4 ms·

Petnames: A humane approach to secure, decentralized naming (2018)

52 points by simonpure 4y ago

rambojazz 4y ago
I'm looking forward for the comments about this. I discovered/read about "pet names" a while ago, but I could not understand very well what problem they're trying to solve, and if they solve it.
- c0mptonFP 4y ago
  Petnames try to solve a trilemma known as Zooko's triangle. A naming system that is both permissionless and globally unique will tend towards unreadable names. You'll see lots of Sybil attacks on these systems, with botnets squatting any decent name. For DNS, you have many governance bodies that act as gatekeepers for domain registration. Repository hosts like GitHub avoid Zooko's triangle by having namespaces, and an appeal process if someone is squatting your trademark. Crates.io on Rust doesn't allow automated crate creation. In many cases, naming systems are not permissionless, and gatekept by a central entity. Once you open the floodgates of permissionless-ness, you're dealing with a hostile environment that's difficult to control. Petnames are one solution to this issue. Others are Handshake, Namecoin and ENS
- unixbane 4y ago
  The proper way to connect to a service on the internet after the 70s when crypto was invented, is to connect by public key or hash thereof. Instead of a bloated insecure HTTPS stack, your code just connects and checks against the public key which was used as the address (actual implementation details like finding the IP address or routing over an overlay network is done automatically with something like a DHT). The second piece to this is how the GUI works. Instead of showing long bit strings or hex encoding them in some pointless way, it allows you to assign names to these addresses as you come across them. When you see the address in some other page it will show up with the name you assigned and so you will recognize it. A key point to this is that HTTPS does not actually cause you to know you are using the right domain name. Aside from the fact that HTTPS is untrustworthy due to the CA model, mybrand.com or mybrand.net or one of the other infinite number of legitimate sounding things could all be the correct domain for some brand, you would never know unless someone previously introduced you to the right domain name. Since you had to get it from somewhere, you may as well have received the public key at that point, which could be encoded in a QR code, or, on the internet, which is the main use case of petnames, trivially included as a link in some web 8.0[1] page or chat where you first heard of the brand. 1. I guess it will take them 6 more tries to get this right.
  - ianopolous 4y ago
    Strong agree. There is a massively undersold feature of IPFS, p2p streams, which do exactly this. We use it extensively in Peergos to sent http requests to a public key. It has stunning UX as well, not having to worry about changing IP addresses etc. This makes it easy to have zero dependency on DNS or the TLS certificate authorities.
ryanschneider 4y ago
This happy path seems pretty nice, but I feel like there’s lots of room for attacks of various types, anyone aware of pre-existing discussions around possible attacks? For example would something like a robocaller be able to reconstruct my social graph? What about work/life contacts leaking across boundaries I’d prefer they didn’t?
- fwip 4y ago
  The article doesn't really go into it, but most real life applications would not share every contact with every other contact. You can imagine a number of different solutions to this problem, but it's mostly a UX issue on how users would be most willing to share their contacts with others. Apps with different approaches could still share data with one another.
  - zcw100 4y ago
    There's a link in there for it but it would be easy to miss that does a much better job of explaining the system http://www.skyhunter.com/marcs/petnames/IntroPetNames.html http://www.skyhunter.com/marcs/petnames/IntroPetNames.html A pentane system actually protects you from phishing attacks and you don't really share your pentanes. You can use your petname as a nickname when introducing a key to someone else. One of the most important parts is to have a good UI/UX that does not confuse nicknames with pentanes or allow you to accidentally accept a nickname as pentane that is confusingly close to an already existing petname. Nicknames are names that you propose using when introducing yourself or someone else. A pet name is the name you assign privately. So Lumberg could be a nickname but your petname might be "dickhead boss". You're free to introduce him to people you know either way you'd like.
wcerfgba 4y ago
So, /etc/hosts ?
pfraze 4y ago
