7 ms·

This problem, namely bazillions of ways to get auth wrong, is solved by Web3. I really don't get why everyone here hates it. Edit: Yes, I meant that login is

This problem, namely bazillions of ways to get auth wrong, is solved by Web3. I really don't get why everyone here hates it. Edit: Yes, I meant that login is tied to your wallet. This can be a hardware wallet, so it's very difficult to have it attacked, can be backed up, never expires, etc. This auth mechanism removes _tons_ of problems with existing web sites & giant corporations. But I guess most of you work for them, so have fun mocking people who are not like you :)

jjulius 4y ago
It would be helpful if you were to explain why Web3 would be beneficial here instead of just tossing snark towards HN.
- mh- 4y ago
  It'd also be useful for them to define what they mean by Web3 in this context.
  - tehlike 4y ago
    metamask with login with wallet, i assume, is what they mean.
stevage 4y ago
Like pretty much everything else involving blockchain there are more straightforward ways to solve the problem without all the BS.
- supramouse 4y ago
  yeah for auth is a blockchain even required? it's pretty much just asymmetric crypto at that point isn't it? I think the 'web3' way would make it worse wouldn't it? like metamask relying on centeralized service to query the blockchain I guess a real benifit I could see would be being able to use a blockchain to revoke your keys somehow but that's not how metamask and web3 stuff seems to work right now
  - tehlike 4y ago
    Metamask can sign data, which would help you prove the user has the private for a given public key. You do not need the blockchain. The chrome extension to cryptography would help - but we have FIDO that does exactly that (and webauthn i guess).
    - throwme_123 4y ago
      Indeed that is possible, the problem is all the greedy corporations that want to suck all our data, so they can't simply trust the signed messages of Metamask and want instead to implement layers of poor software for their profit
      - tehlike 4y ago
        oh i mean, identity/authentication alone doesn't make profit right? The problem with using PK cryptography is that if you lose your keys, you'd be locked out. Then we would probably have other key schemes M-of-N etc or social proof to compensate for the problems with single-key PK, which then has other problems.
  - throwme_123 4y ago
    Metamask relies on whatever RPC you give it, including your own node if you want The asym crypto is enough for proper authentication, but decentralized apps generally are built to use it, without relying on centralized data. A message signature being verified by a stateless service is all that is required Could do without web3, but the practice of predatory web giants and smaller startups is to exploit the users so they don't do that
- Jarwain 4y ago
  The BS makes it a more sticky though. If your entire life (identity and finance) is gated by a single password, a user will Care more and that makes it easier to use and remember. In other words, having your wallet behind the same password supports adoption.
m1keil 4y ago
> I really don't get why everyone here hates it. Partly because comments like this.
- throwme_123 4y ago
  Thanks for being helpful. All the web3 or crypto hate if you prefer is a very strong bias in this site. There are no real arguments, just that it is a scam or whatever. Is asymmetric crypto a scam? Is Leslie Lamport an idiot and nobody needs decentralized computing? Please enlighten me
  - m1keil 4y ago
    You just name dropped web3 as a solution without having any explanation about how and why exactly would it help and now you are complaining I'm not being helpful? You serious?
jherico 4y ago
> solved by Web3. To the extent that web3 is even well defined, no it absolutely doesn't. The blockchain space right now is rife with scams and people getting stuff stolen from their wallets. At best it makes it harder for the average user to understand how to be secure and at worst it changes this scenario from "I lost my facebook account" to "I lost control of every asset I own and my entire identity".
deleted 4y ago
[deleted]
yjftsjthsd-h 4y ago
The problem here is that the user had their own domain and lost it. Obviously the analog here is having their own wallet and losing it, in which case they're probably more screwed rather than less.
- Jarwain 4y ago
  Run out of time is a little more accurate, and a failure mode that Cannot Happen with crypto, though. Steps can be made to make your wallet impossible to lose, but not your domain.
- throwme_123 4y ago
  Wallets do not expire
  - yjftsjthsd-h 4y ago
    Technically true, but if you lose your key and don't have a backup, or forget your password, you're stuck; there's no recovery process (except brute force, which doesn't work on secure passwords), by design.
Thorrez 4y ago
Not really. People have their cryptocurrencies stolen all the time from similar problems. https://fabricegrinda.com/hacked-cryptocurrencies-stolen/ https://fabricegrinda.com/hacked-cryptocurrencies-stolen/ https://krebsonsecurity.com/2020/11/godaddy-employees-used-in-attacks-on-multiple-cryptocurrency-services/ https://krebsonsecurity.com/2020/11/godaddy-employees-used-i... https://therecord.media/two-cryptocurrency-portals-are-experiencing-a-dns-hijack-at-the-same-time/ https://therecord.media/two-cryptocurrency-portals-are-exper... https://cryptonews.com.au/godaddy-website-hack-leaves-defi-protocol-spiritswap-compromised https://cryptonews.com.au/godaddy-website-hack-leaves-defi-p... https://news.bitcoin.com/hackers-compromise-web-portal-bitcoin-org-dns-hijack-replaces-site-with-btc-doubler-scam/ https://news.bitcoin.com/hackers-compromise-web-portal-bitco... https://www.engadget.com/2018-04-25-hackers-dns-phishing-scam-cryptocurrency-myetherwallet.html https://www.engadget.com/2018-04-25-hackers-dns-phishing-sca...

