Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who owns your ATProto identity?

kevinak.se

Post reply on HN
Print view View original

81–90 of 159 posts

Re: Who owns your ATProto identity?

#81

Post by tarpitt »

SkiFire13 wrote: post #12
scyclow wrote: post #4

This is where non-financial use of blockchain could really shine, IMO. Self-sovereign identity management with a smart contract-based process for recovering ids if keys get lost or hacked. Blockchains are pretty out of favor these days, but I really don't see a better solution for decentralized identity management.

> smart contract-based process for recovering ids if keys get lost or hacked How would that even work?

Perhaps some sort of namecoin or ENS-like petname system with multisig or some type of scripting that enables different recovery methods.

For example, you could set your petname up so it can be controlled by a single keypair, which can be overridden after a certain time by a ring signature based on keypairs held by friends, family, peers, and trusted computing devices you leave in a safe deposit box.

Or maybe you could trust your identity with some centralized entity, but only as part of a 2-of-3 multisig with yourself and another trusted entity.

Basicially namecoin with bitcoin-like scripting controls.

Re: Who owns your ATProto identity?

#82

Post by EGreg »

tptacek wrote: post #52
EGreg wrote: post #42

Earlier quoted context omitted.

Yes you do own your domain, as much as you can own your house. Your hosting provider can only take down your hosting, not your domain. Seizing domain names isn't very common. And by the way, with Web3 domains, you have full ownership via your own private key, with no need to pay rent. Is it possible to lose your house that you own? Yes. It's far more rare to lose a domain you own, by it being seized. DNSSec is used t…

In addition to the fact that almost nobody uses DNSSEC, it solves none of the problems indicated by this article.

Right, but neither do these problems apply to domains, as much as they apply to ATProto accounts.

You don't even have the frameworks that are available to protect domains. (Domain lock, transfer, etc.) And registrars are regulated by laws and frameworks in ways ATProto hosts aren't. Don't get me wrong, if a registrar transfers your domain due to a social engineering attack on the registrar, then you might lose it (an attacker almost did this to me once via a SIM swap, and I had to call GoDaddy to prevent the transfers). But that's not the same as, say, hacking the web hosting server.

In any case, tptacek, Safebox is supposed to solve these actual problems, by making sure no one can actually get into the box (no ssh, etc) so it's a "neutral ground" that no one can really "own", "redirect", steal keys or impersonate you. If you read https://safebots.ai/about you'll see what I'm talking about. If you do, I'd love to read any feedback you might have, given your background in security!

Re: Who owns your ATProto identity?

#83

Post by AndrewStephens »

majorchord wrote: post #66
AndrewStephens wrote: post #5

Earlier quoted context omitted.

What is the incentive for an individual to participate in a non-financial blockchain? Bitcoin-style blockchains “work” because everyone gets the possibility of a little reward for all the hassle and non-negligible CPU time of being a node.

For me the incentive is being able to own an identity that nobody can take away from me. And the assumption is that services will support this type of identity, so I don't have to make accounts on other systems that people can take away and now I've lost all access to any data I had.

I think what you are looking for is something like Mastodon or related activity-pub service. You can run your own instance and nobody can take that away from you. No need to drag a blockchain into it - just host whatever services you need.

Re: Who owns your ATProto identity?

#84

Post by skybrian »

Aurornis wrote: post #49
skybrian wrote: post #13

Most people don’t worry about it for the same reason they don’t worry about GitHub abusing their GitHub account and are even willing to use “login with GitHub” to access their other accounts. Account takeover by a third party is a bigger risk. If you’re concerned about supply chain risks, there are more important concerns than “what if GitHub itself is a bad actor.” It’s solvable if you’re willing to self-host your P…

> Most people don’t worry about it for the same reason they don’t worry about GitHub abusing their GitHub account Even with GitHub we don’t hand over our private keys to the GitHub server, though. When I commit to my repos the commits are still signed by the private key that lives on my computer. Someone could take over my GitHub account and they wouldn’t be able to sign commits with the private key on my PC. They co…

Good point, but how many projects require people to sign their git commits? it's not something I've had to do at all.

If you're not signing them then hosting on GitHub gives GitHub the ability to do arbitrary commits in your name. The repo's HEAD is whatever GitHub says it is.

Re: Who owns your ATProto identity?

#85

Post by ftfish »

jacobgold wrote: post #77
ftfish wrote: post #68

Earlier quoted context omitted.

