Live data from Hacker News

The Future of Online Identity Is Decentralized

yarmo.eu

131–140 of 202 posts

Re: The Future of Online Identity Is Decentralized

#131

The future of online identity is centralized. China is already there. At age 16, you get your picture and fingerprints taken. If you get a phone, its ID is tied to your personal ID. Your WeChat account is tied to that ID. If you ride the subway or bus in a major city, or a train, your ID is recorded when you pay. A combination of phone tracking and facial recognition records where you go in some cities. It's even use…

Real ID is a contract between the federal government and the states about the security of their existing ID issuing processes. It covers things like, don’t leave ID printers and card stock in podunk branch offices where $12/hour staff can let in their friends at night. Use printing processes that are sufficiently hard to replicate. If your freedom relied on stuff like this, you were already an outlaw, the only implication of Real ID is that now you will need stronger technical skills to produce your next convincing fake. It has nothing to do with where and whether IDs are required. Airport and courthouse security have been requiring IDs for many years now.

Re: The Future of Online Identity Is Decentralized

#134
> Removing the possibility for anonymity could solve the problem of online toxicity.

Except that it's not possible. And worse, it's just hard enough to evade that only those with malicious goals will manage it.

> Large internet corporations like Google and Facebook allow all to create an account on condition that some personally identifiable information is revealed, usually a phone number.

Also Signal, sadly enough :(

> The benefit is that it deters most from repeatably creating new accounts when older accounts have been flagged or banned due to improper behavior. These companies gain the function of "identity provider": they manage your online identity that can be used to login in different locations of the internet. We all know many websites that offer a "Google login" or "Facebook login".

Yes, it "deters most". And mainly it deters vulnerable people, who need ~anonymity to protect themselves from adversaries. It doesn't deter spammers, trolls, scammers, bot operators, and such. There are just so many ways to use multiple phone numbers. Ranging from free websites to SIM banks. And actually, it's easier just to buy accounts, either fresh or old (which probably means stolen).

So even without getting into concerns about corporate gatekeepers, it's clear that this is a misguided approach.

Re: The Future of Online Identity Is Decentralized

#135

Earlier quoted context omitted.

Linkedin/Facebook/Email login establish that it is the same "person" coming back. They don't guarantee the identity of the person as in official name or address or date of birth.

is this a distinction without a difference? Networks like LinkedIn exist for the purpose of building real social capital and that's how they're used by 99% of their users. I don't see the incentive for someone to use a fake persona (other than scamming). All those private firms are in many ways identity providers just as real and official as governmental ones.

It's a massive difference. Consider linkedin vs national UK login.

The later one guarantees the identity: full name, date of birth, address, verified phone number, last taxable income, etc...

It allows to request government benefits or open a bank account online, because the identity is guaranteed. There is a real verified person behind the account. (corollary: you will be in troubles if somebody gets credit cards under your UK identity).

On the other hand, it's not great if that identity is required to apply to a job. The company can see your passport after they hire you. There is no need for every job board and recruiter and company to systematically get all your personal information in advance.

Re: The Future of Online Identity Is Decentralized

#136

I agree with a lot of this post. A lot of the left-leaning intellectuals that are now criticizing the harder-left stances in academia; people like Brent Weinstine, Jonathan Haidt, Sam Harris, et. al. ... I've heard all of them say they want less anonymity and more accounts tied to real identities. Whenever I hear this I think, "What? No! That's the opposite direction we should be going." Identities that are hard lock…

On the contrary, I advise everyone to use real-name identities wherever they can. I understand that pseudonymous and real name accounts have fundamentally different approaches, but I think, for the majority of people, pseudonymous accounts are a mistake. The reason is simple. In 2020, everybody is a brand. Things have become competitive to the point that the inevitable happened: business has occupied free time. We co…

Why not do both?

As you say, using your real name builds your brand. However, you must then be very careful to avoid saying stuff that damages your brand. And as you basically say, you must therefore censor yourself online.

So why not do other stuff using pseudonyms? That's exactly why I started using them. I'm retired now, so there's really nothing about my meatspace identity to protect. But when there was, having the freedom to express myself honestly online was important to me. In particular, because I had to police my meatspace behavior so carefully.

