Comment by DenisM | Hacker News Reader

Comment by DenisM | Hacker News Reader

Parent Full thread

My friends and I have thought this through in detail a while ago, and have a few suggestions to make. I hope you make the best of it!

Distributed identity

Allow me to designate trusted friends / custodians. Store fractions of my private key with them, so that they can rebuild the key if I lost mine. They should also be able to issue a "revocation as of certain date" if my key is compromised, and vouch for my new key being a valid replacement of the old key. So my identity becomes "Bob Smith from Seattle, friend of Jane Doe from Portland and Sally X from Redmond". My social circle is my identity! Non-technical users will not even need to know what private key / public key is.

Relays

Introduce a notion of the "relay" server - a server where I will register my current IP address for direct p2p connection, or pick my "voicemail" if I can't be reach right away. I can have multiple relays. So my list of friends is a list of their public keys and their relays as best I know them. Whenever I publish new content, the software will aggressively push the data to each of my friends / subscribers. Each time my relay list is updated, it also gets pushed to everyone. If I can't find my friend's relay, I will query our mutual friends to see if they know where to find my lost friend.

Objects

There should be a way to create handles for real-life objects and locations. Since many people will end up creating different entries for the same object, there should be a way for me to record in my log that guid-a and guid-b refer to the same restaurant in my opinion. As well I could access similar opinion records made by my friends, or their friends.

Comments

Each post has an identity, as does each location. My friends can comment on those things in their own log, but I will only see these comments if I get to access those posts / locations myself (or I go out of my way to look for them). This way I know what my friends think of this article or this restaurant. Bye-bye Yelp, bye-bye fake Amazon reviews.

Content Curation

I will subscribe to certain bots / people who will tell me that some pieces of news floating around will be a waste of my time or be offensive. Bye-bye clickbait, bye-bye goatse.

Storage

Allow me to designate space to store my friend's encrypted blobs for them. They can back up their files to me, and I can backup to them.

> Distributed identity

a very nice person whom i like to call mix made a module for this recently: http://git.scuttlebot.io/%25XJz%2BcF9oIgd1eHYFGg3ycVwowLEseL...

horcrux! also found here : https://www.npmjs.com/package/ssb-horcrux

The part which splits your key is now automated and part of Patchbay. I'll build the resurrection part when someone needs it

I think a lot of this stuff will rely on a more formal spec like https://github.com/solid/solid-spec to be useful.

For identity, there's https://github.com/solid/solid-spec/blob/master/solid-webid-...

Right now I'm particularly interested in https://github.com/solid/web-access-control-spec although I think it's incomplete when it comes to data portability and access control. From what I've seen on re-decentralizing the internet, access control is either non-existent, or relies on a server hosting your data to implement access control correctly.

What if, in the WAC protocol linked above, instead of ACL resources informing the server, we could have ACL resources providing clients with keys to the encrypted resource (presumably wrapped in each authorized agent's pub key). Host proof data is a necessity for decentralized social networking IMO, even if the majority of agents would happily hand their keys over to their host.

For relays, that is more or less what the pub servers do. I connect to a relay, and if I subscribe to a channel or follow an individual, I end up with messages from months ago. The pub servers "gossip" with each other, so any particular pub server you connect to, should be able to catch you up on all of your friends and channels "gossip".

you have had the same ideas as we did! this is roughly how secure scuttlebutt works.

For the distributed identity piece is there a good reason not to rely on keybase.io?

Also important that an initial smaller community would be targeted and that it would succeed there. FB did this will colleges, a federated one would in a world where FB already exists would have an even harder time.

> distributed identity piece is there a good reason not to rely on keybase.io

Depends on your definition of "distributed", I suppose

My impression was that keybase is distributed? Can it be used without talking to keybase's servers?

The Keybase server manages giving out usernames, and recording the proof URLs for users, and then your client hits the URLs, checks that the proofs are signed with the appropriate key, and caches them to watch for future discrepancies.

Keybase offers decentralized trust, in that the Keybase server can't lie to you about someone's keys -- your Keybase client will trust their public proofs and not the Keybase server -- but it's not a distributed/decentralized service as a whole, because you still receive hints from the server about where proofs live, and learn Keybase usernames from it.

(I work at Keybase.)

It looks like SSB is crying out for Keybase integration. Any plans for being able to add a SSB identity to my Keybase account?

Dunno! Would encourage SSB users to post the request to https://github.com/keybase/keybase-issues/issues/518.

Are you working on a fully decentralized architecture?

(Speaking personally, not sure what an official Keybase opinion would be.)

No, I don't think the tech is quite there yet. Even just handing out human-readable usernames requires blockchain-style consensus, and we don't have a blockchain being followed along by everyone's machines to adjudicate consensus requests (yet!).

The folks at Blockstack Labs are doing fine work in this area, though: https://blockstack.org/

Does keybase still upload the private PGP key to the keybase server by default? https://github.com/keybase/keybase-issues/issues/160

We're trying to move away from PGP to a per-device key model (keys never leave the client devices): https://keybase.io/blog/keybase-new-key-model

You did not answer my question, but I guess it does not matter with the new strategy. Looks like embrace-extend-extinguish to me – has it always been a goal of Keybase to replace PGP with something keybase-specific or did something change?

What the heck is keybase ? I went to the website and it does not offer a clue about what this is or how it works. It says "download the app" but is not an app. It says it's more than a website but does not seem to be distributed in any way.

The fact that it failed at the most basic thing of actually telling what it is about, what it does and how would be good reasons to not use keybase.

Reply on news.ycombinator.com