5 ms·

As I see it, the problem is that the email address has been conflated with your identity, and that is extremely problematic. It should only ever have been a som

As I see it, the problem is that the email address has been conflated with your identity, and that is extremely problematic. It should only ever have been a somewhat transient reachability identifier. As an identity it then gets linked to concepts like authorization and trust, eg "we'll send this code to your email, because we implicitly trust that only you can see your email, and that youll always be able to get to it." Every so often one sees a cri de coeur from someone who has learned this lesson the hard way when Google locks them out of their account, the key to their digital life evaporates, there's nothing they can do about it. Alternative identifiers exist, eg handles on sites like HN, but they are second-order artifacts of the email as ID. Given the stakes, then, you have to decide whether to try and control your identity by bulding your own infra for email (domain, mail server, dkim etc and a fair bit of hell), paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail, or letting Google or Microsoft control it and hoping you dont fall foul of them. All these options have drawbacks. Side musing follows: I dont know what the solution to identity is on the Internet. A very long time ago, X.509 certs issued by quasi government authorities was mooted as part of a international directory system. I can see a future authoritarian state falling in love with this idea again, esp with the resulting lack of anonymity,..but also the ability to "kill" people on the Internet simply by revoking their cert.

thoi4234234234 1y ago
Not just email - today it's almost impossible to have a decent life without a (smart) phone and being tied-in through OTP verification. All these things have become so essential that it's shocking that it's not regulated like a utility (or even as a right given their systemic imposition).
- brewdad 1y ago
  OTP verification can largely be worked around because so many sites still use SMS codes which a dumb phone can handle. Similarly, 2FA codes can be handled on a PC without requiring a smart phone. It adds hurdles but can be done. Where it becomes challenging is situations where smart phones truly are required. When I attended college football games last fall, all tickets were e-tickets. You were required to present a QR code on your device or your ticket stored in Apple Wallet or Google Wallet. I ran into the same situation with my local theater's ticketing. You haven't lived until you've witnessed an audience with an average age of 70 try to figure out their tickets on their smartphones when they've never used them for that before nor had any notion that was even POSSIBLE.
  - mr_mitm 1y ago
    I don't understand why client certificates aren't way more common as a second factor. They have existed forever, are available on all platforms, they are phishing resistant (unlike OTP, and don't get me started on SMS), browsers or OSs could generate them during setup, and you could enroll them seamlessly with one click. Instead we had to invent new things like passkeys which do essentially the same thing. You can use client certificates even with IMAP and SMTP.
    - nabeards 1y ago
      Client certs were amazing, wholeheartedly agree! I see you are suffering from something that always happened to me when championing them: they were so unknown that people assumed you meant PGP…sigh.
    - Max_aaa 1y ago
      The main reason that PGP did not catch on, as only the most tech savy were able to understand how the chain worked.
      - mr_mitm 1y ago
        Okay, I know that and I agree, but I wasn't talking about PGP. Client certificates are much easier to use. They can be self-signed and the whole trust issue disappears.
    - poincaredisk 1y ago
      >they are phishing resistant But can be easily stolen by malware (unless someone adds a client cert OS support? intriguing idea). But so can passkeys stored on the same device, so I don't know. Long time ago browsers even had a widget to generate client certs natively! But it was removed, probably because of lack of use.
      - mr_mitm 1y ago
        All is lost the moment you have malware on your device. It can just steal the session key after authentication.
flexagoon 1y ago
If you don't want to link your email and your identity, you can use aliasing services like SimpleLogin. I have a separate email alias for every account, such as hackernews.ci72j@slmail.me, and only use my personal email for personal communications.
- hnb2137 1y ago
  Until slmail.me disappears and all your logins stop working and can no longer be changed.
ssivark 1y ago
> Side musing follows: I dont know what the solution to identity is on the Internet. I was fond of how Keybase brought to life [1] identity proofs (linking and validating your different online identities) in a very easy to use platform. Pity it went away; feels like a loss for the internet. [1] https://news.ycombinator.com/item?id=7453360 https://news.ycombinator.com/item?id=7453360
- brewdad 1y ago
  Right, but I want to validate my identity for cases where it is important to me. I also want to prevent others from assuming my identity in cases where it doesn't really matter (until it does). My identity here is not the same identity use on Reddit. At the same time being erroneously linked to someone else's posts on Reddit because they use this username could be a real problem. At he same time, I don't necessarily want my posts here to be linked to posts at Reddit or X or wherever. Rinse and repeat across thousands of web sites. It's a problem with no easy solutions. In part, because no two users want exactly the same solution.
  - genewitch 1y ago
    For example, I always use email login, never a phone number or Github or Facebag, and I barely have a presence on Google's panopticon, so never with my Google account. If a site demands it I just don't use it. I also pay Fastmail to host my domain email, so that really helped get off Google. Yeah I gotta remember to renew every 10 years or whatever, plus $15/yr for fastmail; but what's the other option, I learn some SMTP package? No thanks.
  - sfn42 1y ago
    In Norway we have multiple national id providers. The banks have one called BankID which is what I mostly use, but there are other alternatives. These can be used somewhat interchangeably across different applications like my online bank, tax website, healthcare website, investment platforms, pretty much everything. I can also use it to sign contracts. It's pretty sweet.
radium3d 1y ago
All you mentioned are better than the SSN
EbNar 1y ago
You don't need to reinvent the wheel to have a "somewhat safe email". Just own a personal domain and host it on migadu, mailcheap, mxroute, Zoho or any other provider.
- pembrook 1y ago
  Yep, you own your domain, you own your mailbox and can take it with you anywhere once a service gets bad or dies. The real problem comes when your email address is owned by someone else (eg. @gmail.com). That’s the definition of lock-in.
  - thombles 1y ago
    The lock-in does have the bonus that it's practically impossible for someone else to take over your email address. Forgetting to update your credit card for renewal, long term afk/coma, death etc. are all issues with having your own domain and I decided to move away from that model.
    - poincaredisk 1y ago
      It's the other way around in my opinion. With your own domain you own your identity. By ceding it to someone else you risk losing it at a whim of some algorithm or bot or by forgetting password, or getting locked out for some other reason.
      - tsimionescu 1y ago
        The problem is that you can't own a domain, you only lease it for a limited time. If you fail to pay the lease, you automatically lose it, and someone else can automatically get it, and there's nothing you can do about it. Domain names are worse than email providers from this point of view, since even if you lose your Gmail account, Google will typically not give it out to someone else, at least for some time.
        bell-cot 1y ago
sshine 1y ago
> paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail I don’t experience them doing that. They’re email companies going strong. Maybe they get sold in some decades, and you move on. But I’ve had FastMail for one decade now, and it’s remained the same throughout. Including the minor UI bugs in their email client. But I’d much rather live with those than suddenly they’re also an AI company.
BrtByte 1y ago
The question is: can we build a decentralized identity layer that's actually usable and respects privacy?
- idkfasayer 1y ago
  [dead]

