Is “acceptably non-dystopian” self-sovereign identity even possible?
blog.mollywhite.net
Is “acceptably non-dystopian” self-sovereign identity even possible?
1–10 of 295 posts
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#2How can identity be self-sovereign?
In the end, it boils down to everyone just asking to see the passport or some other government ID, or a proxy for that (credit card, library card, employee card).
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#3How can identity be self-sovereign? In the end, it boils down to everyone just asking to see the passport or some other government ID, or a proxy for that (credit card, library card, employee card).
The "web of trust" is the canonical example of "self-sovereign" identity: you publish your identity, others verify it, and (in theory) the "web" propagates through degrees of trust in peers.
The big problem there is that it doesn't scale beyond a small handful of people who know each other well and trust each other for a specific purpose. Cryptocurrency companies seem to be aware of this (and of the prominent historical record of failure associated with WoT), which might be why they perform remarkable contortions to avoid that phrase (see "web of verifications" in the article.)
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#4How can identity be self-sovereign? In the end, it boils down to everyone just asking to see the passport or some other government ID, or a proxy for that (credit card, library card, employee card).
Self-sovereign identity boils down to : you control a public key (you have the private key). Everything after that is some variant on : someone with another key can sign a message that means they believe something about your key. This turns out to be pretty much the same as X.509 from 30+ years ago, with the names of things changed and modern encoding schemes used for the messages.
In this context, much of what we think of as identity on the internet doesn't need a central authority because all most web sites know about you is that you're the same entity that originally created the account (usually implemented via your email address). But email tends to be favored by users because managing your own keys is problematic.
Be very skeptical of anyone who claims to have devised a decentralized sybil-resistant identity scheme.
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#5How can identity be self-sovereign? In the end, it boils down to everyone just asking to see the passport or some other government ID, or a proxy for that (credit card, library card, employee card).
The "web of trust" is the canonical example of "self-sovereign" identity: you publish your identity, others verify it, and (in theory) the "web" propagates through degrees of trust in peers. The big problem there is that it doesn't scale beyond a small handful of people who know each other well and trust each other for a specific purpose . Cryptocurrency companies seem to be aware of this (and of the prominent histor…
Putting crypto currency to one side, you are aware of the pgp 'strong set'? because six degrees of Kevin Bacon says a handful is a serious underestimate of how good transitive trust can be. The strong set is quite large.
That word "transitive" is a very important qualifier here: it's weaker than an absolute statement but hierarchical PKI turns out to be weaker than theory, in practice.
Crypto coins are trash. Signatures are not trash. Behaviour of people and systems performing signing including HSM operators are mutable and worrisome.
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#6How can identity be self-sovereign? In the end, it boils down to everyone just asking to see the passport or some other government ID, or a proxy for that (credit card, library card, employee card).
The "web of trust" is the canonical example of "self-sovereign" identity: you publish your identity, others verify it, and (in theory) the "web" propagates through degrees of trust in peers. The big problem there is that it doesn't scale beyond a small handful of people who know each other well and trust each other for a specific purpose . Cryptocurrency companies seem to be aware of this (and of the prominent histor…
I do think there is some potential in the idea of people proving they are at face-to-face events (signing each others' zero-knowledge tokens) and then timing/placing those events such that someone can't be in two places at once.
However, doing graph-based Sybil detection is already a hard problem[0], and trying to create an infallible algorithm that also works using homomorphic encryption is maybe pushing beyond the boundaries of known technology, unfortunately.
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#7To the author: please define acronyms the first time you use them.
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#8Earlier quoted context omitted.
The "web of trust" is the canonical example of "self-sovereign" identity: you publish your identity, others verify it, and (in theory) the "web" propagates through degrees of trust in peers. The big problem there is that it doesn't scale beyond a small handful of people who know each other well and trust each other for a specific purpose . Cryptocurrency companies seem to be aware of this (and of the prominent histor…
Putting crypto currency to one side, you are aware of the pgp 'strong set'? because six degrees of Kevin Bacon says a handful is a serious underestimate of how good transitive trust can be. The strong set is quite large. That word "transitive" is a very important qualifier here: it's weaker than an absolute statement but hierarchical PKI turns out to be weaker than theory, in practice. Crypto coins are trash. Signatu…
I'm aware of the strong set, but I was under the impression that it didn't accomplish much anymore -- GnuPG disabled SKS lookups a while back, in response to the network's inability to handle thousands of clearly malicious key attestations. The last major topological analysis I can find of the strong set was back in 2015, one year before the first series of spam attacks on SKS.
(But don't get me wrong: signatures are great! I'm just skeptical of the WoT, from multiple angles.)
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#9How can identity be self-sovereign? In the end, it boils down to everyone just asking to see the passport or some other government ID, or a proxy for that (credit card, library card, employee card).
I'm woefully underinformed. But SSI seems like some kind of next-gen adtech. Instead of scaring people about privacy we just convince people "it's safe - you are in control." Meanwhile you can now sell your privacy.
I hope someone less cynical can convince me it's a good idea.
Re: Is “acceptably non-dystopian” self-sovereign identity even possible?
#10How can identity be self-sovereign? In the end, it boils down to everyone just asking to see the passport or some other government ID, or a proxy for that (credit card, library card, employee card).
Crypto-currency nonsense aside, the article clearly goes into DIDs which is on its way to becoming a standard.
https://www.w3.org/TR/did-core/
> Decentralized identifiers (DIDs) are a new type of identifier that enables verifiable, decentralized digital identity. A DID refers to any subject (e.g., a person, organization, thing, data model, abstract entity, etc.) as determined by the controller of the DID. In contrast to typical, federated identifiers, DIDs have been designed so that they may be decoupled from centralized registries, identity providers, and certificate authorities. Specifically, while other parties might be used to help enable the discovery of information related to a DID, the design enables the controller of a DID to prove control over it without requiring permission from any other party. DIDs are URIs that associate a DID subject with a DID document allowing trustable interactions associated with that subject.