Live data from Hacker News

Who owns your ATProto identity?

kevinak.se

21–30 of 159 posts

Re: Who owns your ATProto identity?

#21
post #17

Who owns your domain name? Hint: it’s probably not you. Your hosting provider could take down your domain, or even steal traffic and direct it to their own IPs

that is why you have did:plc in ATProto but that doesn't resolve the concerns raised in this article.

Re: Who owns your ATProto identity?

#22
Is author new at the whole web thing? Yes, people trust remote web servers. Yes, if you link multiple apps to an identity server (be it atproto, google, or self-hosted OpenID server), and your identity server is compromised, attacker will be able to impersonate you or lock you out.

This is just how the web works, and there is no easy around it without losing features people care about. Sure, you can do client-side encryption and pretend serve can't see the plaintext, but it's just a theatre, see Hushmail incident for example.

And having people export uber-key by default is pretty terrible idea. Sure, allow advanced users (like post author) to do it. But for the common person, the exported key is just another way to get account compromised, via malware or backup provider hacking. Or if they are not backing up stuff, then the key will get lost next time they upgrade.

Re: Who owns your ATProto identity?

#23
post #8

Centralization is always a trap. No idea why people have such a hard time joining and supporting the Fediverse.

How is the fediverse different. Can't the owner of an instance post as you? Can they read all your data stored on their instance and pass it to anyone they want to?

Re: Who owns your ATProto identity?

#24
post #7

Earlier quoted context omitted.

Source? What I see here doesn't look good. https://bluefacts.app/bluesky-user-growth Never mind the pivot to reddit. https://www.cnbc.com/2026/06/04/bluesky-twitter-rival-reddit...

What’s the definition of success here? Instagram like user counts?

Arguing that success is purely about the ultra high numbers seems to miss the forest for the trees. Is HN a failure because it did not reach the level of DAU as Reddit? The quality of discussion and community here is certainly substantially higher. I feel the same about Mastodon and Bsky vs Twitter. I’ll take community I actually want to engage with over sheer numbers any day.

Re: Who owns your ATProto identity?

#25
post #17

Who owns your domain name? Hint: it’s probably not you. Your hosting provider could take down your domain, or even steal traffic and direct it to their own IPs

Can you move a DNS record AND make it look like I signed off on it?

The author's concern seems to be more focused on impersonation

Re: Who owns your ATProto identity?

#26
post #7

Earlier quoted context omitted.

Source? What I see here doesn't look good. https://bluefacts.app/bluesky-user-growth Never mind the pivot to reddit. https://www.cnbc.com/2026/06/04/bluesky-twitter-rival-reddit...

What’s the definition of success here? Instagram like user counts?

[deleted]

Re: Who owns your ATProto identity?

#27
post #4

This is where non-financial use of blockchain could really shine, IMO. Self-sovereign identity management with a smart contract-based process for recovering ids if keys get lost or hacked. Blockchains are pretty out of favor these days, but I really don't see a better solution for decentralized identity management.

> smart contract-based process for recovering ids if keys get lost or hacked How would that even work?

If someone's account gets lost or hacked, the person with the most incentive to own that account is usually the original owner, so just give it to whoever is willing to pay the most, problem solved. We can call it "proof of stake", where you always stake a certain amount to keep owning your account, and when contested, whoever stakes the most gets it.

Poor people don't deserve rights on the blockchain anyway, it's not like they can afford the transaction fees, if they didn't want their account stolen they should have tried being rich, or buying into nearer the top of the pyramid.

Don't worry about people who pass away or lose internet for an extended period, we'll deal with that in v2, when we get "proof of death" and "proof of internet disconnectivity" on the blockchain somehow.

/s if it's necessary

Re: Who owns your ATProto identity?

#29

One of the core features of AT is the ability to move your repo hosting provider (PDS) at any time. This is the "data portability" problem that ActivityPub never solved. Bluesky Social, PBC runs a PDS service (bsky.social) for free, there are a number of free public alternatives, and thousands of users self-host. Self-hosting your own PDS can be done with Raspberry Pi or $5/mo VM and requires very little work. It run…

Except it isn't as straightforward as most people would think. The last time I checked this, I think there were some issues with Bluesky app view and it didn't show accounts from a self hosted PDS

Re: Who owns your ATProto identity?

#30

Most people don’t worry about it for the same reason they don’t worry about GitHub abusing their GitHub account and are even willing to use “login with GitHub” to access their other accounts. Account takeover by a third party is a bigger risk. If you’re concerned about supply chain risks, there are more important concerns than “what if GitHub itself is a bad actor.” It’s solvable if you’re willing to self-host your P…

This "social coding" thing Tangled has going on is cool but I don't want it. I hear they're figuring out private repos but for me, I don't want the same account I use for social for my code.

I'm probably in the minority though.

Post reply on HN