Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Who owns your ATProto identity?

kevinak.se

Post reply on HN
Print view View original

111–120 of 159 posts

Re: Who owns your ATProto identity?

#111

Post by Zambyte »

handoflixue wrote: post #25
rbren wrote: post #17

Who owns your domain name? Hint: it’s probably not you. Your hosting provider could take down your domain, or even steal traffic and direct it to their own IPs

Can you move a DNS record AND make it look like I signed off on it? The author's concern seems to be more focused on impersonation

Do you use your own CA? Would you expect users to even notice if the certs were suddenly issued by LetsEncrypt? Or are you signing traffic using something other than TLS, where the domain name doesn't really matter anyway?

Re: Who owns your ATProto identity?

#112

Post by [deleted] »

mdasen wrote: post #31
jacobgold wrote: post #16

One of the core features of AT is the ability to move your repo hosting provider (PDS) at any time. This is the "data portability" problem that ActivityPub never solved. Bluesky Social, PBC runs a PDS service (bsky.social) for free, there are a number of free public alternatives, and thousands of users self-host. Self-hosting your own PDS can be done with Raspberry Pi or $5/mo VM and requires very little work. It run…

You have the ability to move, as long as Bluesky Social PBC allows it. They hold the keys for your DID. If they don't allow you to move to another PDS, you can't move. The original theory was that you'd hold the private keys, but that's something that would hugely limit adoption so they decided to hold the keys themselves. In terms of moving your backlog of posts to a new server, part of the issue is liability (not m…

[deleted]

Re: Who owns your ATProto identity?

#113

Post by OneDeuxTriSeiGo »

Aurornis wrote: post #53
jacobgold wrote: post #48

Earlier quoted context omitted.

Your DNS provider can obtain a TLS certificate for your domain and cryptographically impersonate https://yourdomain.tld It's not exactly the same thing but it's close.

Still not the same thing as in the article. Server side TLS certificates are widely understood to be tied to the current owner of the domain. In a social protocol or context, I would expect a private key to be in the private control of the individual, such as when someone uses their private key to sign an email or git commit. The purpose of signing your emails or commits is to provide a good indicator that it actuall…

> The purpose of signing your emails or commits is to provide a good indicator that it actually came from you, not someone who managed to get access to your email account at the time.

This is true and it's still true in the ATProto ecosystem but in a different context.

It asserts that events and records are authored by your PDS, not by you specifically. Which is certainly closer to the intent of TLS certs.

And technically you can maintain a PDS proxy that can only host, broadcast events, and receive content but that doesn't have any keys or signing capabilities.

Then you can have a local PDS that does your signing and sends signed events and records (basically signed state updates) to the PDS proxy to actually emit to the network. This then allows you to lock your keys behind a hardware key to better lock everything down. Of course there are trade offs to this. If it requires physical auth then it can only work on one device at a time or you have to self host it homelab style at which point it might just make more sense to host the PDS yourself anyways.

There's a project thats working on this very thing but I've not kept up with it and I can't remember what the name of it is. If any ATproto people in the comments knows the name/link feel free to reply under this to enlighten me + everyone else.

Re: Who owns your ATProto identity?

#114

Post by verdverm »

jacobgold wrote: post #108
verdverm wrote: post #103

Earlier quoted context omitted.

It is confusing to say "users" when it is actually "accounts", humans tend to associate "user" with another human, where as "account" can cover people and bots (many on atproto) eg. I personally had more than a dozen accounts

That's a fair distinction to make but my (educated) guess is that something like 95% of users have a single account on Bluesky. Most users signed up by downloading the app or visiting the web site and created a single account. As a point of reference, the official Google Play store independently verifies that the Bluesky app has had 10M+ installs. https://play.google.com/store/apps/details?id=xyz.blueskyweb... There…

I would counterpoint that a non-insignificant number of the accounts are spam/bots. Jaz's stats overestimate because it does not remove certain accounts which have been takedown/deleted, let alone those that remain. I have shared analysis of this on HN, Bluesky, and Discord to avoid making educated guesses.

The reality is that a significant chunk (>50%) was Blue MAGA, or turned off by them, and I see little prospect that they will reactivate. Outside of the Bluesky echo chamber, there is a deep brand association with Bluesky being primarily political refugees. They see Bluesky as the left-wing Truth Social. I've asked hundreds of people IRL if they have heard of Bluesky, they are far more likely to have this brand association than to have heard of "atproto" (more than half vs 1-2% / can count on one hand).

Re: Who owns your ATProto identity?

#115

Post by nekusar »

EGreg wrote: post #79
nekusar wrote: post #60

Earlier quoted context omitted.

> Yes you do own your domain, as much as you can own your house Uh, no. I can legally shoot and kill intruders due to castle doctrine and stand your ground laws in my physical home. And legal invasions require being in front of a judge and a search warrant. A domain can be seized for 'terms of service' (aka kangaroo court) reasons. Stand your ground nor castle doctrine doesn't apply to your digital house.

Let's compare apples to apples, shall we. How many houses were actually seized, repossessed, commandeered with "eminent domain", slowly taken over via "adverse possession", encroached on with easements and air rights, and whatever else? Versus how many domains? There is no violence on the internet. You can't shoot intruders. And that's a great thing. Put in legal terms, you do NOT have this level of ownership to your…

I'm not sure where you're from, but in my state, we have "Castle Doctrine" and "Stand your Ground" laws.

