3 ms·

> account recovery is not something "nice to have", but rather a hard requirement — and it's impossible, by design, in a public-key-crypto-based system. Can yo

> account recovery is not something "nice to have", but rather a hard requirement — and it's impossible, by design, in a public-key-crypto-based system. Can you give some examples of acceptable account recovery systems? Do they involve either giving up privacy (with government-issued IDs, for example), or delegating the problem to another system like email? If email is an acceptable system to base account recovery on, then couldn't users just store their recovery private key in an email sent to themselves (or saved as a draft)?

grishka 4y ago
> Do they involve either giving up privacy (with government-issued IDs, for example) Sometimes, yes. But then presenting a government-issued ID is kinda inescapable — this is also a requirement for participation in crypto. You can't buy cryptocurrency without KYC. And you sure as hecc need some sort of tokens for these "fully decentralized" identity schemes because they inevitably are a cryptocurrency with extra functionality duct taped to the side. > or delegating the problem to another system like email? That's also an option. > If email is an acceptable system to base account recovery on, then couldn't users just store their recovery private key in an email sent to themselves (or saved as a draft)? And if their email account is broken into and the private key gets into someone else's hands, how exactly do they prevent potential impersonation without starting a whole new online life, ideally without their followers even noticing?
- dane-pgp 4y ago
  > these "fully decentralized" identity schemes ... inevitably are a cryptocurrency with extra functionality duct taped to the side. I've not actually used BrightID[0], but my understanding is that you can use it without needing to buy any of their tokens. So it's more like a web-of-trust identity scheme with a cryptocurrency duct taped to the side. (Also I think that buying cryptocurrency without relying on a government-regulated business is probably more common than you're suggesting). > if their email account is broken into and the private key gets into someone else's hands This is the same problem that all existing social networks (and probably some government services in some countries) are already vulnerable to. I think a decentralised social network can offer meaningful improvements in user freedom and privacy without also solving every other online/computer security problem in the world. > starting a whole new online life In the case of BrightID, you can set up "social recovery"[1] which uses the social graph to allow you to regain access to your account. [0] https://www.brightid.org/ https://www.brightid.org/ [1] https://brightid.gitbook.io/brightid/setting-up-social-recovery https://brightid.gitbook.io/brightid/setting-up-social-recov...

grishka 4y ago

> Do they involve either giving up privacy (with government-issued IDs, for example) Sometimes, yes. But then presenting a government-issued ID is kinda inescapable — this is also a requirement for participation in crypto. You can't buy cryptocurrency without KYC. And you sure as hecc need some sort of tokens for these "fully decentralized" identity schemes because they inevitably are a cryptocurrency with extra functionality duct taped to the side. > or delegating the problem to another system like email? That's also an option. > If email is an acceptable system to base account recovery on, then couldn't users just store their recovery private key in an email sent to themselves (or saved as a draft)? And if their email account is broken into and the private key gets into someone else's hands, how exactly do they prevent potential impersonation without starting a whole new online life, ideally without their followers even noticing?

dane-pgp 4y ago
> these "fully decentralized" identity schemes ... inevitably are a cryptocurrency with extra functionality duct taped to the side. I've not actually used BrightID[0], but my understanding is that you can use it without needing to buy any of their tokens. So it's more like a web-of-trust identity scheme with a cryptocurrency duct taped to the side. (Also I think that buying cryptocurrency without relying on a government-regulated business is probably more common than you're suggesting). > if their email account is broken into and the private key gets into someone else's hands This is the same problem that all existing social networks (and probably some government services in some countries) are already vulnerable to. I think a decentralised social network can offer meaningful improvements in user freedom and privacy without also solving every other online/computer security problem in the world. > starting a whole new online life In the case of BrightID, you can set up "social recovery"[1] which uses the social graph to allow you to regain access to your account. [0] https://www.brightid.org/ https://www.brightid.org/ [1] https://brightid.gitbook.io/brightid/setting-up-social-recovery https://brightid.gitbook.io/brightid/setting-up-social-recov...