Basically petnames change the addressing architecture from “one global mapping” to “many local mappings.” This means that petnames cannot be used as shared identifiers; you use a global UUID when you need to identify information between users. There are some contexts where this works great (the phone address book) and some where it doesn’t (Web URLs). In effect, if I wanted to drop a URL in this comment, the petname model requires that I use the UUID. You can share petnames with each other to help people, and you could publish petnames and do searches (but this creates trust questions - how do we verify a pet name is accurate?). It may be an entirely suitable approach, but it basically means there are no global short names. I can’t tell you Im at pfrazee dot com if there’s no global dot com registry.
- infogulch 4y ago
  So instead of having one global registry you have many local registries. If registries are also identified by UUID then you say pfraze dot com in the <registry uuid> registry. I like this because then you can have registries that correspond 1-1 with other real-life things that can be internally consistent without having to worry about global uniqueness, like a registry of all registered businesses in a state, or all trademarks, etc. The next step is to create a system for "peering agreements" between registries, or meta-registries.
  - pfraze 4y ago
    You can, but any shared address book needs to have a very clear scope of applicability. Basically: any users that are communicating need to either share the same registry, or have some clear indication that they aren't in order to avoid significant mishaps. I'm not totally sure how you accomplish that.
    - kixiQu 4y ago
      <del>The federated approach would be the same way that we distinguish cooluser@gmail.com from cooluser@proton.me; in this case, the server part would just determine who you're asking to map cooluser to a UUID.</del> Actually, this is handled pretty clearly in the example article.
schanzen 4y ago
For our transitive use of petnames in name systems see also https://datatracker.ietf.org/doc/draft-schanzen-gns/ https://datatracker.ietf.org/doc/draft-schanzen-gns/ and https://www.gnunet.org/en/gns.html https://www.gnunet.org/en/gns.html
unixbane 4y ago
This version of petnames is too complicated. You can't get a good petname system without getting rid of broken crap first. Scanning a QR code on a flyer should be the sole introduction point and just lead to a secure communication from then on. Why do I want petnames for phone numbers or other insecure things? To put it differently, no petname system built on top of unix / web crap will ever be good. Everyone (like posters here) will not understand what they're doing and just write code that breaks it on all layers of the OS and GUIs. Guaranteed if Android starts using petnames more there will just be issues like it copies someone's petnames all over yours, shares the ones you didn't want to share, etc.
- Zamiel_Snawley 4y ago
  no petname system built on top of unix / web crap will ever be good. This claim is unsupported. If you have created or know of a better version of petnames, I'd love to hear about it.
  - Schroedingersat 4y ago
    Introduce via a uuid represented as hex, psuedo-pronouncable syllables, or a barcode. Every uuid maps deterministically to an abstract avatar which can't be changed. It can be canonically 64 or 128 bits, but allow the user to see a 32 or even 24 bit visualisation if they please. If identities have significant cost (such as needing to subscribe to a provider or to be embedded in your local social graph) the smaller should suffice even as a default. Allow saving with whatever name you please to a list or using the target's name for themselves. Allow sending a contact with metadata including optionally the nickname Allow lists to be published, and whole lists to be saved as entries. Don't hide the uuid ever because that's condescending and introduces many vectors for bad things. People learned what phone numbers were, trust them to learn what a UUID is if you stop shifting the sand under them for a minute and hiding what is actually going on at every opportunity.
mlinksva 4y ago
I would guess this is being posted today because of https://news.ycombinator.com/item?id=32500151 https://news.ycombinator.com/item?id=32500151 by the same author, which is 2022.
vivegi 4y ago
In Hypertext you would say <a href="https://example.com/aresource">A resource</a> In essence the anchor text becomes the petname and is human readable while the href points to the URL of the resource referenced by the link described by the petname. If you want a name authority, use URLs. What you alias them to is up to you since only you use the alias. If you need the alias also to be globally unique, tough luck! Use URLs there as well (or invent new naming schemes and try to get them adopted).

