Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Asymmetry of Internet Identity

crawshaw.io

Post reply on HN
Print view View original

11–20 of 40 posts

Re: The Asymmetry of Internet Identity

#11

Post by basch »

pwinnski wrote: post #6
basch wrote: post #3

Layer 5 belongs before Layer 4, its more like a half layer similar to IP vs MAC. OAuth is a way to communicate someones registered personhood securely. The last layer should be "Persona" and be about how people present their personality and behavior, having potentially multiple identities, characters, depending on the service, context, how much anonymity exists, etc and it would be akin to Layer 7 Applications, runni…

I can be name@mydomain.com without using "Inter-brand Identity protocols," so the layers seem to be in the right order to me.

name@mydomain.com would be layer 3 correct? using the oauth services of mydomain.com to authenticate yourself as name@mydomain.com should be layer 3.5, not layer 5. To me that comes before the "person" layer 4.

Re: The Asymmetry of Internet Identity

#12

Post by basch »

raxxorrax wrote: post #8

I don't necessarily want to rely on brands to use the jargon of the article to facilitate informational exchange. As a user I certainly am interested to exclude the brand wherever I can, because it is a security flaw and allows for countless attack vectors. I know about the current ambitions of identity providers and I make use of them because I am lazy too and don't know enough about security to match their services…

Institution may have been a better word than Brand.

Re: The Asymmetry of Internet Identity

#13

Post by Mathnerd314 »

The discussion leaves out account/identity recovery, which in practice is the most important part. You can use a PGP keypair as your identity, but if you lose access to it then you're screwed. So from an identity perspective the "brands" he mentions are a set of account recovery services of varying effectiveness, consisting of email, SMS, phone, and more complicated/unreliable methods like begging technical support.

At the end he mentions a statistical analysis in Mathematica and a text adventure in PHP. The second seems easy enough to share by just giving out an IP or using a dynamic DNS service. Mathematica is less clear, because it's proprietary, but it comes with a cloud subscription so presumably one would just upload it to the cloud. It's pointless to complain about a "brand" when the software itself is the brand.

And the last part where he talks about identifying people is also really simple. Everyone has a phone, so just using GPS narrows down the space to a few hundred, wherein one can use other methods like scrolling through the list. The hard part is doing it in a way doesn't allow user tracking, but that's a privacy rather than an identity issue.

Re: The Asymmetry of Internet Identity

#14

Post by gnode »

This article seems to present the state of the Internet as a kind of feudalism, where one must swear fealty to an established "brand", and carving out a life as a freeman is practically unattainable. I'd say the reality is that it's easy to join the Internet land-owning class (buy a domain; get a cert; run services), yet most people prefer to rent because they are not so inclined.

Email is widely used, HTTPS is widely used, and they don't require you use a gatekeeper brand. Many instant messaging platforms, while run by brands, allow you to bring your own email address as an identity.

I don't think authentication of identities is a feature that ties people to brands. A phone number is pseudonymous, and acts as an identity for many mobile messaging applications. Authentication in many cases is performed socially: you got the number from them, from a mutual friend, or they told you who they are and you were convinced.

Re: The Asymmetry of Internet Identity

#15

Post by VintageVibes »

I was surprised this post didn't even mention the existence or development around decentralized P2P technologies for identity management. We have the tech, it's mostly a problem of marketing and network effect. Large centralized brands like Google or Facebook are convenient active hubs of interconnected identities, but these centralized apps have the major downside of eventually leaking personal data that we don't want them too. Not to mention at some point it just gets so tiresome to create yet another account, for yet another brand. We need secure means to manage our own online identity in a way that can interoperate with all the brands out there with minimal risk.

Re: The Asymmetry of Internet Identity

#16

Post by JohnFen »

I think I get what the article is trying to say, but I have to admit that bringing in the concept of "brand" seriously derails it for me.

My identity is not a "brand", the identifiers I use online are not a "brand", and I don't interact with "brands". I interact with people.

What I'm not sure about is whether I'm just having a reaction to the use of the concept of "brand" that is obscuring a meaningful and accurate point for me.

Now that I've written all of this, though, I'm not sure that I understood what the article was trying to say at all.

EDIT: now that I've read it a couple of times, I'm pretty sure that I don't understand what it's really saying. Can someone explain like I'm five?

Re: The Asymmetry of Internet Identity

#17

Post by carapace »

There's a book, "Mystery of Capital", wherein the author points out is that in order for identity and contracts to work there has to be "something to lose" for the parties involved.

