Comment by rsync | Hacker News Reader

Comment by rsync | Hacker News Reader

Parent Full thread

"We need a good solution to identity. Right now most web services use 'has control of an email account,' while some others — to include email services — use 'has control of a phone number.'"

I nominate Oh By Codes[1], for obvious and selfish reasons.

We are currently working very simple, human (and machine) readable markup tags that you can put into your own, personal Oh By Code, which can then be used as your comprehensive contact token - and possibly for identity.

I just ordered a small stack of business cards that have nothing on them but:

0 x JOHN

and I will populate that, my personal code[2], with things like <pgppubkey></pgppubkey> and <phone></phone> and <email></email>. Then, instead of a cluttered up business card (or annoying, long interactions over the phone trying to spell out my email address, etc.) I can just direct interested parties to my Oh By Code which will contain whatever it is that they need.

Since the usable bits are in tags, you could do things like log into services, or address email, or dial a phone not with the phone number, but with the Oh By Code.

Yes, I am well aware of the enormous, almost insurmountable chicken and egg problem of Oh By Codes not being useful until everyone knows what they are.

[1] https://0x.co

[2] free codes are random and immutable. Custom codes can be chosen and can be edited.

> Yes, I am well aware of the enormous, almost insurmountable chicken and egg problem of Oh By Codes not being useful until everyone knows what they are.

I fail to see how what an "oh by" code achieves that cannot be achieved by an URL, save for the subjective beauty of the format looking like 0xffffff.

Plus, if this became a thing, everybody would have to put their total trust in "PERFECT PRIVACY, LLC" or "Oh By, Inc.", which seems a step backwards from the distributed nature of DNS.

Would you mind expanding a bit and explaining how this system can be used to log into services? That doesn't seem to be so obvious.

"I fail to see how what an "oh by" code achieves that cannot be achieved by an URL, save for the subjective beauty of the format looking like 0xffffff."

You're correct. Sadly, in 2016, it appears that most people aren't creating and maintaining their own web pages. I wish this weren't the case, but it is.

What's nice about an Oh By Code, other than being a lightweight (throwaway ?) website that you can (optionally) create for free is that you can communicate the "URL" in real life. You don't need a computer to pass on an Oh By Code. You can chalk it on the sidewalk or write it on a post-it note in a way that is difficult with URLs or other schemas (like email addresses).

In fact, it's even shorter and quicker than a phone number.

"Plus, if this became a thing, everybody would have to put their total trust in "PERFECT PRIVACY, LLC""

That's true. I'd say we have as good a track record as anyone. It's worth mentioning that the rsync.net warrant canary, which was the first warrant canary, turned ten this year.

"Would you mind expanding a bit and explaining how this system can be used to log into services? That doesn't seem to be so obvious."

I'm not sure. We're brainstorming ways in which it makes sense to give people an Oh By Code instead of giving people a phone number and this seemed to relate to this discussion. As I said, my new business card will have nothing on it except 0xJOHN.

A phone number is presumed to have some level of identity proofing behind it (i.e. control over the phone number means you have a credit card, bank account, photo id, etc.).

As the article points out, this turns out to be rather easy to spoof.

How do "oh by" codes solve this issue? What if I print up a bunch of business cards with 0xJOHN?

Identity proofing is a hard problem!

Reply on news.ycombinator.com