Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keyoxide: A privacy-friendly platform to establish your decentralized identity

codeberg.org

Post reply on HN
Print view View original

11–20 of 60 posts

Re: Keyoxide: A privacy-friendly platform to establish your decentralized identity

#11

Post by Jtsummers »

woah wrote: post #10
lutoma wrote: post #7

Earlier quoted context omitted.

I'm not OP, but feel similarly about Keybase. When it originally launched, it marketed itself as directory where you could link your social accounts using cryptographic proofs, so that anyone who was wondering if "@lutoma" on twitter and "lutoma" on Hacker News are the same person could easily check. I.e. pretty much what Keyoxide now seems to aim to do. Simple enough and reasonably useful. But then at some point the…

Seems like the problem is that their core service simply did not make any money

They never charged. People were willing to pay, but they never offered a for fee service.

Re: Keyoxide: A privacy-friendly platform to establish your decentralized identity

#12

Post by dane-pgp »

greenail wrote: post #8

I really like the general idea of decentralized identity. Personally I'd prefer to keep my identities on different apps/platforms mostly (99%) separate. It seems to me that giving an adversary a map (especially usernames and email identities) of your online presence is a bad idea especially if they get access to one account and get some private details they may be able to use to socially engineer their way into other…

I'm not sure what the best implementation of decentralized identity is (although proof-of-personhood systems like BrightID seem interesting[0]), but ideally the different platforms would cryptographically sign statements for you like "This user has a positive reputation on our platform" which you can disclose to other platforms without them being able to learn your username on the original platform.

[0] https://www.brightid.org/

Re: Keyoxide: A privacy-friendly platform to establish your decentralized identity

#13

Post by forgotmypw17 »

na85 wrote: post #6

It'd be cool to see this without PGP. Signatures via signify/minisign are superior in every way.

Excuse me, but does your alternative provide toolchains and user interfaces for every major platform in existence today, including Mac, *nix, iOS, Android, Windows, a library for every major language in existence, and 25 years of attempts to break it?

If not, I don't see how you can claim it is superior in every way, because here are at least two ways in which PGP/GPG are by far superior.

Re: Keyoxide: A privacy-friendly platform to establish your decentralized identity

#14

Post by robinhoodsghost »

georgyo wrote: post #9
na85 wrote: post #6

It'd be cool to see this without PGP. Signatures via signify/minisign are superior in every way.

> are superior in every way. Besides the fact that a signify/minisign are a raw key instead of being padded with identity information, in what way are they actually better? Similarly, minisign makes no claims at identity at all. You get a random string, and the user is responsible for knowing which key is for what user. The minisign public key contains nothing but the key. To me, that is a horrible user experience. A…

Nah troll baiting is saying "PGP tools are installed nearly everywhere (except windows) by default" when windows still has almost 80% market share on PCs. Most of the rest are on macos. If you want something to be useful that relies on network effects then they, and mobile users are who you need to accommodate. Linux on the desktop users are a rounding error.

Re: Keyoxide: A privacy-friendly platform to establish your decentralized identity

#15

Post by na85 »

forgotmypw17 wrote: post #13
na85 wrote: post #6

It'd be cool to see this without PGP. Signatures via signify/minisign are superior in every way.

Excuse me, but does your alternative provide toolchains and user interfaces for every major platform in existence today, including Mac, *nix, iOS, Android, Windows, a library for every major language in existence, and 25 years of attempts to break it? If not, I don't see how you can claim it is superior in every way, because here are at least two ways in which PGP/GPG are by far superior.

I dunno about windows but minisign is on Mac and Linux, yes.

As for 25 years to break it, well, go look at CVEs for GnuPG. There have been many.

Re: Keyoxide: A privacy-friendly platform to establish your decentralized identity

#17

Post by selfhoster11 »

na85 wrote: post #6

It'd be cool to see this without PGP. Signatures via signify/minisign are superior in every way.

PGP/GPG has much broader adoption, and is not fundamentally broken as a standard. It's also what people are used to. I don't know what to do with a minisign key.

Re: Keyoxide: A privacy-friendly platform to establish your decentralized identity

#18

Post by forgotmypw17 »

na85 wrote: post #15
forgotmypw17 wrote: post #13

Earlier quoted context omitted.

Excuse me, but does your alternative provide toolchains and user interfaces for every major platform in existence today, including Mac, *nix, iOS, Android, Windows, a library for every major language in existence, and 25 years of attempts to break it? If not, I don't see how you can claim it is superior in every way, because here are at least two ways in which PGP/GPG are by far superior.

I dunno about windows but minisign is on Mac and Linux, yes. As for 25 years to break it, well, go look at CVEs for GnuPG. There have been many.

The algorithms still stand 25 years later.

Is it also available for iOS and Android? FreeBSD?

Are there libraries for Perl and PHP?

Re: Keyoxide: A privacy-friendly platform to establish your decentralized identity

#19

Post by crosser »

Would the following be functionally equivalent?:

- on each platform, include your pgp key id in the "bio"/"about" of your profile

- in your pgp key, include your profile URLs on each platform as an identity.

(In DNS, CERT RR exists for this purpose already.)

Post reply on HN