Live data from Hacker News

Using blockchain for identity management is mostly ridiculous

blog.xot.nl

41–49 of 49 posts

Re: Using blockchain for identity management is mostly ridiculous

#41
post #2

Using blockchain for $x is (mostly) ridiculous

The best litmus test I have seen is "Are double spends a problem in your architecture?" If not you probably don't need a blockchain.

The best litmus test is "is telling which document was earlier helping in anything?", because this is precisely what blockchain is solving.

Re: Using blockchain for identity management is mostly ridiculous

#42
post #29

Earlier quoted context omitted.

You can still measure the total amount of hashpower applied. Someone could add arbitrarily many blocks but you can calculate how much it cost for them to do it.

So? Without competition for time it's pretty easy to make quite long blockchains. It's the competition for time that makes the mining reliable right now.

The competition works by increasing the difficulty. At any given time there's a maximum numerical value of the block hash; the lower it is, the more hashes you have to make before you find a valid one.

The difficulty can be checked after the fact, by simply checking the numerical values of hashes. If a hash is one in a trillion, you know it took about a trillion attempts on average to make it, and you can figure out the economic cost of doing that.

It would be easy to make a chain with lots of blocks of low difficulty. It would also be easy for anyone to see that it didn't cost much to make it.

Re: Using blockchain for identity management is mostly ridiculous

#43
post #23

The original article was based on fundamental misunderstandings of Blockcerts, but the follow-up Blockcerts community discussion (including the article's author) was productive: http://community.blockcerts.org/t/response-to-blockchain-blo...

Including the response of JHH in the comments again.

Re: Using blockchain for identity management is mostly ridiculous

#44
post #25

Earlier quoted context omitted.

You're basically specifiying PKI, not anything to do with Blockchain. If you truly want the timestamps to "lock in" the time of a transaction without trusting either party, a hash-commitment could be used, akin to https://opentimestamps.org/ .

A blockchain seems like a very reasonable way to provide a distributed immutable log of actions that take place within a PKI infrastructure. It even adds the ability for 3rd party auditors to participate in the system in a real-time manner. You might even extend it, so that instead of it being PKI with a blockchain transport, to something more akin to Kerberos with a blockchain transport -- every attempt, successful…

Cert Transparency is an effort on that front: https://www.certificate-transparency.org/faq, and it works without a blockchain.

Re: Using blockchain for identity management is mostly ridiculous

#45
post #28
post #22

Earlier quoted context omitted.

> scan a fingerprint (to establish identity) > annually update information about themselves onto the blockchain (how?) What could possibly go wrong? Fingerprints alone should not be used as a key.

I don't mean using the fingerprint as a key. I mean that if you can produce a fingerprint image corresponding to a blockchain hash and it matches your fingerprint 20 years later, and this is linked to 20 years worth of blockchain recorded credential information, I would find that very compelling evidence that you are who you say you are.

What you described is identical to a key

Re: Using blockchain for identity management is mostly ridiculous

#46
post #37
post #30

Earlier quoted context omitted.

Is there a preference for the term ‘third-world’ to ‘developing nation’

:shrug: don't care

"Developing" (or less euphemistically, "poor") is better because "3rd world" has specific cold-war related connotations that are less and less relevant as time goes on - eg, a poor former soviet bloc country wouldn't be "3rd world" as some people understand the term.

Re: Using blockchain for identity management is mostly ridiculous

#47
post #2

Using blockchain for $x is (mostly) ridiculous

The best litmus test I have seen is "Are double spends a problem in your architecture?" If not you probably don't need a blockchain.

The use-case here is a decentralized mechanism for providing (at least approximately) validated timestamps, which it seems to me a blockchain can do.

Re: Using blockchain for identity management is mostly ridiculous

#48
post #25

Earlier quoted context omitted.

A blockchain seems like a very reasonable way to provide a distributed immutable log of actions that take place within a PKI infrastructure. It even adds the ability for 3rd party auditors to participate in the system in a real-time manner. You might even extend it, so that instead of it being PKI with a blockchain transport, to something more akin to Kerberos with a blockchain transport -- every attempt, successful…

Cert Transparency is an effort on that front: https://www.certificate-transparency.org/faq , and it works without a blockchain.

Cert Transparency depends on our benevolent lord Google to maintain the integrity of the log. Using a blockchain pushes that trust model out such that it's distributed across multiple actors.

There's nothing wrong with CT -- it's a great step in the right direction. There's also nothing wrong with exploring distributed immutable logging.

Re: Using blockchain for identity management is mostly ridiculous

#49
post #41

Earlier quoted context omitted.

The best litmus test I have seen is "Are double spends a problem in your architecture?" If not you probably don't need a blockchain.

The best litmus test is "is telling which document was earlier helping in anything?", because this is precisely what blockchain is solving.

Fair enough
Post reply on HN