A chunk of these registered users are apparently "ghost accounts" hosted on a PDS on a trump.com subdomain. https://bsky.app/profile/tyggero.cz/post/3moskpisnuc2t Source: https://sifa.id/stats Statement from Bluesky: https://bsky.app/profile/pfrazee.com/post/3mmp27wwnic2j

Based on your comments, it seems like you're trying to spread FUD? The stats page you linked to explains exactly what's going on. These spam PLC identities have nothing to do with with the tens of millions of real Bluesky registered users. Either you misunderstood or you're being intentionally dishonest.

Never said that, though, plus provided sources. Just adding context for what the total number of users means.

Re: Who owns your ATProto identity?

#86

Post by tarpitt »

TheDong wrote: post #27
SkiFire13 wrote: post #12

Earlier quoted context omitted.

> smart contract-based process for recovering ids if keys get lost or hacked How would that even work?

If someone's account gets lost or hacked, the person with the most incentive to own that account is usually the original owner, so just give it to whoever is willing to pay the most, problem solved. We can call it "proof of stake", where you always stake a certain amount to keep owning your account, and when contested, whoever stakes the most gets it. Poor people don't deserve rights on the blockchain anyway, it's no…

I think you're right that transaction fees are a key problem. It's ultimately a bandwidth problem. You're bidding for the limited vbytes, and the bidding price only increases with traffic, kicking poor users out.

I think the key thing to recognise with petname systems is that there doesn't need to be this sort of "top-level consensus" as opposed to ecash systems.

You can have two instances of namecoin, say Namecoin1 or Namecoin2. You can just have different domains like alice.nmc1 and bob.nmc2 and have them interoperate properly. You can just keep forking blockchain-based petname systems to overcome the bandwidth/fee problem.

What this means is that Namecoin1 full nodes don't need to synchronize all the domain names on Namecoin2 and vice-versa. Similar to TLDs on DNS. We can imagine that there might be different petname TLDs for different global regions, and they might be merge-mined.

This isn't true for money applications like bitcoin or eth, because by forking BTC or ETH or something, you are creating new coins.

Re: Who owns your ATProto identity?

#87

Post by jacobgold »

ftfish wrote: post #85
jacobgold wrote: post #77

Earlier quoted context omitted.

Based on your comments, it seems like you're trying to spread FUD? The stats page you linked to explains exactly what's going on. These spam PLC identities have nothing to do with with the tens of millions of real Bluesky registered users. Either you misunderstood or you're being intentionally dishonest.

Never said that, though, plus provided sources. Just adding context for what the total number of users means.

You still seem to be implying the number of real registered users on Bluesky isn't ~50M, which it is. The PLC identity spam you referenced is not being counted in this number.

Re: Who owns your ATProto identity?

#88

Post by tarpitt »

AndrewStephens wrote: post #83
majorchord wrote: post #66

Earlier quoted context omitted.

For me the incentive is being able to own an identity that nobody can take away from me. And the assumption is that services will support this type of identity, so I don't have to make accounts on other systems that people can take away and now I've lost all access to any data I had.

I think what you are looking for is something like Mastodon or related activity-pub service. You can run your own instance and nobody can take that away from you. No need to drag a blockchain into it - just host whatever services you need.

except for your domain registrar and your PKI certificate authority

Re: Who owns your ATProto identity?

#89

Post by drdexebtjl »

opem wrote: post #37
noname120 wrote: post #28

AI fluff

and what makes you say that?

> It's not the data, it's the keys

is a heading

edit:

>On ATProto, your PDS doesn't just store your Bluesky posts. It stores everything.

>Not just your Bluesky account. Your ability to post, commit, publish, or interact across every ATProto app.

>The repo data itself isn't the issue. It's all public anyway,

>An attacker, a state actor with a warrant, or a rogue employee doesn't just get read access. They get the signing keys

Re: Who owns your ATProto identity?

#90

Post by skybrian »

pocksuppet wrote: post #78
skybrian wrote: post #13

Most people don’t worry about it for the same reason they don’t worry about GitHub abusing their GitHub account and are even willing to use “login with GitHub” to access their other accounts. Account takeover by a third party is a bigger risk. If you’re concerned about supply chain risks, there are more important concerns than “what if GitHub itself is a bad actor.” It’s solvable if you’re willing to self-host your P…

The whole claimed point of ATProto is to avoid stuff like this. If centralization isn't a problem, just use GitHub, or X, because platforms that don't try to decentralize work better.

If you assume that Bluesky won't suddenly turn hostile (we'll get some warning) then being able to migrate your PDS is better than what X gives you and about the same as being able to move your git repo off of GitHub.
Post reply on HN