thoi4234234234 1y ago

Not just email - today it's almost impossible to have a decent life without a (smart) phone and being tied-in through OTP verification. All these things have become so essential that it's shocking that it's not regulated like a utility (or even as a right given their systemic imposition).

brewdad 1y ago
OTP verification can largely be worked around because so many sites still use SMS codes which a dumb phone can handle. Similarly, 2FA codes can be handled on a PC without requiring a smart phone. It adds hurdles but can be done. Where it becomes challenging is situations where smart phones truly are required. When I attended college football games last fall, all tickets were e-tickets. You were required to present a QR code on your device or your ticket stored in Apple Wallet or Google Wallet. I ran into the same situation with my local theater's ticketing. You haven't lived until you've witnessed an audience with an average age of 70 try to figure out their tickets on their smartphones when they've never used them for that before nor had any notion that was even POSSIBLE.
- mr_mitm 1y ago
  I don't understand why client certificates aren't way more common as a second factor. They have existed forever, are available on all platforms, they are phishing resistant (unlike OTP, and don't get me started on SMS), browsers or OSs could generate them during setup, and you could enroll them seamlessly with one click. Instead we had to invent new things like passkeys which do essentially the same thing. You can use client certificates even with IMAP and SMTP.
  - nabeards 1y ago
    Client certs were amazing, wholeheartedly agree! I see you are suffering from something that always happened to me when championing them: they were so unknown that people assumed you meant PGP…sigh.
  - Max_aaa 1y ago
    The main reason that PGP did not catch on, as only the most tech savy were able to understand how the chain worked.
    - mr_mitm 1y ago
      Okay, I know that and I agree, but I wasn't talking about PGP. Client certificates are much easier to use. They can be self-signed and the whole trust issue disappears.
  - poincaredisk 1y ago
    >they are phishing resistant But can be easily stolen by malware (unless someone adds a client cert OS support? intriguing idea). But so can passkeys stored on the same device, so I don't know. Long time ago browsers even had a widget to generate client certs natively! But it was removed, probably because of lack of use.
    - mr_mitm 1y ago
      All is lost the moment you have malware on your device. It can just steal the session key after authentication.