That means if you are a home invader, I can legally shoot and kill you. There'll be an investigation, but both statutes are affirmative defenses to killing.

Its not that I want to, or look forward to it. I don't, and I hope I never have to. But I will, if I'm forced.

Re: Who owns your ATProto identity?

#116

Post by verdverm »

quasigod wrote: post #110
mdasen wrote: post #31

Earlier quoted context omitted.

You have the ability to move, as long as Bluesky Social PBC allows it. They hold the keys for your DID. If they don't allow you to move to another PDS, you can't move. The original theory was that you'd hold the private keys, but that's something that would hugely limit adoption so they decided to hold the keys themselves. In terms of moving your backlog of posts to a new server, part of the issue is liability (not m…

You can register a recovery key which allows overriding the signing key. This allows users to move from an adversarial PDS. I do think Bluesky should push for more users to add a recovery key, but I also understand why they haven't. Moderation tools arent limited to specific PDS's, labels are public. If an account has received many reports it will have been labelled by Bluesky's moderation account and other independe…

How to adversarial migrate: https://www.da.vidbuchanan.co.uk/blog/adversarial-pds-migrat...

*requires your own PLC key, which the vast majority of users do not have, protonmail has good prior art here (imo)

Re: Who owns your ATProto identity?

#117

Post by drdexebtjl »

rbren wrote: post #17

Who owns your domain name? Hint: it’s probably not you. Your hosting provider could take down your domain, or even steal traffic and direct it to their own IPs

I do. I registered it directly with my ccTLD’s registry, which is a government agency. It’s tied to my national ID number, or to my company’s tax ID.

If my DNS provider messes up, I revoke their DNSSEC keys and point my domain to a different provider.

Domain registration should be national public infrastructure.

Re: Who owns your ATProto identity?

#118

Post by ranger_danger »

refulgentis wrote: post #70
ranger_danger wrote: post #63

Earlier quoted context omitted.

I think the main problem is you can't really ever tell with a high degree of certainty, people are just guessing based on what they see in an unscientific way. And the fact that AI is trained on human data, meaning what we see is in fact things humans have already done themselves, makes it even harder to "know" for certain IMO.

> the main problem is you can't really ever tell with a high degree of certainty This is false, it is trivial to find humans with 99%+ accuracy[1] and there is a well-known service with 99%+ accuracy when analyzed by 3rd parties with no affiliation.[2] > people are just guessing based on what they see in an unscientific way As we see above, this is just guessing in an unscientific way. :) It's important to be rationa…

> This is false, it is trivial to find humans with 99%+ accuracy

Sorry but no, this is also false. AI is largely trained on human data. What it outputs is also largely what a human would output. We could both easily make up the exact same sentences (especially smaller ones) and there is NO way to tell what the real source of a sentence is, especially considering the source can be multiple things (AI and human) at the same time!

There is no amount of literature you could provide or anything you can do or say that would change my mind on this.

Re: Who owns your ATProto identity?

#119

Post by jacobgold »

verdverm wrote: post #114
jacobgold wrote: post #108

Earlier quoted context omitted.

That's a fair distinction to make but my (educated) guess is that something like 95% of users have a single account on Bluesky. Most users signed up by downloading the app or visiting the web site and created a single account. As a point of reference, the official Google Play store independently verifies that the Bluesky app has had 10M+ installs. https://play.google.com/store/apps/details?id=xyz.blueskyweb... There…

I would counterpoint that a non-insignificant number of the accounts are spam/bots. Jaz's stats overestimate because it does not remove certain accounts which have been takedown/deleted, let alone those that remain. I have shared analysis of this on HN, Bluesky, and Discord to avoid making educated guesses. The reality is that a significant chunk (>50%) was Blue MAGA, or turned off by them, and I see little prospect…

Sure, it may overestimate the exact count, but that doesn't change the fact that tens of millions of real people have downloaded Bluesky and signed up.

Right now, Bluesky has one large community, which is already great for some people but not most people. Once Bluesky adds Communities, new communities can form, making it interesting to the other 90% of people who were excited initially and then turned off by it being "one note".

Re: Who owns your ATProto identity?

#120

Post by drdexebtjl »

bluebarbet wrote: post #67
refulgentis wrote: post #58

Earlier quoted context omitted.

> "This was AI" itself has all the tells of an irrational panic which typically accompanies new technology, Being able to tell who wrote something doesn't imply irrationality, panicking, or a reaction to new technology. > like UFO sightings in the 1950s. UFO sightings stayed confined to the 1950s and were a reaction to new technology? Or were the UFO sightings in the 1950s the only UFO sightings that were a reaction…

So I just read the article a bit more closely, and personally I see no reason to panic like you (and others here) are doing. The AI suspicion was presumably triggered by one of the subheadings, which follows the "It's not X, it's Y" schema. At this point it's almost a meme that this betrays AI. But I say: who cares? The substance and the authenticity are what count. This article made some interesting points, and it w…

It’s not just that subheading, it’s a recurring pattern.

It’s not about authors using AI, it’s about authors not respecting the reader’s time.

Writing has a multiplicative force. The writer only needs to spend time writing it once. The text will reach thousands of readers who will collectively spend a lot more time on it than the author.

If even with that asymmetry, the author is not willing to put effort into writing it, I’m not going to bother reading it, regardless of the text’s substance. I’m just not interested.

Post reply on HN