52 points by simonpure 4y ago

I'm looking forward for the comments about this. I discovered/read about "pet names" a while ago, but I could not understand very well what problem they're trying to solve, and if they solve it.

c0mptonFP 4y ago
Petnames try to solve a trilemma known as Zooko's triangle. A naming system that is both permissionless and globally unique will tend towards unreadable names. You'll see lots of Sybil attacks on these systems, with botnets squatting any decent name. For DNS, you have many governance bodies that act as gatekeepers for domain registration. Repository hosts like GitHub avoid Zooko's triangle by having namespaces, and an appeal process if someone is squatting your trademark. Crates.io on Rust doesn't allow automated crate creation. In many cases, naming systems are not permissionless, and gatekept by a central entity. Once you open the floodgates of permissionless-ness, you're dealing with a hostile environment that's difficult to control. Petnames are one solution to this issue. Others are Handshake, Namecoin and ENS
unixbane 4y ago
The proper way to connect to a service on the internet after the 70s when crypto was invented, is to connect by public key or hash thereof. Instead of a bloated insecure HTTPS stack, your code just connects and checks against the public key which was used as the address (actual implementation details like finding the IP address or routing over an overlay network is done automatically with something like a DHT). The second piece to this is how the GUI works. Instead of showing long bit strings or hex encoding them in some pointless way, it allows you to assign names to these addresses as you come across them. When you see the address in some other page it will show up with the name you assigned and so you will recognize it. A key point to this is that HTTPS does not actually cause you to know you are using the right domain name. Aside from the fact that HTTPS is untrustworthy due to the CA model, mybrand.com or mybrand.net or one of the other infinite number of legitimate sounding things could all be the correct domain for some brand, you would never know unless someone previously introduced you to the right domain name. Since you had to get it from somewhere, you may as well have received the public key at that point, which could be encoded in a QR code, or, on the internet, which is the main use case of petnames, trivially included as a link in some web 8.0[1] page or chat where you first heard of the brand. 1. I guess it will take them 6 more tries to get this right.
- ianopolous 4y ago
  Strong agree. There is a massively undersold feature of IPFS, p2p streams, which do exactly this. We use it extensively in Peergos to sent http requests to a public key. It has stunning UX as well, not having to worry about changing IP addresses etc. This makes it easy to have zero dependency on DNS or the TLS certificate authorities.

ryanschneider 4y ago

This happy path seems pretty nice, but I feel like there’s lots of room for attacks of various types, anyone aware of pre-existing discussions around possible attacks? For example would something like a robocaller be able to reconstruct my social graph? What about work/life contacts leaking across boundaries I’d prefer they didn’t?

fwip 4y ago
The article doesn't really go into it, but most real life applications would not share every contact with every other contact. You can imagine a number of different solutions to this problem, but it's mostly a UX issue on how users would be most willing to share their contacts with others. Apps with different approaches could still share data with one another.
- zcw100 4y ago
  There's a link in there for it but it would be easy to miss that does a much better job of explaining the system http://www.skyhunter.com/marcs/petnames/IntroPetNames.html http://www.skyhunter.com/marcs/petnames/IntroPetNames.html A pentane system actually protects you from phishing attacks and you don't really share your pentanes. You can use your petname as a nickname when introducing a key to someone else. One of the most important parts is to have a good UI/UX that does not confuse nicknames with pentanes or allow you to accidentally accept a nickname as pentane that is confusingly close to an already existing petname. Nicknames are names that you propose using when introducing yourself or someone else. A pet name is the name you assign privately. So Lumberg could be a nickname but your petname might be "dickhead boss". You're free to introduce him to people you know either way you'd like.

wcerfgba 4y ago

So, /etc/hosts ?