flexagoon 1y ago

If you don't want to link your email and your identity, you can use aliasing services like SimpleLogin. I have a separate email alias for every account, such as hackernews.ci72j@slmail.me, and only use my personal email for personal communications.

hnb2137 1y ago
Until slmail.me disappears and all your logins stop working and can no longer be changed.

ssivark 1y ago

> Side musing follows: I dont know what the solution to identity is on the Internet. I was fond of how Keybase brought to life [1] identity proofs (linking and validating your different online identities) in a very easy to use platform. Pity it went away; feels like a loss for the internet. [1] https://news.ycombinator.com/item?id=7453360 https://news.ycombinator.com/item?id=7453360

brewdad 1y ago
Right, but I want to validate my identity for cases where it is important to me. I also want to prevent others from assuming my identity in cases where it doesn't really matter (until it does). My identity here is not the same identity use on Reddit. At the same time being erroneously linked to someone else's posts on Reddit because they use this username could be a real problem. At he same time, I don't necessarily want my posts here to be linked to posts at Reddit or X or wherever. Rinse and repeat across thousands of web sites. It's a problem with no easy solutions. In part, because no two users want exactly the same solution.
- genewitch 1y ago
  For example, I always use email login, never a phone number or Github or Facebag, and I barely have a presence on Google's panopticon, so never with my Google account. If a site demands it I just don't use it. I also pay Fastmail to host my domain email, so that really helped get off Google. Yeah I gotta remember to renew every 10 years or whatever, plus $15/yr for fastmail; but what's the other option, I learn some SMTP package? No thanks.
- sfn42 1y ago
  In Norway we have multiple national id providers. The banks have one called BankID which is what I mostly use, but there are other alternatives. These can be used somewhat interchangeably across different applications like my online bank, tax website, healthcare website, investment platforms, pretty much everything. I can also use it to sign contracts. It's pretty sweet.

radium3d 1y ago

All you mentioned are better than the SSN

EbNar 1y ago

You don't need to reinvent the wheel to have a "somewhat safe email". Just own a personal domain and host it on migadu, mailcheap, mxroute, Zoho or any other provider.

pembrook 1y ago
Yep, you own your domain, you own your mailbox and can take it with you anywhere once a service gets bad or dies. The real problem comes when your email address is owned by someone else (eg. @gmail.com). That’s the definition of lock-in.
- thombles 1y ago
  The lock-in does have the bonus that it's practically impossible for someone else to take over your email address. Forgetting to update your credit card for renewal, long term afk/coma, death etc. are all issues with having your own domain and I decided to move away from that model.
  - poincaredisk 1y ago
    It's the other way around in my opinion. With your own domain you own your identity. By ceding it to someone else you risk losing it at a whim of some algorithm or bot or by forgetting password, or getting locked out for some other reason.
    - tsimionescu 1y ago
      The problem is that you can't own a domain, you only lease it for a limited time. If you fail to pay the lease, you automatically lose it, and someone else can automatically get it, and there's nothing you can do about it. Domain names are worse than email providers from this point of view, since even if you lose your Gmail account, Google will typically not give it out to someone else, at least for some time.
      - bell-cot 1y ago

sshine 1y ago

> paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail I don’t experience them doing that. They’re email companies going strong. Maybe they get sold in some decades, and you move on. But I’ve had FastMail for one decade now, and it’s remained the same throughout. Including the minor UI bugs in their email client. But I’d much rather live with those than suddenly they’re also an AI company.

BrtByte 1y ago

The question is: can we build a decentralized identity layer that's actually usable and respects privacy?

idkfasayer 1y ago
[dead]