jjulius 4y ago

It would be helpful if you were to explain why Web3 would be beneficial here instead of just tossing snark towards HN.

mh- 4y ago
It'd also be useful for them to define what they mean by Web3 in this context.
- tehlike 4y ago
  metamask with login with wallet, i assume, is what they mean.

stevage 4y ago

Like pretty much everything else involving blockchain there are more straightforward ways to solve the problem without all the BS.

supramouse 4y ago
yeah for auth is a blockchain even required? it's pretty much just asymmetric crypto at that point isn't it? I think the 'web3' way would make it worse wouldn't it? like metamask relying on centeralized service to query the blockchain I guess a real benifit I could see would be being able to use a blockchain to revoke your keys somehow but that's not how metamask and web3 stuff seems to work right now
- tehlike 4y ago
  Metamask can sign data, which would help you prove the user has the private for a given public key. You do not need the blockchain. The chrome extension to cryptography would help - but we have FIDO that does exactly that (and webauthn i guess).
  - throwme_123 4y ago
    Indeed that is possible, the problem is all the greedy corporations that want to suck all our data, so they can't simply trust the signed messages of Metamask and want instead to implement layers of poor software for their profit
    - tehlike 4y ago
      oh i mean, identity/authentication alone doesn't make profit right? The problem with using PK cryptography is that if you lose your keys, you'd be locked out. Then we would probably have other key schemes M-of-N etc or social proof to compensate for the problems with single-key PK, which then has other problems.
- throwme_123 4y ago
  Metamask relies on whatever RPC you give it, including your own node if you want The asym crypto is enough for proper authentication, but decentralized apps generally are built to use it, without relying on centralized data. A message signature being verified by a stateless service is all that is required Could do without web3, but the practice of predatory web giants and smaller startups is to exploit the users so they don't do that
Jarwain 4y ago
The BS makes it a more sticky though. If your entire life (identity and finance) is gated by a single password, a user will Care more and that makes it easier to use and remember. In other words, having your wallet behind the same password supports adoption.

m1keil 4y ago

> I really don't get why everyone here hates it. Partly because comments like this.

throwme_123 4y ago
Thanks for being helpful. All the web3 or crypto hate if you prefer is a very strong bias in this site. There are no real arguments, just that it is a scam or whatever. Is asymmetric crypto a scam? Is Leslie Lamport an idiot and nobody needs decentralized computing? Please enlighten me
- m1keil 4y ago
  You just name dropped web3 as a solution without having any explanation about how and why exactly would it help and now you are complaining I'm not being helpful? You serious?

jherico 4y ago

> solved by Web3. To the extent that web3 is even well defined, no it absolutely doesn't. The blockchain space right now is rife with scams and people getting stuff stolen from their wallets. At best it makes it harder for the average user to understand how to be secure and at worst it changes this scenario from "I lost my facebook account" to "I lost control of every asset I own and my entire identity".

deleted 4y ago

[deleted]

yjftsjthsd-h 4y ago

The problem here is that the user had their own domain and lost it. Obviously the analog here is having their own wallet and losing it, in which case they're probably more screwed rather than less.

Jarwain 4y ago
Run out of time is a little more accurate, and a failure mode that Cannot Happen with crypto, though. Steps can be made to make your wallet impossible to lose, but not your domain.
throwme_123 4y ago
Wallets do not expire
- yjftsjthsd-h 4y ago
  Technically true, but if you lose your key and don't have a backup, or forget your password, you're stuck; there's no recovery process (except brute force, which doesn't work on secure passwords), by design.

Thorrez 4y ago

Not really. People have their cryptocurrencies stolen all the time from similar problems. https://fabricegrinda.com/hacked-cryptocurrencies-stolen/ https://fabricegrinda.com/hacked-cryptocurrencies-stolen/ https://krebsonsecurity.com/2020/11/godaddy-employees-used-in-attacks-on-multiple-cryptocurrency-services/ https://krebsonsecurity.com/2020/11/godaddy-employees-used-i... https://therecord.media/two-cryptocurrency-portals-are-experiencing-a-dns-hijack-at-the-same-time/ https://therecord.media/two-cryptocurrency-portals-are-exper... https://cryptonews.com.au/godaddy-website-hack-leaves-defi-protocol-spiritswap-compromised https://cryptonews.com.au/godaddy-website-hack-leaves-defi-p... https://news.bitcoin.com/hackers-compromise-web-portal-bitcoin-org-dns-hijack-replaces-site-with-btc-doubler-scam/ https://news.bitcoin.com/hackers-compromise-web-portal-bitco... https://www.engadget.com/2018-04-25-hackers-dns-phishing-scam-cryptocurrency-myetherwallet.html https://www.engadget.com/2018-04-25-hackers-dns-phishing-sca...