Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is “acceptably non-dystopian” self-sovereign identity even possible?

blog.mollywhite.net

Post reply on HN
Print view View original

81–90 of 295 posts

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#81

Post by rglullis »

DanHulton wrote: post #72
hGkXBvR wrote: post #64

Earlier quoted context omitted.

You fall into the same trap that the parent commenter points out. Rarely does a serious web3 project aim to put everything on a blockchain. But something like a Kickstarter-ish crowdfund system could be using a blockchain contract to handle funding and escrow, while the rest of the website is hosted in a standard web2 way. Suddenly it’s a “web3 project” where users are able to interact with and even own records in th…

Not the parent's objection, rather my own, but how many times has this been tried already, only to hit predictable and easily avoidable issues, if only you'd been using fiat? Like for example, the crypto kickstarter that tried to buy a copy of the constitution? Nevermind the fact that the geniuses in charge didn't realize this didn't give them merchandising rights, when the bid failed, returning the money was a legit…

It only works in places where the institutions are functional, which is something that you are taking from granted.

But forget kickstarter. We are talking about identity. Tell me how you could implement, e.g, a twitter-like application where no single entity can kick you out. Assume that the data does not need to live in a blockchain, and each user's data is portable between different servers. The only thing a (willing) server needs to have is a way to authenticate your identity. How would you do that without blockchain?

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#82

Post by strogonoff »

The problem I have with blockchain enthusiasts, after talking with them about their philosophy, is that they seem to consider trust a bug, and believe that ideal world is achievable with straitjackets of technical solutions that eliminate trust.

Trust is a feature, not a bug. If trust is violated by rogue agents, it is because they exist[0], not because trust itself is a folly.

However, blockchain-adjacent initiatives seem to suggest a future where we implicitly label[1] every human as motivated to hurt another by making all aspects of their activities subject to verification checks.

In addition to strong dystopian vibes, won’t this act of labeling everyone as potential threat actually be instrumental in bringing this motivation to everyone, making it a self-fulfilling prophecy? Aren’t we sort of codifying malicious intent, instead of trying to remove it from the equation? Whom would this serve?

There is place for verification in the interim, such as maintaining security of your home, but if we are looking ahead (as blockchain enthusiasts do) we should strive for a future where humans are not motivated to hurt other humans. Not treating it as some sort of default is a good start.

[0] Their core motivation to benefit at others’ expense is to me indicative of mental health issues, possibly caused by insecurity and upbringing trauma.

[1] https://en.m.wikipedia.org/wiki/Labeling_theory

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#83

Post by davidgerard »

hGkXBvR wrote: post #68

There are two interesting aspects of self-sovereign identity that are not worth hand-waiving away as dystopian: - it provides identity tools that use standards that span across geographical and platform boundaries. this is a different form of “user account” than say an online Amazon or NYStateGov account. it is good to have an option on the web for auth and identity that is detached from any single corporate entity o…

"can" is doing all the work there. If it isn't please show me a SSI system that uses zksnarks in production.

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#84

Post by justincormack »

dane-pgp wrote: post #6
woodruffw wrote: post #3

Earlier quoted context omitted.

The "web of trust" is the canonical example of "self-sovereign" identity: you publish your identity, others verify it, and (in theory) the "web" propagates through degrees of trust in peers. The big problem there is that it doesn't scale beyond a small handful of people who know each other well and trust each other for a specific purpose . Cryptocurrency companies seem to be aware of this (and of the prominent histor…

I do think there is some potential in the idea of people proving they are at face-to-face events (signing each others' zero-knowledge tokens) and then timing/placing those events such that someone can't be in two places at once. However, doing graph-based Sybil detection is already a hard problem[0], and trying to create an infallible algorithm that also works using homomorphic encryption is maybe pushing beyond the…

It would still be easy to have more tokens than people in this setup, you could choose which of your tokens to present, or pass some tokens around. So it is hard to guarantee there is a 1:1 correspondance. Which could be a good thing, but also doesn't work for some of the cases that want 1:1, like giving people a universal basic income where you don't want them to create fake people.

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#85

Post by synctext »

coderintherye wrote: post #35

This is a great write-up for introducing some of these concepts. For those who want to go deeper, highly recommend reading up more on DIDs https://w3c.github.io/did-use-cases/ Verifiable Credentials: https://www.w3.org/TR/vc-data-model/ Some people working in the space to follow: https://twitter.com/kimdhamilton https://twitter.com/IdentityWoman https://twitter.com/ChristopherA Also highly recommend this paper by Fen…

This essay introduces Self-Sovereign Identity very nicely! Even deeper deep dive into this topic :

Sybil attacks are not solved with the "Soul" bound reputation approach. This was mathematically proven some years ago by Harvard University phd student Sven[0]. See his impossibility results on "weakly beneficial Sybil attacks" and "single report responsiveness property". The blockchain crowd has not yet discovered this, fake identities are an unsolved problem.

Startups be aware. European Commission now has an official "26 000 000.00 EUR" "estimated value" open offer for SSI wallet solutions [1]. Prior for basic service called "EBSI" was 35 million, won by IBM Hyperledger. That now works, Dev API [2]. Upcoming Europe directive states that by 2024 all citizens can apply for a digital identity, if they want one.

(self-promotion..) State-of-the-art: Delft University trustless SSI solution with running code and field-tested zero-knowledge proofs. Scientific publication "A Truly Self-Sovereign Identity System", published at IEEE LCN conference[3]. Disclaimer: we got the government contract for doing privacy-first digital identity. We integrated our own Tor-fork based on UDP for solid privacy with verifiable credential stack, see Github deep link [4].

