11–20 of 46 posts
I'm confused how this works. I tried the demo and Bitwarden asked me if I wanted to save the passkey. From a UX experience, this felt weird.. Why do I need to create an account, and save that account? Why is passkey storage prevent bots? Just that bots haven't added that automation yet?
I know the concerns.
I no longer care. The benefits outweight the costs, imho. I want to be able to tell a site "yes I'm Martin here's proof either ban me or let me in but stop making me jump through hoops to prove ID.
And so that social sites I use will no longer have to deal with undesired non-unique accounts for bot swarms and sockpuppets and the like.
The political usefulness of swarms of bots and sockpuppets is why I have conspiracy theories about the conspiracy theories about digital ID.
I’m sure there are a few contenders in the space but one I’m aware of is [worldcoin](https://world.org/)
Honestly I just want government backed digital ID for this stuff. I know the concerns. I no longer care. The benefits outweight the costs, imho. I want to be able to tell a site "yes I'm Martin here's proof either ban me or let me in but stop making me jump through hoops to prove ID. And so that social sites I use will no longer have to deal with undesired non-unique accounts for bot swarms and sockpuppets and the li…
Here are two of my own, just to join in:
1. Social credit score system. We should all be able to point our phone at antisocial behavior and damage their score. Until then there's pretty much zero recourse against people who have hostile social behaviors that don't commit a crime (like arguing with the McDonalds employee or causing a scene when someone asks them to turn down their music on the bus). People hate on "Karens" but they're actually our last remaining line of defense against these people.
2. As soon as you get on a public road, the government should have dystopian-level control over your car. You can't speed. You can't run a red light (or it will be video recorded and you'll be insta-billed). When there's a wreck, the camera feed in all nearby vehicles is auto-uploaded to the net so all parties can see what happened, no fuss. Break the rules a few times? That's fine, you get your government issued tiny zip car for a year and we'll see if you can respect the shared roads after that. And, of course, alcohol breath analysis to drive.
Honestly I just want government backed digital ID for this stuff. I know the concerns. I no longer care. The benefits outweight the costs, imho. I want to be able to tell a site "yes I'm Martin here's proof either ban me or let me in but stop making me jump through hoops to prove ID. And so that social sites I use will no longer have to deal with undesired non-unique accounts for bot swarms and sockpuppets and the li…
https://github.com/openpassport-org/openpassport
I don't have any strong view either way on the government ID verification for online services. At least in theory though, the concept of partial/selective disclosure of passport data seems to be a good middle ground between proving humanity and maintaining privacy.
Honestly I just want government backed digital ID for this stuff. I know the concerns. I no longer care. The benefits outweight the costs, imho. I want to be able to tell a site "yes I'm Martin here's proof either ban me or let me in but stop making me jump through hoops to prove ID. And so that social sites I use will no longer have to deal with undesired non-unique accounts for bot swarms and sockpuppets and the li…
Props for sharing what's probably a ubiquitously hated opinion on HN. Here are two of my own, just to join in: 1. Social credit score system. We should all be able to point our phone at antisocial behavior and damage their score. Until then there's pretty much zero recourse against people who have hostile social behaviors that don't commit a crime (like arguing with the McDonalds employee or causing a scene when some…
This is neither a new idea or a good one. Cloudflare did a PR launch of pretty much the same thing a few years back, and that you haven't actually seen it in the wild probably tells you all you need to know about how useful it is. Webauthn is not an integrity attestation; it doesn't tell you anything about how trustworthy the client is. Nor is it a uniqueness attestation; an attacker can mint an arbitrary number of d…
so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc
for yubikeys the attestation signing certificate is shared between devices, but this number is limited
so you could rate limit... just it would be a horrible experience when you are limited
As other commenters have said, a better solution needs to be something that is prohibitively difficult for bots to mint. I’m sure there are a few contenders in the space but one I’m aware of is [worldcoin]( https://world.org/ )
https://d1sr9z1pdl3mb7.cloudfront.net/wp-content/uploads/202...
This is neither a new idea or a good one. Cloudflare did a PR launch of pretty much the same thing a few years back, and that you haven't actually seen it in the wild probably tells you all you need to know about how useful it is. Webauthn is not an integrity attestation; it doesn't tell you anything about how trustworthy the client is. Nor is it a uniqueness attestation; an attacker can mint an arbitrary number of d…
there is attestation of the registration device in webauthn so you can tell that a token was signed by an official yubikey, apple secure enclave, tpm, etc for yubikeys the attestation signing certificate is shared between devices, but this number is limited so you could rate limit... just it would be a horrible experience when you are limited
Earlier quoted context omitted.
Yeah, the notably missing part in README is "how this works".
What I'm scared of is some sort of cryptography becoming the death of the open web. Baking keys into your hardware and doing remote attestation. It doesn't tie you to a real-world identity except that you're locked into using an unrooted (DRM'd) device for using online services like a normal person If I had to choose between two evils, I'd rather upload my passport to cloudflare and be able to get anonymous tokens fr…
The worst part will probably be that any hardware backed attestation mechanism will need to blacklist entire ranges of devices once scrapers and other bots find a mechanism to mass produce attestation results, the same way a dumped key from a bluray player carries the risk of killing all future bluray player functionality from devices with that model.
WebAuthn is pretty useless for this purpose as far as my understanding of it goes (as you can pretty much emulate all of it, except if the website has a hardware whitelist that'll eventually block a lot of legitimate users as well). It's harder to bypass remote attestation mechanisms, though, as they're actually meant to provide security against bots.
