It's decades-old public key cryptography. For sure, y

> You can have universal login with MetaMask, sure, but that functionality isn't reliant on a blockchain. It's decades-old public key cryptography. For sure, you can do PGP, but if it's decades old, you have to ask yourself: Why hasn't public key cryptography taken off as a sign in solution in the same way that email or Google or Facebook have been? Mainly because it's always been a chicken and egg problem for consumers and application developers. If you implement PGP as your sign-in method, it's unlikely that any consumers will adopt it unless they're developers. And you increase the barrier to entry for anyone who does not understand it. In the case of MetaMask, this has already got significant traction at 21 million monthly active users (more if you count other EVM wallet solutions), because there's no other way to interact with a blockchain. It's also relatively user friendly. And there's an ecosystem now of applications that require it for interaction, so you're starting to see network effects grow for "Sign in With Ethereum/EVM". > But successful internet communities do everything in their power to remain walled gardens This will be proven to be false in the long run. This was the same argument against Linux back in the day vs. Windows. The bazaar will win against the cathedral in the end.

roywiggins 4y ago
Okay, but the login bit for MetaMask is "just" using public key cryptography though, right? You could strip out the blockchain stuff from MetaMask and that part would still work.
- dwaite 4y ago
  You could also do Web Authentication, which is based on Public Key cryptography and ships with every major browser and is integrated into many operating systems.
phamilton 4y ago
> Why hasn't public key cryptography taken off as a sign in solution in the same way that email or Google or Facebook have been? Because people haven't been financially motivated to evangelize it. I believe that's the core of blockchain/web3 innovations. It's a worse way to do it, but the social hype (driven almost entirely by get rich FOMO) is enough to push it over the edge.
- roywiggins 4y ago
  The most efficient way to do it would be to bootstrap the ecosystem with blockchain buzziness and then just deprecate the blockchain part eventually. MetaMask already relies on "Web2" apis to query blockchains, who says they have to actually hit a blockchain all the time?
  - thawaya3113 4y ago
    This is exactly what’s happening with crypto. A user’s transaction on Coinbase rarely represents an actual transaction on the blockchain. A transaction actually represents a row in a Coinbase SQL database, which Coinbase will eventually batch and then convert into a blockchain operation.
    - rvbissell 4y ago
      So... a dark pool? Oy vey.
    - chrisco255 4y ago
      Coinbase is a centralized exchange. Of course it runs in a SQL db or whatever. They only need to touch the chain when settling inflows/outflows. But something like Uniswap: https://app.uniswap.org/#/swap https://app.uniswap.org/#/swap is fully on-chain. Every trade happens on chain, because the application is an immutable smart contract liquidity protocol, called an AMM, or automated market maker. It does as much, if not more, volume than Coinbase ($1.98B in last 24H): https://info.uniswap.org/#/ https://info.uniswap.org/#/
  - chrisco255 4y ago
    > MetaMask already relies on "Web2" apis to query blockchains False. MetaMask uses Infura as a default, but you can edit your RPC URL to whatever you want. You can even run your own node and sync the chain if you've got a couple hundred gigabytes to spare (no stake required to run a non-validating node). They don't have to hit the blockchain all the time. Only when it makes sense. For everything else, there's off-chain signatures. That's the beauty of it. Hey, you don't want to use the chain, just use the sign-in with Ethereum feature, and that's totally cool!
dwaite 4y ago
> For sure, you can do PGP, but if it's decades old, you have to ask yourself: Why hasn't public key cryptography taken off as a sign in solution in the same way that email or Google or Facebook have been? For the same reason a Metamask extension to do so won't take off outside of specialized applications. Since users have not yet authenticated, this is part of a conversation process of potential users to registered, authenticated users. Only options which will increase that will be supported. People to some very high double-digit percentage understand what a "Sign in with Google" button does, what will happen if they hit it. Because of that, there is high likelyhood if someone hits that button that they will return successfully authenticated. PGP never had a website-based authentication option. Mutual TLS did, but other than a few certificate authorities I've never seen it out of the enterprise space - the compatibility and user experience were never even close to sufficient to offer as a broader option. As optimized as the sign in with Google experience is, there are still sites which will not support it because they want to make sure the user does not get 'lost' on another site if there are failures. They simply will not outsource their funnel.
- dropnerd 4y ago
  chrome will never have a "login with pgp" function brave already supports "login with ethereum" adoption matters
pshc 4y ago
Exactly! AFAIK client certificates have been in browsers for decades and almost no one uses them. Whereas, like you said, millions of people now the ability and basic know-how to generate and sign with public-private key pairs, adopted via incentives that keep the wallet ecosystem thriving.
hnaccount141 4y ago
> This will be proven to be false in the long run. This was the same argument against Linux back in the day vs. Windows. The bazaar will win against the cathedral in the end. Linux is still sitting at ~2% desktop market share compared to 90% for macOS+Windows. I'd hardly call that a win for the bazaar.
topranks 4y ago
People only use Metamask to engage in speculative crypto schemes. Blockchain doesn’t really solve the whole “who is giving me this key” issue with PGP.

