2 ms·

The minute you introduce the concept of "key pair", you've lost 99% of people.

by toyg 3y ago

lyu07282 3y ago
True, but you might be able to store it/hide it away in some DHT behind a username and passphrase, even that might not be necessary. You can solve a lot of complexity in the protocol by good frontend people who understand UX. Even Whatsapp is using PKI, its just all hidden away from the user.
- nickorlow 3y ago
  Yeah, Apple's passkeys is trying to do this too. Their UX is good but it's still pretty immature
DANmode 3y ago
I think this is the decade this problem goes away. Of course, the phrase that gains traction won't be "keypair".
- tsimionescu 3y ago
  Holding a private key in a way that is both usable and secure is not easy, for fundamental reasons. As such, it is impossible for this to catch on with the general public, ever. A far mor likely outcome is for government-managed identities to become the only way to access certain kinds of services, for better and for worse. Governments already have the identity management part handled, with the legal system acting as the ultimate fall-back for any corner case. The integration is already widely used for certain services (the entire financial system relies on government-managed identities already, all around the world), so it's just a matter of extending this. It also helps solve certain less talked about problems of identity systems, such as preventing children from accessing certain kinds of content. Ideally, instead of the current solution of every institution having access to all of your personal details so they can check your identity with the government, governments could start working for the opposite model - a government-issued and managed IdP, where only the government knows your personal details, and where enterprises get an opaque token they can use to ask the government about a set of details they need to operate their business.
pessimizer 3y ago
They managed to sell cryptocurrencies by proxy; maybe somebody else holds your keys, and you log in using a traditional method to have that provider use the keys where they are needed or rotate and update them when you want them rotated and need to broadcast that fact. And people who can handle it themselves, handle it themselves.

The minute you introduce the concept of "key pair", you've lost 99% of people.

by toyg 3y ago

The minute you introduce the concept of "key pair", you've lost 99% of people.

True, but you might be able to store it/hide it away in some DHT behind a username and passphrase, even that might not be necessary. You can solve a lot of complexity in the protocol by good frontend people who understand UX. Even Whatsapp is using PKI, its just all hidden away from the user.

nickorlow 3y ago
Yeah, Apple's passkeys is trying to do this too. Their UX is good but it's still pretty immature

DANmode 3y ago

I think this is the decade this problem goes away. Of course, the phrase that gains traction won't be "keypair".

tsimionescu 3y ago
Holding a private key in a way that is both usable and secure is not easy, for fundamental reasons. As such, it is impossible for this to catch on with the general public, ever. A far mor likely outcome is for government-managed identities to become the only way to access certain kinds of services, for better and for worse. Governments already have the identity management part handled, with the legal system acting as the ultimate fall-back for any corner case. The integration is already widely used for certain services (the entire financial system relies on government-managed identities already, all around the world), so it's just a matter of extending this. It also helps solve certain less talked about problems of identity systems, such as preventing children from accessing certain kinds of content. Ideally, instead of the current solution of every institution having access to all of your personal details so they can check your identity with the government, governments could start working for the opposite model - a government-issued and managed IdP, where only the government knows your personal details, and where enterprises get an opaque token they can use to ask the government about a set of details they need to operate their business.

pessimizer 3y ago

They managed to sell cryptocurrencies by proxy; maybe somebody else holds your keys, and you log in using a traditional method to have that provider use the keys where they are needed or rotate and update them when you want them rotated and need to broadcast that fact. And people who can handle it themselves, handle it themselves.