[0] https://dash.harvard.edu/bitstream/handle/1/4907301/Seuken_S... [1] https://ted.europa.eu/udl?uri=TED:NOTICE:309685-2022:TEXT:EN... [2] https://ec.europa.eu/digital-building-blocks/wikis/display/E... [3] https://arxiv.org/pdf/2007.00415.pdf [4] https://py-ipv8.readthedocs.io/en/latest/basics/identity_tut...

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#86

Post by slx26 »

meheleventyone wrote: post #58
georgelyon wrote: post #42

This is an excellent write-up, and I genuinely hope that the brain-cycles the web3 world is spending on this eventually benefit the rest of society. I’ve been musing about a similar but more simple problem: how can we prove we are an individual human in the context of a web service. Think of this like the ultimate CAPTCHA where not only can you prove you are human but every person can do so at most once or, more prag…

In Iceland we already have digital identity from a centralised authority. I log into my bank, health service, sign papers (including loans) and so on with a government managed digital ID. So this isn’t even something that needs invention let alone by web3.

But does it allow you to anonymously prove that you are a human? You don't want to go telling random websites who you are.

No one says this can't be done. In fact, it's explicitly mentioned in the essay, that the problem this approach has is that it's centralized and you typically can't use it as an anonymous proof of humanity, or disclosing information selectively.

So, why is this important? Well, while you can still make a website and trust you won't be popular enough to become a target, the truth is that without proof of uniqueness / humanity, many services and systems can't be put to the service of the people without potentially falling into an insane battle against spam, in protection of user data, in protection of privacy, etc. And while you can absolutely build lots of things without giving a shit about all this and actually be successful, it's simply immoral (and progressively becoming more and more legally restricted). If this was a solved problem, digital services could finally become truly democratized. Nowadays, this is the main issue preventing many programmers from setting up useful services, very often intended to serve the local community, requiring us instead to start a whole company, getting in touch with some lawyers and storing user data like their actual state IDs. Which we can't do if we don't intend to monetize the service! Without this barrier, we could really do a lot more for our local communities in the digital space.

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#87

Post by davidgerard »

forum_ghost wrote: post #75
dmitriid wrote: post #67

Earlier quoted context omitted.

> too often have simple counter arguments If only there was anyone to provide those. > That's the reason they're not addressed No, it's not the reason. Because you'd think that after a decade there would be blog posts or articles with coherent explanations of how these problems are tackled. Nope. All we hear is "there are arguments but we won't show them to you just join the discords believe in blockchain so many sma…

There are endless blogs and forums with these arguments chewed out, just a google search away. Molly sounds like someone with an agenda of wilful ignorance due to how easily rebuttals of her arguments can be located, and thus it’s a waste of time to even engage.

see, this would have been the perfect moment to link your three favourite slam-dunk examples, which I assume from your comment you have right there to hand.

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#88

Post by hGkXBvR »

lottin wrote: post #78
hGkXBvR wrote: post #68

There are two interesting aspects of self-sovereign identity that are not worth hand-waiving away as dystopian: - it provides identity tools that use standards that span across geographical and platform boundaries. this is a different form of “user account” than say an online Amazon or NYStateGov account. it is good to have an option on the web for auth and identity that is detached from any single corporate entity o…

Why would anyone sign a message on a public ledger?

All messages on a blockchain ledger are signed messages.

A practical example is signing the message “I, user 1234, am sending 1000 USDC to user 5678”

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#89

Post by nverno »

strogonoff wrote: post #82

The problem I have with blockchain enthusiasts, after talking with them about their philosophy, is that they seem to consider trust a bug, and believe that ideal world is achievable with straitjackets of technical solutions that eliminate trust. Trust is a feature, not a bug. If trust is violated by rogue agents, it is because they exist[0], not because trust itself is a folly. However, blockchain-adjacent initiative…

Everyone is a potential threat, that's the whole point of trust in the first place. If that wasn't the case, trust (in terms of safety) wouldnt even be a thing.

Re: Is “acceptably non-dystopian” self-sovereign identity even possible?

#90

Post by TheOtherHobbes »

atoav wrote: post #56
rglullis wrote: post #48

From a first read, the following problems I see in this critique: - The trilemmas do not need to be solved . They just need to be acknowledged when you are designing your application so that people can understand the types of trade-offs being made. In cases where sybil-resistance is not a requirement, you can build a system that gives you privacy and decentralization. When sybil-resistance is required, you just need…

As a web3 critic, my criticism is not that there can be only one, it is that all the proposed web3 stuff that I read about is just an existing thing with extra steps. If I were to build a blog system I would not store the blog posts in a local merkle tree. Why not? Because a regular database has more benefits. Now why would I want to store the data on a decentralized public merkle tree (blockchain)? I don't want my b…

The issue I have with web3 is that it's libertarian politics pretending to be a technological solution. "Decentralised" is being sold as "Out of reach of governments" - but that's clearly not true.

It's also ridiculously poor value-generated-per-Watt-used.

It's in the same conceptual class as "gun culture makes everyone safer" and "lowering taxes on rich people makes everyone richer" - both of which are trivially falsifiable, but repeated fervently by promoters and adherents, some of whom are acting in bad faith.

The root comment is correct - you can't enforce trust in a low-trust culture.

The real problem is the culture. And especially the fact that in a low-trust culture, successful scamming is considered a major status marker.

Post reply on HN