pfraze 4y ago

Basically petnames change the addressing architecture from “one global mapping” to “many local mappings.” This means that petnames cannot be used as shared identifiers; you use a global UUID when you need to identify information between users. There are some contexts where this works great (the phone address book) and some where it doesn’t (Web URLs). In effect, if I wanted to drop a URL in this comment, the petname model requires that I use the UUID. You can share petnames with each other to help people, and you could publish petnames and do searches (but this creates trust questions - how do we verify a pet name is accurate?). It may be an entirely suitable approach, but it basically means there are no global short names. I can’t tell you Im at pfrazee dot com if there’s no global dot com registry.

infogulch 4y ago
So instead of having one global registry you have many local registries. If registries are also identified by UUID then you say pfraze dot com in the <registry uuid> registry. I like this because then you can have registries that correspond 1-1 with other real-life things that can be internally consistent without having to worry about global uniqueness, like a registry of all registered businesses in a state, or all trademarks, etc. The next step is to create a system for "peering agreements" between registries, or meta-registries.
- pfraze 4y ago
  You can, but any shared address book needs to have a very clear scope of applicability. Basically: any users that are communicating need to either share the same registry, or have some clear indication that they aren't in order to avoid significant mishaps. I'm not totally sure how you accomplish that.
  - kixiQu 4y ago
    <del>The federated approach would be the same way that we distinguish cooluser@gmail.com from cooluser@proton.me; in this case, the server part would just determine who you're asking to map cooluser to a UUID.</del> Actually, this is handled pretty clearly in the example article.

schanzen 4y ago

For our transitive use of petnames in name systems see also https://datatracker.ietf.org/doc/draft-schanzen-gns/ https://datatracker.ietf.org/doc/draft-schanzen-gns/ and https://www.gnunet.org/en/gns.html https://www.gnunet.org/en/gns.html

unixbane 4y ago

This version of petnames is too complicated. You can't get a good petname system without getting rid of broken crap first. Scanning a QR code on a flyer should be the sole introduction point and just lead to a secure communication from then on. Why do I want petnames for phone numbers or other insecure things? To put it differently, no petname system built on top of unix / web crap will ever be good. Everyone (like posters here) will not understand what they're doing and just write code that breaks it on all layers of the OS and GUIs. Guaranteed if Android starts using petnames more there will just be issues like it copies someone's petnames all over yours, shares the ones you didn't want to share, etc.

Zamiel_Snawley 4y ago
no petname system built on top of unix / web crap will ever be good. This claim is unsupported. If you have created or know of a better version of petnames, I'd love to hear about it.
- Schroedingersat 4y ago
  Introduce via a uuid represented as hex, psuedo-pronouncable syllables, or a barcode. Every uuid maps deterministically to an abstract avatar which can't be changed. It can be canonically 64 or 128 bits, but allow the user to see a 32 or even 24 bit visualisation if they please. If identities have significant cost (such as needing to subscribe to a provider or to be embedded in your local social graph) the smaller should suffice even as a default. Allow saving with whatever name you please to a list or using the target's name for themselves. Allow sending a contact with metadata including optionally the nickname Allow lists to be published, and whole lists to be saved as entries. Don't hide the uuid ever because that's condescending and introduces many vectors for bad things. People learned what phone numbers were, trust them to learn what a UUID is if you stop shifting the sand under them for a minute and hiding what is actually going on at every opportunity.

mlinksva 4y ago

I would guess this is being posted today because of https://news.ycombinator.com/item?id=32500151 https://news.ycombinator.com/item?id=32500151 by the same author, which is 2022.

vivegi 4y ago

In Hypertext you would say <a href="https://example.com/aresource">A resource</a> In essence the anchor text becomes the petname and is human readable while the href points to the URL of the resource referenced by the link described by the petname. If you want a name authority, use URLs. What you alias them to is up to you since only you use the alias. If you need the alias also to be globally unique, tough luck! Use URLs there as well (or invent new naming schemes and try to get them adopted).