Re: The Future of Online Identity Is Decentralized

#137

Earlier quoted context omitted.

Linkedin/Facebook/Email login establish that it is the same "person" coming back. They don't guarantee the identity of the person as in official name or address or date of birth.

is this a distinction without a difference? Networks like LinkedIn exist for the purpose of building real social capital and that's how they're used by 99% of their users. I don't see the incentive for someone to use a fake persona (other than scamming). All those private firms are in many ways identity providers just as real and official as governmental ones.

> Networks like LinkedIn exist for the purpose of building real social capital

???

No they don't. They exist for the purpose of selling advertising. Any other purpose is either marketing copy to get you to use it or an emergent property based on people believing the marketing. Consider that LinkedIn would continue to exist if it provided no social capital whatsoever as long as it could still get ads in front of eyeballs.

Another observation: whether any specific social network "builds social capital" depends on the demographics of the audience and general "trendiness". People in high school don't care about LinkedIn, professionals in their 30s don't care about TikTok. Does this mean that TikTok should be an "identity provider" to people under 20?

Re: The Future of Online Identity Is Decentralized

#138
post #123

Earlier quoted context omitted.

I dunno, I think the UX for decentralized identity could be made pretty good. The GNUnet project has one that runs locally but exposes itself with an OIDC interface: https://reclaim.gnunet.org/ It's still pretty early, but imagine a more polished version of that with a user-friendly installer. If you had the software installed and running, it'd behave pretty similarly to e.g. Google's OIDC provider. Linux distros cou…

That's so so many steps and requires knowledge of so many things. It has the big two fundamental problems, and a major third one: * Its value prop is poorly explained. As an engineer with a CS degree, I still barely understand what it's talking about (what's an "identity attribute"??) without some digging. * Even if the value prop was well-explained, it's still very high friction compared to "Sign in with ". Why woul…

>As an engineer with a CS degree, I still barely understand what it's talking about (what's an "identity attribute"??) without some digging.

It's not really ready to be used widely at this point. Given that, the fact that the documentation is currently more oriented towards developers working on identity software is fine, I think.

>Even if the value prop was well-explained, it's still very high friction compared to "Sign in with ". Why would a user download an installer and deal with managing all of their accounts? There's a secure, anonymous, easy, centralized option that does it all for you (Sign in with Apple). That service does it so well that you only have to click a button to log in or sign up. Nothing else required. That isn't achievable without a central authority managing everything for you.

Sure, installing software is higher-friction than using a centralized service, but it's not that much higher friction. It's not like people don't install software all the time. (And again, this is something that could easily be preinstalled by your OS vendor of choice, which would make the experience very similar to the centralized providers'.)

>Your local machine is a major point of failure. If you lose your local machine and haven't backed up your accounts, you just lose access, right? The only solution is either set up a server with periodic backup (too much friction for regular users) or a centralized authority that stores them for you, which defeats the purpose of all of this.

Yes, this is a big one. No, I don't think those are the only two options. You could sync them between devices if you have more than one (phone/laptop?), you could store them on a user-specified data storage location (think MIT's Solid), etc. I acknowledge that it's a problem, but I think it's a tractable one.

>This project, to me, falls into the "cool technical stuff category". It's obviously built for "geeks" (lack of a better term) and not for people.

I think you're looking at the project as it is, and not as it could be.

Re: The Future of Online Identity Is Decentralized

#139
> Built for individuals, I recently launched Keyoxide which uses cryptographic keypairs to accomplish decentralized identity verification. While it doesn't (and shouldn't!) link an account to a person in the physical realm, it links accounts across platforms.

I'm glad to see this! Although it seems to be hugged to death right now :( I had been using KeyBase for this, but after the recent sale to Zoom, I've backed away.

Re: The Future of Online Identity Is Decentralized

#140
> On today's internet, the best we can do is make fully separated accounts, link them using technologies like decentralized online identity proofs and create our own online personas, with our own open tools that ensure we maintain ownership over them.

That's for sure how I see it :) It gives everyone the choice of what mix of real names and ~anonymous personas to use, and how to link them.

Post reply on HN