roywiggins 4y ago

Okay, but the login bit for MetaMask is "just" using public key cryptography though, right? You could strip out the blockchain stuff from MetaMask and that part would still work.

dwaite 4y ago
You could also do Web Authentication, which is based on Public Key cryptography and ships with every major browser and is integrated into many operating systems.

phamilton 4y ago

> Why hasn't public key cryptography taken off as a sign in solution in the same way that email or Google or Facebook have been? Because people haven't been financially motivated to evangelize it. I believe that's the core of blockchain/web3 innovations. It's a worse way to do it, but the social hype (driven almost entirely by get rich FOMO) is enough to push it over the edge.

roywiggins 4y ago
The most efficient way to do it would be to bootstrap the ecosystem with blockchain buzziness and then just deprecate the blockchain part eventually. MetaMask already relies on "Web2" apis to query blockchains, who says they have to actually hit a blockchain all the time?
- thawaya3113 4y ago
  This is exactly what’s happening with crypto. A user’s transaction on Coinbase rarely represents an actual transaction on the blockchain. A transaction actually represents a row in a Coinbase SQL database, which Coinbase will eventually batch and then convert into a blockchain operation.
  - rvbissell 4y ago
    So... a dark pool? Oy vey.
  - chrisco255 4y ago
    Coinbase is a centralized exchange. Of course it runs in a SQL db or whatever. They only need to touch the chain when settling inflows/outflows. But something like Uniswap: https://app.uniswap.org/#/swap https://app.uniswap.org/#/swap is fully on-chain. Every trade happens on chain, because the application is an immutable smart contract liquidity protocol, called an AMM, or automated market maker. It does as much, if not more, volume than Coinbase ($1.98B in last 24H): https://info.uniswap.org/#/ https://info.uniswap.org/#/
- chrisco255 4y ago
  > MetaMask already relies on "Web2" apis to query blockchains False. MetaMask uses Infura as a default, but you can edit your RPC URL to whatever you want. You can even run your own node and sync the chain if you've got a couple hundred gigabytes to spare (no stake required to run a non-validating node). They don't have to hit the blockchain all the time. Only when it makes sense. For everything else, there's off-chain signatures. That's the beauty of it. Hey, you don't want to use the chain, just use the sign-in with Ethereum feature, and that's totally cool!

dwaite 4y ago

> For sure, you can do PGP, but if it's decades old, you have to ask yourself: Why hasn't public key cryptography taken off as a sign in solution in the same way that email or Google or Facebook have been? For the same reason a Metamask extension to do so won't take off outside of specialized applications. Since users have not yet authenticated, this is part of a conversation process of potential users to registered, authenticated users. Only options which will increase that will be supported. People to some very high double-digit percentage understand what a "Sign in with Google" button does, what will happen if they hit it. Because of that, there is high likelyhood if someone hits that button that they will return successfully authenticated. PGP never had a website-based authentication option. Mutual TLS did, but other than a few certificate authorities I've never seen it out of the enterprise space - the compatibility and user experience were never even close to sufficient to offer as a broader option. As optimized as the sign in with Google experience is, there are still sites which will not support it because they want to make sure the user does not get 'lost' on another site if there are failures. They simply will not outsource their funnel.

dropnerd 4y ago
chrome will never have a "login with pgp" function brave already supports "login with ethereum" adoption matters

pshc 4y ago

Exactly! AFAIK client certificates have been in browsers for decades and almost no one uses them. Whereas, like you said, millions of people now the ability and basic know-how to generate and sign with public-private key pairs, adopted via incentives that keep the wallet ecosystem thriving.

hnaccount141 4y ago

> This will be proven to be false in the long run. This was the same argument against Linux back in the day vs. Windows. The bazaar will win against the cathedral in the end. Linux is still sitting at ~2% desktop market share compared to 90% for macOS+Windows. I'd hardly call that a win for the bazaar.

topranks 4y ago

People only use Metamask to engage in speculative crypto schemes. Blockchain doesn’t really solve the whole “who is giving me this key” issue with PGP.