E.g. the power company can't supply power to slums not because of technical limits, but rather economic limits: because the residents don't have titles or leases or bank accounts there's no way to shut off the power to a household for non-payment. There's no leverage without paperwork.

It's relatively established how to do this IRL with deeds and titles and contracts and such. On the Internet it's not even clear that identity is possible to establish. Our computer systems leak like sieves and people get hacked all the time.

I was imagining just yesterday starting an MLM system based on reselling yubikeys and establishing a hardware-backed web-of-trust. I wouldn't even try to make it a pyramid: just resell the keys to your "downline" at wholesale plus the upline uh payment (I don't know the terminology.) Any infrastructure is provisioned by open bid and paid for by simple equal division among all current members. I would imagine it would amount to about a dollar or two per month per person at the very most, flat rate, not part of the MLM.

The whole point is to self-fund a hardware-backed p2p-IRL identity authentication network.

Re: The Asymmetry of Internet Identity

#18

Post by zokier »

Personally I think good identity system should have these properties:

* Identity provider should not see which services users authenticate to. Afaik this is now a major issue with current "Log in with X" systems

* Services should not be able to discover which other services user has authenticated to, i.e. the identity presented to service A should not be linkable to identity presented to service B

* Identities should be relatively stable. The identity presented to certain service at certain point in time should be the same identity presented to the same service in some other point of time.

* The system probably needs to be able to allow users to reveal additional information about their identity. This is problematic requirement because in wider use it is ripe for abuse by service providers

* Optionally it'd be nice if the system would have some facilities for offline usage, where neither user nor service needs to talk to identity provider.

This is fairly hairy problem, with many more concerns in the details and other people probably having different requirements. From a quick search, Credenticas (now MS) U-Prove system comes closest, but I haven't delved really into it to see if it actually matches my thoughts.

Re: The Asymmetry of Internet Identity

#19

Post by TeMPOraL »

JohnFen wrote: post #16

I think I get what the article is trying to say, but I have to admit that bringing in the concept of "brand" seriously derails it for me. My identity is not a "brand", the identifiers I use online are not a "brand", and I don't interact with "brands". I interact with people. What I'm not sure about is whether I'm just having a reaction to the use of the concept of "brand" that is obscuring a meaningful and accurate p…

Your on-line identity consists of one or more brands and associated brand-specific identifiers. For instance, to me right now, you're HN!JohnFen. HN, or news.ycombinator.com, is the brand. Right now I'm speaking to you also using HN brand, as HN!TeMPOraL. HN is the brand through which the communication happens. I can't use my Twitter!TeMPOraL_PL account to talk to you, because there's no transport between Twitter and HN. And even if it was, now two brands would be involved in communication.

If you think about it, you'll notice that there's no way you and me can ever talk with one another without a brand intermediary, unless we accidentally meet somewhere physically, or unless some direct connection details could be exchanged through a chain of our physical acquaintances (essentially performing an IP routing over meatspace social network).

Re: The Asymmetry of Internet Identity

#20

Post by JohnFen »

TeMPOraL wrote: post #19
JohnFen wrote: post #16

I think I get what the article is trying to say, but I have to admit that bringing in the concept of "brand" seriously derails it for me. My identity is not a "brand", the identifiers I use online are not a "brand", and I don't interact with "brands". I interact with people. What I'm not sure about is whether I'm just having a reaction to the use of the concept of "brand" that is obscuring a meaningful and accurate p…

Your on-line identity consists of one or more brands and associated brand-specific identifiers. For instance, to me right now, you're HN!JohnFen. HN, or news.ycombinator.com, is the brand. Right now I'm speaking to you also using HN brand, as HN!TeMPOraL. HN is the brand through which the communication happens. I can't use my Twitter!TeMPOraL_PL account to talk to you, because there's no transport between Twitter and…

I think I see what I was missing here -- he's talking about identity services, not actual identities. I see a large difference there.

In any case, thank you for helping to clear that up.

> If you think about it, you'll notice that there's no way you and me can ever talk with one another without a brand intermediary

I think that this is a matter of worldview or perspective. I don't see it that way at all, but I understand how others might.

The use of the term "brand" here is very confusing to me, as a brand is a constructed and projected image, not a solid thing. As another commenter here said, "institution" may be better. "Company" might be even better than that.

Post reply on HN